Data Processing Addendum
For customers who need a written processing agreement on file. Contact us for a signed copy.
Last updated: August 2026
Post-termination data retention: 30 days
Roles
Where you use our products to handle personal data about your customers or staff, you are the controller and we are the processor. We process that data to provide the service and for no other purpose — we do not mine it, sell it, or use it to train models.
Instructions
We process personal data on your documented instructions, which for most customers means: as necessary to run the product you have bought. If we ever believe an instruction breaks applicable law, we will tell you rather than quietly comply.
Sub-processors
The current list of sub-processors is published on our security page rather than buried in this document, so it can be kept current. It names each vendor, what they do, and where they operate. Tell us if you want notice before we add one.
Security measures
Encryption in transit and at rest, role-based access control, least-privilege internal access and continuous monitoring. Our security page states these in full — including, deliberately, the certifications we do not hold.
Personnel
Our staff access customer environments only where a specific piece of work requires it, and that access is removed when the work is finished. Everyone with access is bound by confidentiality obligations.
Your rights requests
If one of your customers asks you to access, correct or delete their data, we will help you answer it. Ask and we will export the relevant records or delete them and confirm when it is done.
Return and deletion
When your agreement with us ends, we will return your data in a portable format or delete it, at your choice. Unless you ask us to delete it sooner, we hold it for the retention window stated at the top of this document so that a late export request does not arrive too late, and delete it after that. Where a signed agreement with you sets a different window, the signed agreement governs.
Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and give you what we know, so that you can meet your own notification obligations.