Data Processing Addendum
Last updated 12 August 2026
Roles
For customer data held in a workspace, the organization is the controller and we are the processor. We process that data only on the organization's documented instructions.
Subject matter
Provision of the platform: storing customer accounts, generated content, and the records needed to run the service.
Sub-processors
We use hosting, email and payment sub-processors, and the AI provider each organization configures. We will tell organizations before adding a new sub-processor.
Security
Encryption at rest for credentials, encryption in transit, access controls, and regular patching.
Assistance
We help organizations respond to data subject requests, and will notify them without undue delay if we become aware of a breach affecting their data.
Deletion
On erasure of a workspace, all customer data in it is deleted. Anonymised financial records are retained as described in the privacy policy.