Data processing agreement

1. Roles

You are the controller of personal data in your register. We are the processor. We process it only on your documented instructions — using the service is such an instruction — except where law requires otherwise, in which case we will tell you unless prohibited from doing so.

2. Subject matter and duration

Subject matter: providing a risk register. Duration: the term of your subscription, plus the 30-day deletion grace period. Nature and purpose: storage, retrieval, calculation of risk scores, and notification by email. Data subjects: your personnel who use the service or are named as risk or control owners. Categories of data: business contact details (name, email), role, and whatever you choose to record in your register.

A risk register is not a natural home for special-category data, and the product does not ask for any.

Workspaces created by an agent before anybody claims them are outside this agreement until they are claimed, because until then there is no controller and no personal data: we are never given an email address at that stage and there is no way to supply one. Such a workspace is deleted automatically after 5 days. This agreement begins when a person claims one and provides their own address — at which point they become the controller and everything above applies from that moment.

3. Confidentiality

Anyone we authorise to process your data is bound by confidentiality obligations. Access is limited to what is needed to operate and support the service.

4. Security

We implement appropriate technical and organisational measures, described in the security overview, which forms part of this agreement. In summary: EU hosting, encryption in transit and at rest, tenant isolation enforced at the database level, passwordless authentication, role-based access, and an append-only audit log.

5. Subprocessors

You give general authorisation for the subprocessors listed on the subprocessors page: Heroku, Brevo, Stripe, PostHog and Bunny. We will give notice before adding or replacing one, and you may object on reasonable data protection grounds. We remain liable for their performance.

6. Assisting you

The export and deletion tools under Settings → Your data are how we assist with access, portability and erasure requests: they are self-serve, immediate, and cover everything we hold. Where a request cannot be satisfied that way, we will help within a reasonable time.

7. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a breach affecting your data, with the information you need to meet your own obligations.

8. Return and deletion

You may export everything at any time. On termination, your data is deleted as described in the privacy policy and the security overview — including the honest position on backups, which is that deleted data ages out of encrypted backups within the stated retention window rather than being surgically removed from them.

9. Audits

We will make available the information needed to demonstrate compliance with this agreement, and will respond to reasonable security questionnaires. We do not currently hold ISO 27001 or SOC 2 certification and do not offer on-site audits.

10. International transfers

Data is hosted in the EU. Some subprocessors, Heroku among them, are US-owned companies serving us from EU regions. Where a subprocessor, or a parent company, may process data outside the EEA, standard contractual clauses apply.