Roles
The customer is the controller of customer content. Attestloom Inc. is the processor and processes it only to provide Attestloom.
Processing on instructions
We process customer content only on documented instructions: the Terms, your configuration of the service, and your written requests. We tell you if we believe an instruction breaks the law. Customer content is never used to train models.
Data and subjects
Categories: security documentation, questionnaires, answers, comments, and audit records, which may contain names and business contact details of your employees and your customers' staff. We do not ask for, and you should not upload, special category data.
Security measures
- TLS in transit; encrypted storage at rest; original files sealed with AES-256-GCM under per-workspace keys derived with HKDF-SHA256.
- Logical tenant isolation: every customer row carries a workspace identifier enforced on every query, plus server-side role checks.
- Least-privilege production access for named personnel only, with an audit trail of approvals and exports inside each workspace.
- Rate limiting and abuse controls on public endpoints.
Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Language model inference and embeddings for drafting and retrieval | United States |
| Vercel Inc. | Application hosting, edge network, and serverless functions | United States (iad1) |
| Neon Inc. | Managed PostgreSQL with pgvector (primary database) | United States (AWS us-east-1) |
| Stripe, Inc. | Subscription billing | United States |
| Resend, Inc. | Transactional email (verification, password reset, assignment notices) | United States |
We give 30 days notice before adding a subprocessor that processes customer content, and you may object on reasonable grounds.
International transfers
Customer content is processed in the United States. For data from the EU, UK, or Switzerland, the DPA incorporates the EU Standard Contractual Clauses (Module 2 and Module 3) and the UK Addendum.
Incident notice
We notify affected customers without undue delay, and within 72 hours, after confirming a personal data breach involving their content, with what we know and what we are doing about it.
Deletion and return
You can export and delete all content at any time from Settings. After termination we delete remaining content within 30 days, and host backups expire within a further 30 days.
Audits and assistance
We answer reasonable security questionnaires about Attestloom, help with data subject requests and impact assessments, and support audits as the DPA describes. Attestloom does not yet hold a SOC 2 report; see the roadmap on the Trust page.