GDPR-aligned terms governing AssurAI's processing of personal data on behalf of our customers.
Template notice: This DPA is provided as a template for convenience. It is not legal advice — have your own counsel review it before relying on it. For a countersigned copy, email privacy@getassurai.com.
This Data Processing Agreement ("DPA") forms part of the agreement between:
This DPA applies to the extent the Processor processes Personal Data (as defined under the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK GDPR) on behalf of the Controller.
The Controller determines the purposes and means of processing the audit, compliance, and risk data it uploads to AssurAI. The Processor processes that Personal Data only on the Controller's documented instructions, including those set out in this DPA, the Privacy Policy, and the platform's configuration (such as the selected data region).
The Processor ensures that persons authorised to process Personal Data are bound by confidentiality obligations.
Subject matter: the provision of the AssurAI AI-native GRC platform for audit, compliance, and risk management.
Duration: processing continues for the term of the Controller's subscription and for any post-termination retention period described in Section 11 and the Privacy Policy.
Personal Data is processed to host, secure, and operate the platform and to provide its features, including AI-assisted generation of workpapers, controls testing, findings, and reports. AI processing is performed to produce outputs for the Controller only and is not used to train AI models.
| Processing activity | Purpose |
|---|---|
| Storage & hosting | Persisting the Controller's audit data |
| Authentication | Securing account access |
| AI generation | Producing workpapers and analysis on request |
| Transactional email | Notifications, reminders, confirmations |
The Controller must not upload special categories of data unless strictly necessary and lawful.
The Controller authorises the Processor to engage the following sub-processors. Each is bound by a written agreement imposing data-protection obligations no less protective than this DPA.
| Sub-processor | Service | Region |
|---|---|---|
| Supabase | Database & authentication | US or EU (per org data region) |
| Netlify | Application hosting & functions | US / global edge |
| Anthropic | AI processing (Claude API) — no training on customer data | US |
| Resend | Transactional email delivery | US |
The Processor will give reasonable notice of any intended change to its sub-processors, allowing the Controller to object on reasonable data-protection grounds.
The Processor implements appropriate technical and organisational measures, including:
Further detail is available at getassurai.com/security.
Taking into account the nature of the processing, the Processor assists the Controller (by appropriate technical and organisational measures, insofar as possible) in responding to requests to exercise data subject rights — access, rectification, erasure, restriction, portability, and objection.
The platform provides self-service data export (portability) and data deletion (erasure) tools from account settings. Deletion is confirmed via an emailed verification code and applied as an immediate soft-delete pending permanent removal under the retention policy.
AssurAI offers a data region selection (US or EU). For organisations on the EU region, primary database storage is provisioned in an EU Supabase project. Certain sub-processors (e.g. AI processing) may still process data in the United States.
Where Personal Data is transferred outside the EEA, UK, or Switzerland, such transfers are governed by the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with supplementary measures where required.
EU data residency requires the organisation to be provisioned on AssurAI's EU deployment. See our EU setup documentation or contact us to enable EU residency for your organisation.
The Processor will notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach affecting the Controller's data, providing the information reasonably necessary for the Controller to meet its own notification obligations.
On termination, or upon the Controller's request, the Processor will delete or return the Controller's Personal Data: