Substanto
Data Processing Agreement
This DPA forms part of the agreement between Substanto Ltd, a company registered in England and Wales with company number 17447004, whose registered office is at Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE (“Substanto”, the “Processor”) and the customer identified in the applicable order or account (“Customer”, the “Controller”) for the use of Substanto (the “Service”). It governs the Processor’s processing of Personal Data on behalf of the Controller.
Substanto also acts as a controller in respect of account, billing and usage data, as described in our Privacy Policy. This DPA governs only the Personal Data that Substanto processes as a processor on the Controller's instructions.
1. Definitions
“Personal Data”, “processing”, “controller”, “processor”, and “data subject” have the meanings given under Applicable Data Protection Law. “Applicable Data Protection Law” means the data protection laws applicable to the processing, namely the UK General Data Protection Regulation and the Data Protection Act 2018, and, where the Controller is established in the EEA or offers goods or services there, the EU General Data Protection Regulation (together, the “GDPR”).
2. Roles and scope of processing
The Controller determines the purposes and means of processing; the Processor processes Personal Data only on the Controller’s documented instructions, including as set out in this DPA and the Service configuration. The subject matter, duration, nature, and purpose of processing, and the categories of data and data subjects, are described in Annex A.
3. Processor obligations
- Process Personal Data only on documented instructions from the Controller, including for international transfers, unless required by law (in which case the Processor will notify the Controller unless legally prohibited).
- Ensure persons authorised to process Personal Data are bound by confidentiality.
- Implement the technical and organisational security measures described in Annex B.
- Not use Customer content, including Personal Data, to train the Processor’s or any third party’s AI or machine learning models.
- Assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting its security, breach-notification, and impact-assessment obligations.
4. Subprocessors
The Controller authorises the Processor to engage the subprocessors listed on the Processor's Subprocessors page, which describes each subprocessor’s legal entity, country, purpose, and the data shared. The Processor imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance. The Processor will give the Controller at least 30 days' advance notice of any intended addition or replacement of a subprocessor and a reasonable opportunity to object.
5. International transfers and data location
The database in which Your Content is stored is located in the European Union (Ireland) (Supabase, eu-west-1). The application server is hosted in the United States (Render, Oregon), and AI processing (drafting and semantic matching) is performed by subprocessors located in the United States. Where Personal Data is transferred out of the UK or EEA, the Processor relies on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (or the UK IDTA where it applies standalone), as set out in Annex C.
6. Security
The Processor maintains the measures in Annex B, including encryption in transit and at rest, hashed credentials, per-tenant access scoping, rate limiting, and audit logging. The Processor reviews these measures periodically and may update them provided the level of protection is not reduced.
7. Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller’s data, with the information reasonably available to support the Controller’s own notification obligations, including the GDPR 72-hour notification framework.
8. Data-subject rights
Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests to exercise data-subject rights under Applicable Data Protection Law.
9. Audits
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable confidentiality and security controls. The Processor may satisfy audit requests by providing its current third-party attestations (e.g., SOC 2 / ISO 27001) under NDA.
10. Return and deletion
On termination of the Service, the Processor will, at the Controller’s choice, delete or return the Personal Data and delete existing copies, except to the extent retention is required by law. Production data is deleted within the period stated in the Privacy Policy.
11. Term, liability, and governing law
This DPA remains in effect for the duration of the processing under the agreement. Liability is subject to the limitations in the underlying agreement. This DPA is governed by England and Wales, without prejudice to any mandatory provisions of Applicable Data Protection Law.
Annex A: Details of processing
| Subject matter | Drafting and management of security-questionnaire answers from Controller-provided content. |
|---|---|
| Duration | For the term of the agreement, plus the retention window in the Privacy Policy. |
| Nature & purpose | Storage, retrieval, semantic matching, and AI-assisted drafting to deliver the Service. |
| Categories of data | Account data (name, work email); Controller content that may contain Personal Data (e.g., names/roles in policies or questionnaires). Controller should avoid uploading special-category data. |
| Data subjects | Controller’s personnel and any individuals referenced in Controller content. |
| Processing locations | Storage of Your Content: EU (Ireland), Supabase eu-west-1. Application server: US (Oregon), Render. AI subprocessors: US (Anthropic, Voyage AI). Transactional email: EU (Ireland), Resend. Frontend hosting and website analytics: US (Vercel). Encrypted weekly database backups, kept 28 days: US (GitHub). |
Annex B: Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest.
- Passwords and API tokens stored only as hashes; token rotation supported.
- Per-tenant access scoping; content used only to answer the Controller’s own questionnaires.
- Rate limiting and abuse safeguards; security headers and locked cross-origin policy.
- Audit logging; least-privilege access to production.
Annex C: Transfer mechanisms
- EU / EEA: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), where Personal Data is transferred to a country without an adequacy decision.
- UK: the UK International Data Transfer Addendum to the EU SCCs, or the UK IDTA where it applies standalone.
← Privacy Policy · Terms of Service · Home
Substanto Ltd. Registered in England and Wales, company number 17447004. Registered office: Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.
Version 2.1, 4 October 2026. Supersedes the version dated 8 September 2026.