Last updated 2026-10-21
Data processing agreement
Our standard DPA. Sign it from the billing page, or send it to your lawyer first.
What it covers
Roles
We are a controller for the database and a processor for anything you upload.
Sub-processors
Listed on /subprocessors. 30 days' notice before we add one, with a right to object.
Security
TLS 1.2+ in transit, AES-256 at rest, managed KMS, access logging, annual review.
Breach notice
Within 72 hours of us becoming aware, with what we know and what we're doing.
Transfers
EU standard contractual clauses and the UK addendum for data leaving the EEA or UK.
Termination
Uploads deleted 30 days after the account closes. Audit rights on request.
Placeholder before launch
[Attach the signed-form PDF and the executed SCC module references after legal review.]