Data processing agreement

Terms defined in the General Data Protection Regulation (EU) 2016/679 carry the same meaning here. Customer Personal Data means personal data we process on your behalf under the Terms of service, including everything inside the documents you upload.

You are the controller and we are the processor. You determine the purposes and means of processing Customer Personal Data. We process it only on your documented instructions.

Your use of the service, including opening a case, declaring the data subject, uploading documents, making entity decisions and releasing a bundle, constitutes your documented instructions.

We will tell you if, in our opinion, an instruction infringes the GDPR or another data protection provision, and we may suspend the affected processing until it is resolved.

• Process Customer Personal Data only on your documented instructions, including on transfers, unless Union or Member State law to which we are subject requires otherwise, in which case we will tell you of that legal requirement before processing, unless that law prohibits it on important grounds of public interest
• Ensure that everyone authorised to process it is bound by an obligation of confidentiality
• Implement and maintain the technical and organisational measures in Annex 2
• Respect the conditions in clause 5 for engaging a sub-processor
• Assist you, taking into account the nature of the processing, in responding to data subject requests
• Assist you with data protection impact assessments and with prior consultation, to the extent the information is available to us
• Delete or return Customer Personal Data at the end of the service, as set out in clause 7
• Make available the information necessary to demonstrate compliance with Article 28, and allow for audits as set out in clause 4

Our personnel do not read your documents in the ordinary course of providing the Service. The production credentials that could reach document content are held by a small number of named individuals. We will tell you if we have had to access the content of a case, and why, unless a law prevents us.

If a data subject contacts us directly about Customer Personal Data, we will not respond on the substance. We will tell them to contact you and, where we can identify you, tell you without undue delay.

The product itself is the assistance mechanism. Access, rectification and portability in respect of a case are exercised by you through the application, and every action leaves an audit record you can export.

Erasure of a case ahead of its retention window is exercised through the application too. An owner or administrator of your organisation can abandon any case that has not already been purged, whatever its status and including after release, by confirming its reference; a draft can also be deleted outright. Abandoning a case purges it as clause 7.2 describes, normally within minutes of the instruction. It cannot be undone, it is recorded in the audit log, and it is not billed.

We will make available the information necessary to demonstrate compliance with Article 28, including the current version of the documents in this trust centre, and will respond to a reasonable security questionnaire once per year.

You may audit our processing, or mandate an independent auditor to do so, on thirty days' written notice, no more than once in any twelve month period, unless a supervisory authority requires otherwise or a personal data breach has occurred. Audits take place during business hours, must not unreasonably disrupt the service, and are subject to confidentiality.

An audit may not extend to another customer's data, and may not involve penetration testing of shared infrastructure without our prior written agreement and that of the affected provider.

You give general written authorisation for us to engage sub-processors. The current list is published as the Sub-processor list and forms part of this DPA.

We will give at least thirty days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot offer an alternative, you may terminate the affected subscription without penalty and receive a pro rata refund of prepaid fees.

We impose on every sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in phases without further undue delay.

Notifying a supervisory authority or affected data subjects is your decision as controller. We will provide the information and assistance you reasonably need in order to make it, including inside the notification deadlines that apply to you.

If our independent verification step finds that a generated document still contains a surface form we had decided to redact, that document is withheld and the case is blocked before release. Where such a finding relates to a bundle you have already released, we treat it as a suspected personal data breach and notify you under clause 6.1.

A case is purged automatically at the end of the retention window you configure, which defaults to 30 days after release and is capped by your plan. Unreleased cases are purged after 180 days, with warnings beforehand.

Purging deletes the stored objects of the case, which are the originals, the generated documents and the bundles, deletes its records in the database, including the extracted document model and the entity mentions, and destroys the encryption key held for that case. What was encrypted under that key, which is the text of each mention of a detected entity and the extracted document model, is unreadable from that moment wherever a copy of it survives, including in a database backup.

Some case data is held in the database without encryption under the case key: the display name of each detected entity, which is the fullest spelling of that name, email address or identifier as it appeared in the documents and is shown on the review screen so that a reviewer can tell who is who across documents; the identifiers you declare for the data subject; the external reference you give a case, which may identify a person; the names of the files in the case and of any connected folder they were retrieved from; and the normalised form of each detected name or identifier that lets two spellings resolve to the same person. The database, and with it this data, is held by the sub-processor Supabase in Frankfurt. We plan to encrypt the display name under the case key, and will update this clause when we do. Purging deletes them, but a database backup taken before the purge still holds them until that backup expires. Database backups can be restored for seven days, after which they are no longer available to us or to you.

What survives is a tombstone containing the case reference, the dates, the counts and the quality summary, with no personal data in it, so that you retain an accountability record of the disclosure you made.

On termination you may export your bundles and audit records for 30 days. After that, all Customer Personal Data is deleted on the schedule above unless a law requires us to keep it, in which case we will tell you what and why.

All processing of Customer Personal Data takes place within the European Union. We will not transfer it to a third country without your prior written authorisation.

Where a sub-processor's corporate structure creates the possibility of access from a third country, that access is governed by the European Commission's Standard Contractual Clauses, module three, together with the supplementary technical measures described in Annex 2.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of service, except where those limitations are not permitted by applicable data protection law.

This DPA is governed by the law of the Kingdom of Norway, and disputes are subject to the jurisdiction set out in the Terms of service.

This DPA takes effect with the Terms of service and remains in force for as long as we process Customer Personal Data on your behalf.

The subject matter is the preparation of documents for disclosure to a data subject. The nature of the processing is automated extraction of text, detection of personal data, resolution of detected mentions into entities, application of a redaction policy, generation of redacted documents, independent verification of those documents, and packaging into a bundle.

The purpose is to enable the Controller to comply with a right of access or an equivalent disclosure obligation, by removing personal data relating to persons other than the requester.

For the term of the Terms of service, and for each case, until it is purged under clause 7.

• The data subject who made the access request, whom the Controller declares when opening a case
• Employees, contractors and representatives of the Controller who appear in the documents
• Third parties of any kind who happen to appear in the documents, including customers, suppliers, family members, correspondents and members of the public, who have no relationship with the Processor and who are typically unaware the processing is taking place

Account data about your authorised users, which is their name, work email, role, authentication data and the audit record of their actions, is processed by us as a controller under our Privacy notice, and is not Customer Personal Data.

• Identifiers: names, aliases, initials, usernames, email addresses, telephone numbers, postal addresses
• Government and financial identifiers: national identification numbers, bank account numbers, payment card numbers
• Employment data: job titles, reporting lines, performance and disciplinary content, correspondence
• Any other personal data that happens to be present in the documents the Controller uploads, which the Processor does not select and cannot predict

The Controller decides what to upload. Documents submitted for a right of access commonly contain special category data, in particular health information, trade union membership and data revealing racial or ethnic origin, and may contain data relating to criminal convictions and offences.

The Processor does not seek special category data and does not process it for any purpose other than detecting and removing it where it relates to a person other than the declared data subject. The measures in Annex 2, in particular envelope encryption and the prohibition on personal data in logs, are applied to all Customer Personal Data without distinction.

Processing is occasional and controller-initiated, taking place when a case is submitted. Volume is determined by the Controller, and is typically several hundred documents per case.

• All processing in the European Union: database and object storage in Frankfurt, processing workers in Frankfurt, web functions pinned to Frankfurt, model inference at a European provider
• Row-level security on every tenant table, enforced by the database rather than by application code, so a cross-tenant read is refused at the lowest layer
• Storage paths namespaced per organisation and per case, with no listing tokens issued at any time

• TLS in transit on every hop, including the internal call from the web tier to the processing worker, which additionally carries a shared secret
• Encryption at rest for all stored data
• Envelope encryption with AES-256-GCM, applied on our servers before the data is stored, for the personal data densest in identifiers: the text of each mention of a detected entity, identifiers a reviewer reports as missed, and the normalised document model. A per-case data key is wrapped by an organisation key. The display name of each entity and the other case data named in clause 7.2 are not encrypted under it
• Purge destroys the case key, which renders what was encrypted under it unreadable wherever a copy survives, including in a database backup. The unencrypted case data named in clause 7.2 is deleted by the purge but remains in a backup taken before it for as long as that backup can be restored, which is seven days

• Object access only through single-object signed URLs, valid two hours for upload and two minutes for download, issued by a server route that re-checks membership and role at the moment of issue
• Role-based access with four roles, and permissions enforced in database transition functions rather than in the interface
• Multi-factor authentication available on every plan, which an owner can require across the organisation
• SAML single sign-on through the organisation's own identity provider, with a DNS-verified domain and an organisation-wide requirement, available on the Business plan
• Dual control for releasing a bundle and for marking an entity as the data subject is committed in the enterprise agreement and not yet released, and no plan carries it today
• Least privilege for Processor personnel, with the production credentials that could reach document content held by a small number of named individuals

• An append-only audit log covering state transitions, entity decisions, bundle downloads, each time a reviewer opens the unredacted excerpts around an entity, recorded by identifier and before anything is decrypted, and configuration changes. No entry can be edited, and each entry is deleted six years after it is made
• An allowlist serializer for application logs that permits identifiers, counts, enumerated values and durations only, with a continuous integration rule blocking raw string interpolation into a logger
• Model calls recorded as token or page counts, durations and chunk identifiers. Prompts, completions and recognised text are not stored in any log

• A fail-closed policy with no code path from an unattributed entity to disclosure
• Independent verification by a component that shares no code with the redaction pipeline, enforced by a lint rule on the dependency graph, which re-extracts every generated document and blocks release on any residual match
• Detection health gates that stop a case rather than allowing a degraded run to complete quietly
• A labelled corpus gating every change to a detector, a prompt or a model version in continuous integration

• Hostile-input handling for archive, email and office document parsers, including zip-slip and archive-bomb guards, a recursion depth cap, per-job memory and time budgets, and fuzzing in continuous integration
• An egress allowlist on the component that handles document content, so it can reach only the destinations it needs
• Daily backups of the database, held in the same region and restorable for seven days. Stored objects are not included in these backups
• Code review on every change, dependency scanning, and secrets held in a managed store and never in source control

• Confidentiality undertakings for all personnel with access to Customer Personal Data
• Security and data protection training on joining and annually thereafter
• A documented incident response procedure, including the notification path in clause 6
• Written data protection terms with every sub-processor, and a review before engagement