Data Processing Agreement

You are the controller. You decide what documents to upload and which questionnaires to answer. FillTrust is the processor, acting only on your instructions. Using the service is the instruction; anything beyond it requires your agreement in writing.

We process your data to extract questions from security questionnaires, generate answers from the documents you provide, and store both so you can review, reuse and export them. Processing lasts as long as your account exists. When you delete your account we delete the data, as described under deletion and return.

FillTrust is designed around corporate documentation, not personal data. In normal use the personal data we process is limited to:

• Your users: name, email address, hashed password, and, if enabled, an encrypted two-factor secret.
• Colleagues you involve: the email address of anyone you ask to answer a question, and the answer they write.
• Incidental content: any personal data that happens to appear inside a document you upload, such as a named security officer in a policy.

We do not ask for special-category data under Article 9, and the service is not intended for it. Please do not upload it.

You give general authorisation for the sub-processors below. We will publish any addition on this page and at /legal/subprocessors at least 30 days before it starts processing, so you can object.

Your documents are stored in the EU: object storage in Paris, database in Frankfurt. To answer a question we send the question text and the specific passages retrieved from your documents to Google and OpenAI in the United States. We do not send whole documents.

Those transfers rely on the Commission’s Standard Contractual Clauses (Decision 2021/914, Module Two). Each provider states that data submitted through their paid APIs is not used to train their models.

Anthropic remains listed as a subprocessor and may receive the same question text and passages if we switch the answering model back. It is not in use today. We would rather name a recipient that is currently idle than have you discover one that was not listed.

If EU-only processing is a hard requirement for you, tell us before uploading anything. Today we cannot offer it.

The technical and organisational measures we apply under Article 32:

Everyone with access to production is bound by confidentiality. We will notify you without undue delay, and in any event within 48 hours, of any breach affecting your data, with what we know and what we are doing about it.

We are not currently SOC 2 or ISO 27001 certified and do not claim to be. See our security overview.

You can export your data at any time from the product. Deleting your account removes every uploaded document, generated questionnaire and stored answer, and cancels billing. If any part of that cannot be completed the deletion is aborted and reported to you rather than partially applied.

Backups roll off within 30 days. We keep no copy after that except where law requires it.

We will help you respond to data subject requests and to your obligations under Articles 32 to 36, taking into account the nature of the processing and the information available to us. We will make available the information needed to demonstrate compliance with Article 28, and will accept a reasonable audit, in practice, answering a security questionnaire, which we are unusually well placed to do.