Trust Centre›Procurement
Procurement pack
Security and data-protection documents on request, sent direct to your inbox.
Six documents, one request
Sent direct to your inbox, never publicly downloadable, so we can record what was shared, with whom, and on what date. We reply within one business day.
EU controller-processor agreement under GDPR Art. 28. Buyer supplies legal entity, registered address and signatory before execution.
Three EU-resident sub-processors: AWS, Vercel, Auth0. Live and citable at /trust#subprocessors. 30-day prior notice for changes.
Article 35 framework. Scoped to your stated processing activities before sending.
Business continuity and disaster recovery policy. Scoped to your deployment region and tier.
Information security controls summary. Mirrors the security infrastructure and posture sections of /trust.
Scoped to your cloud, processing regions, and chosen framework (CSA STAR, SIG Core, SIG Lite, CAIQ v4).
DPA, sub-processor list, and DPIA send immediately. BCM/DR, InfoSec, and SIG/CAIQ-lite are tailored to your deployment, so we may ask one or two clarifying questions first.