Data processing agreement
/legal/dpaA processor, onyour instructions.
The DPA summary is published; the signed document is part of the enterprise agreement. This page summarises what it commits us to; the countersigned document is one email away.
- 24hbreach notification, at most
- 3sub-processors, listed, with notice before any change
- 1role: processor, on your instructions
What it covers
When your connected systems contain personal data, actionlake processes that data only to execute the instructions you or your authorized agents give - never for our own purposes. You are the controller; we are the processor; the audit record is the evidence of exactly what processing occurred.
The commitments
- 01Processing only on documented instructions, with a record of every action
- 02Credentials and content encrypted in transit and at rest; no product screen exposes customer content, and production access is limited to named engineers, for operations
- 03Sub-processors listed, with notice before any change
- 04Breach notification without undue delay, and within twenty-four hours
- 05Deletion on termination, with the audit record exportable first
- 06Assistance with your own compliance obligations, including data-subject requests
Getting it signed
Email [email protected] from your account address and a countersigned copy comes back by email. Enterprise customers who need their own paper reviewed: talk to us.
Bring us your security review.
The trust page lists every mechanism, and every absence, in the same type size.