Data processing
When we process data on your behalf.
Where we deliver services in which we process personal data on the customer's behalf, we enter into a data processing agreement (DPA). Below is the framework it is based on.
The framework
The customer is the data controller and determines the purposes and means. Data Envoy is the data processor and processes data only on documented instructions. We do not process data for our own purposes and do not train models on the customer's data.
The agreement is entered into before access is set up, and follows Article 28 of the GDPR.
- Processing only on instructions
- Confidentiality for everyone with access
- Access on the principle of least privilege
- Encryption in transit and at rest
- Sub-processors only with approval
- Deletion or return on termination
Security
Access control
Named accounts, two-factor authentication and logging. Read access by default — write access only where the task requires it.
Local hosting
Where agreed, agents and the data layer run on the customer's own server, so data does not leave the customer's environment.
Breaches
We notify the customer without undue delay and no later than 24 hours after becoming aware of a breach.
Sub-processors and transfers
We use a limited number of suppliers for hosting, communication and model calls. A current list is provided on request and updated when it changes. If data is transferred to third countries, this is done on a valid transfer basis, typically the European Commission's standard contractual clauses.
Assistance
We assist with access requests, erasure, impact assessments and supervision, including audits on reasonable notice. See also Privacy policy.