Data processing agreement

Terms defined in the General Data Protection Regulation (EU) 2016/679 carry the same meaning here. Customer Personal Data means personal data we process on your behalf under the Terms of service, including everything inside the documents you upload.

You are the controller and we are the processor. You determine the purposes and means of processing Customer Personal Data. We process it only on your documented instructions.

Your use of the service, including opening a case, declaring the data subject, uploading documents, making entity decisions and releasing a bundle, constitutes your documented instructions.

We will tell you if, in our opinion, an instruction infringes the GDPR or another data protection provision, and we may suspend the affected processing until it is resolved.

• Process Customer Personal Data only on your documented instructions, including on transfers
• Ensure that everyone authorised to process it is bound by an obligation of confidentiality
• Implement and maintain the technical and organisational measures in Annex 2
• Respect the conditions in clause 5 for engaging a sub-processor
• Assist you, taking into account the nature of the processing, in responding to data subject requests
• Assist you with data protection impact assessments and with prior consultation, to the extent the information is available to us
• Delete or return Customer Personal Data at the end of the service, as set out in clause 7
• Make available the information necessary to demonstrate compliance with Article 28, and allow for audits as set out in clause 4

Our personnel do not read your documents. Access to document content in production requires an explicit, time-bound authorisation, is available to a small named group, and is written to an append-only audit record. We will tell you if we have had to access the content of a case, and why, unless a law prevents us.

If a data subject contacts us directly about Customer Personal Data, we will not respond on the substance. We will tell them to contact you and, where we can identify you, tell you without undue delay.

The product itself is the assistance mechanism. Access, rectification, erasure and portability in respect of a case are exercised by you through the application, and every action leaves an audit record you can export.

We will make available the information necessary to demonstrate compliance with Article 28, including the current version of the documents in this trust centre, and will respond to a reasonable security questionnaire once per year.

You may audit our processing, or mandate an independent auditor to do so, on thirty days' written notice, no more than once in any twelve month period, unless a supervisory authority requires otherwise or a personal data breach has occurred. Audits take place during business hours, must not unreasonably disrupt the service, and are subject to confidentiality.

An audit may not extend to another customer's data, and may not involve penetration testing of shared infrastructure without our prior written agreement and that of the affected provider.

You give general written authorisation for us to engage sub-processors. The current list is published as the Sub-processor list and forms part of this DPA.

We will give at least thirty days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot offer an alternative, you may terminate the affected subscription without penalty and receive a pro rata refund of prepaid fees.

We impose on every sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in phases without further undue delay.

Notifying a supervisory authority or affected data subjects is your decision as controller. We will provide the information and assistance you reasonably need in order to make it, including inside the notification deadlines that apply to you.

If our independent verification step finds that a generated document still contains a surface form we had decided to redact, that document is withheld and the case is blocked before release. Where such a finding relates to a bundle you have already released, we treat it as a suspected personal data breach and notify you under clause 6.1.

A case is purged automatically at the end of the retention window you configure, which defaults to 30 days after release and is capped by your plan. Unreleased cases are purged after 180 days, with warnings beforehand.

Purging deletes the stored objects, the extracted document model and the entity mentions, and destroys the encryption key held for that case, which renders any remaining copy unreadable including in backups.

What survives is a tombstone containing the case reference, the dates, the counts and the quality summary, with no personal data in it, so that you retain an accountability record of the disclosure you made.

On termination you may export your bundles and audit records for 30 days. After that, all Customer Personal Data is deleted on the schedule above unless a law requires us to keep it, in which case we will tell you what and why.

All processing of Customer Personal Data takes place within the European Union. We will not transfer it to a third country without your prior written authorisation.

Where a sub-processor's corporate structure creates the possibility of access from a third country, that access is governed by the European Commission's Standard Contractual Clauses, module three, together with the supplementary technical measures described in Annex 2.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of service, except where those limitations are not permitted by applicable data protection law.

This DPA is governed by the law of the Kingdom of Norway, and disputes are subject to the jurisdiction set out in the Terms of service.

This DPA takes effect with the Terms of service and remains in force for as long as we process Customer Personal Data on your behalf.

The subject matter is the preparation of documents for disclosure to a data subject. The nature of the processing is automated extraction of text, detection of personal data, resolution of detected mentions into entities, application of a redaction policy, generation of redacted documents, independent verification of those documents, and packaging into a bundle.

The purpose is to enable the Controller to comply with a right of access or an equivalent disclosure obligation, by removing personal data relating to persons other than the requester.

For the term of the Terms of service, and for each case, until it is purged under clause 7.

• The data subject who made the access request, whom the Controller declares when opening a case
• Employees, contractors and representatives of the Controller who appear in the documents
• Third parties of any kind who happen to appear in the documents, including customers, suppliers, family members, correspondents and members of the public, who have no relationship with the Processor and who are typically unaware the processing is taking place
• Authorised users of the Controller who operate the service

• Identifiers: names, aliases, initials, usernames, email addresses, telephone numbers, postal addresses
• Government and financial identifiers: national identification numbers, bank account numbers, payment card numbers
• Employment data: job titles, reporting lines, performance and disciplinary content, correspondence
• Any other personal data that happens to be present in the documents the Controller uploads, which the Processor does not select and cannot predict
• Account data for authorised users: name, work email, organisation, role, authentication data, audit records

The Controller decides what to upload. Documents submitted for a right of access commonly contain special category data, in particular health information, trade union membership and data revealing racial or ethnic origin, and may contain data relating to criminal convictions and offences.

The Processor does not seek special category data and does not process it for any purpose other than detecting and removing it where it relates to a person other than the declared data subject. The measures in Annex 2, in particular envelope encryption and the prohibition on personal data in logs, are applied to all Customer Personal Data without distinction.

Processing is occasional and controller-initiated, taking place when a case is submitted. Volume is determined by the Controller, and is typically several hundred documents per case.

• All processing in the European Union: database and object storage in Frankfurt, processing workers in Frankfurt and Amsterdam, web functions pinned to Frankfurt, model inference at a European provider
• Row-level security on every tenant table, enforced by the database rather than by application code, so a cross-tenant read is refused at the lowest layer
• Storage paths namespaced per organisation and per case, with no listing tokens issued at any time

• TLS in transit on every hop, including the internal call from the web tier to the processing worker, which additionally carries a shared secret
• Encryption at rest for all stored data
• Envelope encryption with AES-256-GCM, applied in the worker, for the personal data densest in identifiers: entity surface text and the normalised document model. A per-case data key is wrapped by an organisation key
• Purge destroys the case key, which renders remaining copies unreadable including in backups

• Object access only through single-object signed URLs, valid five minutes for upload and two minutes for download, issued by a server route that re-checks membership and role at the moment of issue
• Role-based access with four roles, and permissions enforced in database transition functions rather than in the interface
• Multi-factor authentication available on every plan; SAML single sign-on on the enterprise plan
• Dual control, on plans where it is enabled, for releasing a bundle and for marking an entity as the data subject
• Least privilege for Processor personnel, with production access to document content requiring explicit time-bound authorisation and generating an audit record

• An append-only audit log covering state transitions, entity decisions, bundle downloads, unredacted views and configuration changes, which cannot be edited or deleted
• An allowlist serializer for application logs that permits identifiers, counts, enumerated values and durations only, with a continuous integration rule blocking raw string interpolation into a logger
• Model calls recorded as token counts and chunk identifiers. Prompts and completions are not stored

• A fail-closed policy with no code path from an unattributed entity to disclosure
• Independent verification by a component that shares no code with the redaction pipeline, enforced by a lint rule on the dependency graph, which re-extracts every generated document and blocks release on any residual match
• Detection health gates that stop a case rather than allowing a degraded run to complete quietly
• A labelled corpus gating every change to a detector, a prompt or a model version in continuous integration

• Hostile-input handling for archive, email and office document parsers, including zip-slip and archive-bomb guards, a recursion depth cap, per-job memory and time budgets, and fuzzing in continuous integration
• An egress allowlist on the component that handles document content, so it can reach only the destinations it needs
• Backups of the database with point-in-time recovery, held in the same region
• Code review on every change, dependency scanning, and secrets held in a managed store and never in source control

• Confidentiality undertakings for all personnel with access to Customer Personal Data
• Security and data protection training on joining and annually thereafter
• A documented incident response procedure, including the notification path in clause 6
• Written data protection terms with every sub-processor, and a review before engagement