# How does Cyber Crucible support Oregon's Consumer Privacy Act (OCPA)?

**Short answer:** Cyber Crucible operates as a processor under the Oregon Consumer Privacy Act, bound by contract to process only on the controller's instructions and to assist with security and consumer-rights requests. Because it collects essentially no personal data, most OCPA obligations have minimal surface in its custody.

## How it aligns

- **Processor duties** — assist with security, breach response, and data-protection assessments.
- **Data minimization** — no customer content, credentials, or keys collected.
- **Purpose limitation** — processing strictly on the controller's instructions.

## Vendor-selection notes

Oregon's law is notable for a broader definition of personal data and specific consumer rights around named third parties; the minimal footprint keeps the vendor side low-risk. A data processing agreement is available on request.