Data Processing Agreement

1.
Roles of the parties

You are the controller of the personal data contained in your connected sources. Loreflow acts solely as a processor, and only on your documented instructions.

2.
Nature and purpose of processing

We process references, relationships and derived summaries in order to provide company memory, search, insights and reporting features inside your workspace.

• Original content remains in the source tool and is fetched on demand
• Permissions from each source tool are mirrored, never widened
• No customer data is used to train third-party foundation models

3.
Sub-processors

We maintain a current list of sub-processors and give 30 days' notice before adding a new one, so you have time to object.

4.
International transfers

Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses, with a transfer impact assessment available on request. Enterprise workspaces may pin data residency to the EU or US.

5.
Security measures

AES-256 encryption at rest, TLS 1.3 in transit, least-privilege internal access, mandatory review on all production changes and annual penetration testing.

6.
Deletion and return

On termination we delete the connective layer within 30 days, or return an export first if you ask. Backups age out within a further 30 days.