Data processing

The position

Hosted, you are the controller and we are the processor: your documents, your instructions, no other purpose. We will sign a data processing agreement, including yours.

There is no published standard text yet. Ask and we will send what we have and negotiate the rest.

What an agreement with us has to cover

8 points

Roles

Hosted, you are the controller and we are the processor. We act on your instructions and use your documents for nothing else, including training a model.

Subject matter and duration

The documents you put through the service, for as long as you keep the workspace. Uploaded text is deleted after 7 days either way. A Workbench run's de-identified output is kept for as long as the workspace stays open, and goes with it on closure.

Subprocessors, and notice before they change

The list on this site is the list, and we give notice before adding a subprocessor.

Security measures

The controls on the trust page as written, including the ones marked not built. The agreement will not be a stronger version of the page.

Your people's requests

Assistance with access, correction and erasure requests: the audit log, the delete endpoint and the workspace export you already hold. Most of it you can produce yourself.

Return and deletion

Both are buttons, not requests to us. An administrator can export the whole workspace at any time, and can close it: the workspace's rows and stored objects are deleted after a 30-day cancellable, read-only grace period. The audit log is retained, and deleting the engine-side entity mapping is a request to us today, honoured and recorded. Provider backups expire on their own schedule, not ours.

Breach notification

Agreed in the contract, not stated on a page we could quietly edit afterwards.

Transfers

Hosted, processing runs in the United States today; a workspace's pinned region governs where its stored output bucket lives. Each subprocessor's transfer mechanism is printed on the subprocessor list. Full EU processing is planned work, not something we can sign yet.

Where we are not a processor at all

In your own account, or on a machine you own, the documents never reach us, so there is nothing for us to process. See the caution on Where it runs.

What we will not do

We will not sign for a control we have not built; the trust page lists what is missing. If a term turns on something we do not have - customer-held keys, SAML, a stated breach window - the conversation is about building it.

Asking

founders@petrarch.co. Tell us which entity is contracting, which jurisdiction, and whether you are starting from your paper or ours. Send any security questionnaire with it; most of it is answered on the trust page and the subprocessor list.

Trust and security Subprocessors Reporting a vulnerability Where it runs