Data Processing Agreement

Scope, and how it is entered into

This agreement applies to all personal data we process for you through the platform. It forms part of the Terms of Service, so accepting those accepts this. There is no separate signature to chase before you are covered.

If your organisation requires a countersigned copy on its own paper, ask and we will sign one.

The subject matter, in the terms the regulation asks for

Article 28 requires a processing agreement to state five specific things. Here they are, without a schedule to hunt through.

The last two are stated as "determined by you" because they genuinely are. A vendor listing them exhaustively is describing its own assumptions, not your data.

Our undertakings

We commit to the following for as long as we hold your data.

• Process it only on your documented instructions, which are this agreement plus what you do in the product. If we ever believe an instruction breaks the law, we tell you rather than quietly complying.
• Keep it confidential, and limit access to the people who need it to operate the platform.
• Hold the security measures described in the next section, and not weaken them during the term.
• Use only the sub-processors listed on the sub-processors page, and tell you before adding one.
• Help you answer a subject request, a data protection impact assessment, or a regulator.
• Tell you about a personal data breach without undue delay and within 72 hours of becoming aware.
• Delete or return the data when the workspace ends, at your choice.

The security measures, named rather than gestured at

Article 32 asks for "appropriate technical and organisational measures". The phrase is meaningless unless the measures are named, so here they are.

• Encryption in transit for every request to the platform and its API.
• Encryption at rest for named sensitive fields, sealed before they are written, with keys held outside the database and rotatable.
• Tenant isolation applied where data is read, so a query missing its workspace returns nothing rather than everything.
• Role-based access control: a tree of apps, modules and actions, granted per workspace.
• Optional second factor, and per-workspace restriction of access by network location.
• An audit log recording significant changes with the actor and the time.
• Uploads served through the platform against your permissions, rather than as public links that keep working after somebody leaves.
• Backups, retained for 30 days, which is also why a deletion completes within 30 days rather than instantly.

Sub-processors

The current list is published on the sub-processors page and is part of this agreement by reference.

We publish a new sub-processor there before it starts processing, and we notify workspace owners who have asked to be told. You can object on reasonable data protection grounds, and if we cannot resolve the objection you may end the agreement without penalty for the unused remainder of your term.

Transfers

Where data moves outside its region of origin, it moves under the standard contractual clauses. The sub-processors page names where each one operates so you can see which transfers apply to you.

Audit

You may verify our compliance with this agreement once a year, and after a breach affecting you, by asking us questions in writing and receiving a written answer.

⚠️ We do not currently hold a SOC 2 or ISO 27001 report to hand you instead, and we would rather say so than let the absence be discovered during a procurement review. If an independent report is a hard requirement for you, tell us. It is a question of when, not whether.

Deletion and return

When the agreement ends you choose deletion or return. Export tools inside the product let you take a copy at any time without asking us.

After the wind-down period the data is deleted from the live system, and it leaves the backups within 30 days of that.