DPA

For the records of the people in your organization, you are the controller and we are the processor. For account and billing data about your own administrators, we are the controller.

We process data on your documented instructions, which are the configuration of your account: the roles you define, the permissions you set, the retention periods you choose, the integrations you authorise and the automation you permit.

We do not process it for any other purpose, and we do not use it to train models made available outside your account.

Encryption in transit and at rest. Isolation between organizations, enforced at the record level — cross-organization reads are not a permission anybody can be granted.

Credentials for connected systems held only by the services that require them, never exposed to a browser and never written to logs.

Access to production restricted, time-bound, logged and reviewed. Every consequential action recorded with its actor, its inputs and its result.

Assistant queries execute with the permissions of the person asking, through the same checks as every other read. There is no separate AI permission model, because a second model would eventually diverge from the first and the divergence would be a breach.

Content held in the system — document text, form submissions, imported records — is treated as data and cannot act as an instruction to the assistant.

We use the sub-processors listed on the subprocessors page. We give notice before adding one, and each is engaged under terms no weaker than these, including the prohibition on training.

We assist with data subject requests, impact assessments and incident notification within the timelines your agreement sets.

Because changes and approvals are recorded with their actor, most audit questions about a specific person or a specific change can be answered from the record rather than by investigation.

On termination, data is returned or deleted at your election within the period your agreement sets. Export remains available throughout the term and during any wind-down period.