Data processing agreement

This agreement is between the customer organisation that holds the Scopecanon account (the controller, "you") and Nimavera Inc. (in formation) (the processor, "we"). For your register — the systems you record, the classifications your people confirm, the evidence you attach — we act as processor: you are the controller, we act on your instructions, and we do not use it for anything else.

For your account — the names and email addresses of your users, sign-in and billing records — we act as an independent controller, because we decide to hold those in order to run the service; the privacy notice covers that processing.

Purpose: keeping your register of AI systems, the classifications, the derived obligations and the evidence, and producing the reports and exports you ask for. Data subjects: your personnel who hold seats, the person named as accountable for human oversight (Article 26(2) of the AI Act requires a named individual rather than a mailbox), and any individual named in evidence you choose to attach. Categories of data: identification and professional contact details, and whatever you place in the register. No special categories are needed; please do not attach evidence containing more personal data than the obligation needs. Duration: the term of your account, plus the deletion periods below.

We process the register only on your documented instructions — these terms, your settings and what you do in the product — including as to transfers outside the EEA, unless the law requires otherwise, in which case we tell you first where the law allows; and we tell you if we believe an instruction breaks data protection law. Everyone with access is bound by confidentiality. We do not sell the data, use it for advertising, or use it to train models, and we do not read it except where you ask us to for support.

Taking into account the nature of the processing, we assist you with data-subject requests and with your obligations on security, breach notification, impact assessments and prior consultation (Articles 32 to 36 GDPR). We provide the information needed to demonstrate compliance with Article 28 and answer a reasonable written audit request once in any twelve-month period, or after a personal data breach. We are not certified to ISO 27001 or SOC 2 and do not suggest otherwise.

TLS on every request. Passwords hashed with bcrypt; only a hash of each session token is stored. Two-step verification available to every user and required for our platform administrators, with the authenticator secret encrypted (AES-256-GCM) and recovery codes stored only as hashes. Every query against the register is scoped to your organisation in the database query itself. Every state-changing action is written to an audit trail that survives the user who made it. Nightly backups of the database and evidence files, verified by content; offsite copies are encrypted (AES-256) before they leave the server, with a key the storage provider never receives. Details are on the security page.

Hostinger International Ltd. — application server and database, in an EU data centre. Cloudflare, Inc. — R2 object storage in an EU-jurisdiction bucket for evidence files and for the encrypted offsite backups, once object storage is switched on. Resend, Inc. — transactional email (sign-in links, invitations, notices); receives the recipient address and the message. Stripe Payments Europe, Ltd. and Stripe, Inc. — payments, tax calculation and invoices once paid plans are on sale; receives billing contact, address, VAT number and the payment details entered in its own checkout. Scopecanon uses no AI provider: the matcher and the obligation rules run on our own server.

You give general authorisation for these sub-processors. We bind each by written terms giving the same level of protection as this agreement and remain responsible for them. We give 30 days' notice by email before adding or replacing one; if you object on reasonable data protection grounds and we cannot address the objection, you may terminate and we refund fees paid for the period after termination.

The register, the evidence and the backups are stored in the European Union. Nimavera Inc. (in formation) is established in the United States, and Cloudflare, Resend and Stripe, Inc. are US companies. Where personal data is transferred to, or accessed from, a country without an adequacy decision, the transfer relies on the European Commission's standard contractual clauses (Decision (EU) 2021/914) — module 2 between you and us, incorporated into this agreement by reference, and module 3 with our sub-processors — with the supplementary measures above, such as encryption of backups. Where a recipient is certified under the EU–US Data Privacy Framework, that adequacy decision may be relied on instead.

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your register. The notice goes to your organisation's owners by email and describes, as far as then known, what happened, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed; we add to it as we learn more.

Any member can export the whole register at any time, as one file with every evidence file attached; that is how data is returned. Deleting the organisation, or the last member deleting their account, deletes it at once — every row and every stored file. On termination the register is deleted within 30 days, or sooner on request. Backups age out within fourteen days after that. The audit entry recording the deletion survives without the deleted content, and invoices are kept as tax law requires.

Liability under this agreement is subject to the limits in the terms of service, except where the GDPR or other mandatory law does not permit them; nothing here limits the rights of data subjects. These terms apply automatically to every account. If your procurement needs a countersigned copy, write to privacy@scopecanon.com and we will sign this text.