Security
GDPR
The General Data Protection Regulation governs personal data about people in the European Economic Area. It has no certificate. What it has is a set of obligations, and a contract that assigns them — which is why the question worth asking a vendor is not whether they are compliant, but which half they carry.
You are the controller for your end users. We are the processor, acting on your documented instruction. The split below follows from that, and the Data Processing Addendum is where it is binding.
What we carry
- A signed processor agreement
- The Data Processing Addendum forms part of the Terms. It carries the Standard Contractual Clauses, module two, for transfers out of the EEA, plus the UK Addendum where that applies.
- Every sub-processor named
- Each one is listed with its activity and where it sits. We give at least thirty days’ notice before adding or replacing one, and you may object.
- Breach notice within seventy-two hours
- We notify you, not your users — you decide what the supervisory authority and the people affected are told, because you are the controller.
- The means to answer your users
- Access, correction, export and deletion are available through the Console and the API, so you can satisfy a request without opening a ticket with us.
- Deletion when you leave
- Data stays exportable for thirty days after termination, then goes from production systems. Backups follow their own expiry, under the same terms until then.
What stays with you
- The legal basis
- Consent, contract, legitimate interest — you choose it for your processing and you record why. We do not pick it for you, and we cannot.
- Your own privacy notice
- Your users read yours, not ours. It has to say what you collect and why, and name us as a processor if you list them.
- Answering your users directly
- A request that reaches us about your end users gets referred back to you. We tell you without undue delay and do not respond on the substance.
- What you configure
- Retention windows, which providers are enabled, what you put in custom claims and metadata. Those are instructions, and the instruction is yours.
Where this is binding
We hold no GDPR certificate, because none exists. Any vendor offering you one is selling something else.