Legal
Last updated: October 27, 2026
This DPA is being finalised. The outline below reflects our current data processing practices. To request a countersigned DPA, use the contact form at the bottom of this page.
"Controller" means the entity that determines the purposes and means of processing personal data. "Processor" means AuditFlo, acting on instructions from the Controller. "Personal Data" has the meaning given in applicable data protection law.
This DPA applies to all processing of personal data carried out by AuditFlo on behalf of the Customer in connection with the provision of the AuditFlo platform. Processing continues for the duration of the subscription agreement.
AuditFlo processes personal data solely to provide the compliance evidence automation services described in the Terms of Service. Processing includes collection, storage, retrieval, and deletion of evidence data from connected integrations.
Data subjects include Customer employees, contractors, and third parties whose personal data appears within the Customer's connected integrations (e.g. GitHub commit authors, Jira ticket assignees).
The Customer warrants it has a lawful basis to transfer personal data to AuditFlo and has provided all required notices to data subjects. The Customer remains the Controller responsible for the accuracy and legality of personal data.
AuditFlo will: (a) process personal data only on documented instructions from the Customer; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement appropriate technical and organisational security measures; (d) assist the Customer in responding to data subject requests.
AuditFlo uses the following sub-processors: Neon (PostgreSQL database hosting), Cloudflare (R2 object storage, CDN), Stripe (billing), Resend (transactional email), and Vercel (optional deployment). AuditFlo will notify Customers of changes to this list with 30 days' notice.
Where personal data is transferred outside the EEA or UK, AuditFlo relies on Standard Contractual Clauses approved by the European Commission, or equivalent transfer mechanisms permitted under applicable law.
AuditFlo implements: encryption at rest and in transit (TLS 1.2+, AES-256); access controls with MFA enforcement; regular security testing; incident response procedures with 72-hour notification to Customers for personal data breaches.
Upon termination of the subscription, personal data will be retained in read-only mode for 90 days and then permanently deleted, unless a longer retention period is required by law.
This DPA is governed by the same law as the Terms of Service. For EU/EEA Customers, the Standard Contractual Clauses shall prevail to the extent of any conflict.
For questions about this DPA or to request a signed copy, use the contact form below.