LEGAL — DATA PROCESSING AGREEMENT
The DPA, in plain terms.
The terms that govern personal data Evident processes on your behalf. The signed version attached to your order form takes precedence.
LAST UPDATED 12 APRIL 2026
VERSION 3.0
EU HOSTED
ON THIS PAGE
01
02
03
04
05
06
07
08
09
01
This agreement applies when Evident processes personal data on behalf of a customer in the course of providing the platform. The customer is the controller; Evident Labs GmbH is the processor.
The subject matter is the provision of AI assurance software. The duration is the subscription term plus the deletion window. The nature of processing is storage, retrieval, analysis and export of evidence.
Data subjects: customer employees, contractors, auditors and guests invited to the register.
Categories of data: identification and contact data, role and access data, and evidence content the customer chooses to upload.
02
We process personal data only on documented instructions from the customer, including the order form and this agreement. We do not use customer data for our own purposes, including model training.
Everyone with access is bound by confidentiality, receives security training and has access reviewed monthly. We assist the customer in responding to data subject requests and in meeting their own GDPR obligations.
03
The current subprocessor list is published on the security page and includes hosting, email delivery, payments and support tooling. Each is bound by terms no less protective than these.
We give 30 days’ notice before adding a subprocessor. The customer may object on reasonable data protection grounds, and where the objection cannot be resolved, terminate the affected service without penalty.
04
Customer content is hosted in the EU by default — Frankfurt primary, Dublin failover — with no replication outside the region.
Where support requires access from outside the EEA, we rely on the European Commission’s standard contractual clauses and apply supplementary measures: named access, time-bound elevation and no bulk export.
05
Annex II of the signed DPA contains the full control set. The summary below is accurate but not a substitute for the annex.
TLS 1.3 in transit, AES-256 at rest, per-tenant keys, customer-managed keys on Enterprise.
SSO, SCIM, hardware keys and monthly privileged access review.
Continuous control monitoring, annual penetration testing and a SOC 2 Type II report.
Incident response runbook, tested twice a year, with documented escalation.
06
We notify the customer without undue delay and within 48 hours of confirming a personal data breach. The notification includes what happened, the data and data subjects affected, likely consequences and the measures taken.
Where the facts are not yet complete, we send an initial notice and follow up as the investigation progresses. We do not wait for a finished root-cause analysis before telling you.
07
A current SOC 2 Type II report and the latest penetration test summary are available under NDA. These satisfy most customer audit requirements without an on-site visit.
Where a regulator or customer requires more, we allow a remote audit on 30 days’ notice, no more than once per twelve months, at the customer’s cost and subject to confidentiality.
08
On termination, the customer may export all customer content for 30 days in CSV, XLSX and JSON. Exports include provenance metadata.
After that window we delete customer content from production systems within 30 days, and from backups within 90 days. We retain only what law requires, and only for as long as it requires.
09
Liability under this agreement is subject to the limitations in the main agreement. Nothing here increases the cap agreed between the parties.
If there is a conflict between this agreement and the main agreement on the processing of personal data, this agreement prevails. Otherwise the main agreement governs.
Questions about this document?
DPA@EVIDENT.SYSTEMS · LEGAL@EVIDENT.SYSTEMS
Contact legal