Data processing agreement

Overview

This Data Processing Agreement (DPA) forms part of the agreement between Nordvec (the Processor) and your organisation (the Controller). It governs how we process personal data on your behalf in accordance with GDPR Article 28.

Scope of processing

Nordvec processes data solely to provide the contracted services. This includes employee names, email addresses, and the content of documents and messages your organisation connects to the platform. Documents are stored in EU data centres, generation and embeddings run in France; the processors involved are listed individually in our sub-processor register.

Data processing activities

When your organisation connects data sources to Nordvec, document content undergoes the following processing: (1) Text extraction and normalisation from the source format, (2) Semantic chunking into structured segments for indexing, (3) Vector embedding generation via a third-party AI provider, listed in our sub-processor register together with the training commitments we have verified for it and the date of that verification, and (4) Storage of the resulting vector representations and text segments in our EU-hosted database for semantic search retrieval. The original document content is stored so that answers and reports can cite their sources. Nordvec does not use document content to train AI models.

Automated content scanning

Nordvec performs automated pattern-based scanning of the text extracted from documents during ingestion to detect potential credentials and API keys (such as cloud provider access keys, authentication tokens, and private keys). A detected value is replaced with a placeholder in the search index Nordvec builds from that text, so search results and the passages the AI model receives from that index do not contain it. The scan does not remove the value from the document text Nordvec stores or from any original file it retains, and it does not alter content in your source systems. Content that does not pass through the index is not redacted and may be processed by the AI model, including files sent for text recognition, images, a passage a user selects in the document viewer, and a document a user copies into a chat to edit it. A document in which a credential was detected is flagged, and the flag is shown to the user who owns the document in their security settings and, for documents submitted through the Push API, in the document's status response. The scanning does not constitute a guarantee of detection, and your organisation remains responsible for managing sensitive content within its source systems.

Security measures

We implement appropriate technical and organisational measures: AES-256 encryption at rest, TLS in transit, row-level security with per-tenant data isolation, role-based access controls, automated security testing on every change (static analysis, dependency vulnerability scanning and secret scanning), and continuous monitoring. Customer documents are stored in an EU data centre in Ireland, operated by a sub-processor listed in our sub-processor register. Nordvec has no second sign-in factor of its own. A sign-in through Google or Microsoft carries the multi-factor policy of the Google or Microsoft account used; a sign-in with an email and password is one factor, and any account can set a password through a reset email, so a workspace cannot yet require its members to sign in through a provider. Sensitive operations, such as account deletion and API key creation, require a sign-in within the last five minutes.

Data retention

Document content, vector embeddings and associated metadata are kept for the duration of the service agreement. When your organisation disconnects a data source, the documents synced from it are deleted with everything derived from them (vector embeddings, text chunks and stored files). A document deleted on its own moves to trash and is permanently deleted after 30 days. After the service agreement ends, all data is deleted within 30 days unless applicable law requires longer retention.

Sub-processors

Nordvec maintains a per-entity register of every sub-processor engaged to deliver the Service. For each one it records the legal name, country of incorporation, corporate parent, processing location, purpose, the categories of personal data, and the Chapter V transfer basis that applies. The register is generated from the code that reaches each provider and re-verified on every change, so a provider cannot be engaged without appearing in it. The current register is published at nordvec.com/subprocessors, with a machine-readable copy and its revision history at nordvec.com/api/trust/subprocessors. We will notify you at least 30 days before a new sub-processor begins processing, and you have the right to object.

International transfers

Documents stored in the EU; AI processing in France. Where a processor in the chain is incorporated outside the EEA, or has a parent that is, a Chapter V transfer basis applies to that processor: our sub-processor register states the basis for each entry, together with the date it was verified, so you can check it per processor rather than rely on a blanket statement here.

Data breach notification

We will notify you within 24 hours of detecting a personal data breach. We assist you in complying with breach notification obligations under GDPR Articles 33 and 34, including notifications to your supervisory authority and affected data subjects.

Data subject rights

The following rights are self-service in the Nordvec platform: access and data portability (Art. 15, 20) through the JSON export in the settings; erasure (Art. 17) through account deletion, which freezes the account at once and erases it in one transaction 14 days later; rectification (Art. 16) through profile editing and per-memory correction; restriction (Art. 18) through per-memory pause, source toggles and upload settings; and objection (Art. 21) through the memory switch. Requests beyond self-service are filed in the platform, addressed to the controller, and settled by the controller's administrators in the request register with the Art. 12(3) deadline tracked; the processor assists on request.

Deletion and data retention

During the agreement, deletions in your source systems reach Nordvec through webhooks or the next sync, and a document in trash is purged after 30 days. When an account is deleted, it is frozen at once and its data (conversations, documents, embeddings, integration tokens) is erased in one transaction 14 days later, unless the account holder cancels within that period. No backup copy of the database exists beyond the running instance, so an erasure is complete once it finishes. After the agreement ends, all personal data is deleted within 30 days.

Audit rights

You have the right to audit our compliance with this agreement. We make available: this DPA and our compliance documentation, our DPIA for AI processing, the Art. 30 processing register, and our sub-processor register with the transfer basis recorded for each processor. We hold no third-party certification today. Our controls are published individually on our trust center, each linked to the code that implements it, and exported as OSCAL so you can load them into your own audit tooling.

Contact

For DPA-related inquiries or data subject access requests, contact us at legal@nordvec.com; the current sub-processor register is published at nordvec.com/subprocessors. Privacy contact: dpo@nordvec.com.