Why does Maditon not flag everything a supplier's document leaves out?

A finding for something a document does not say is only useful if the document was the place to say it. Maditon therefore ties absences to the document’s kind.

• A data processing agreement owes the Article 28(3) terms: documented instructions, confidentiality, security measures, sub-processor consent, assistance, deletion or return, audit rights — and a breach-notification procedure and a retention statement.
• A privacy policy owes retention, transfer mechanisms, the categories of data and recipients, and how people exercise their rights.
• A sub-processor list owes the list itself and how customers are told when it changes.
• A security page owes the measures and the hosting regions.
• A service level agreement owes the availability commitment and the support channels.
• Terms of service and documents filed as other owe nothing in particular: what they say is recorded and commented on, and their silence is not a finding.

If a document is filed under the wrong kind — a cookie policy registered as a privacy policy, say — it will be measured against the wrong list and pick up absences it does not deserve. Refiling it fixes the reading. Where a document does address a point but the model could not pin down what it commits to, the finding is marked needs verification rather than not addressed, so the two cases are never confused.