Data processing agreement
For companies whose content RFX processes on their behalf: the terms under Article 28 GDPR and the Swiss FADP.
1. Parties
The company using RFX (the controller) and [legal entity that operates RFX, registered address, registration number] (the processor). [how the DPA is concluded: accepted with the terms of use, or signed separately]
2. Subject matter and duration
Hosting, indexing and disclosing the company's content on RFX at the levels it chooses, for as long as the company uses RFX. [confirm]
3. Nature and purpose
Storing documents and connected data; reading them with a language model into capability claims that quote their source; answering other companies' agents within the levels, the NDA and the approvals the company gives; keeping the trail of what was disclosed.
4. Types of personal data
Names, work contact details and roles of the company's people; personal data that appears in documents the company uploads or connects. [special categories: none expected; confirm]
5. Categories of data subjects
Employees and contractors of the company; people named in its documents.
6. Obligations of the processor
[process only on documented instructions; confidentiality of personnel; security measures (Annex 2); sub-processors (Annex 1) with prior notice and right to object; assistance with data subject requests and with security, impact assessments and consultations; breach notification within [hours]; deletion or return at the end; audits and information]
7. Annex 1: sub-processors
| Service | For | Data | Where |
|---|---|---|---|
| Cloudflare | Network in front of the site (the tunnel), TLS; object storage (R2) for encrypted backups and signed NDAs | IP address and request metadata; encrypted backup files; signed NDA documents and their audit trail | [region and transfer basis, to confirm] |
| Resend | Sending email: sign-in links and codes, agent confirmations, notices of decisions waiting | Email address, the message | EU (eu-west-1, Ireland) |
| Yousign | Electronic signature of NDAs, when switched on | Signer name, email, the NDA document | [region, to confirm] |
| Anthropic | Language model: reads vendor documents into capability claims, transcribes images and scans, the RFX assistant | Content of vendor documents; messages typed to the assistant; names in them | [region and transfer basis, to confirm] |
| Sentry (only if switched on) | Reporting unexpected errors and missed backups | The error and its stack trace; nothing about the request | [region, if used] |
| Langfuse (only if switched on) | Tracing language-model calls | The RFX assistant's conversations: what a person writes, what the assistant reads and does for them, and its answers, with keys and tokens removed. For other model calls, metadata only: model, tokens, time, hashes, pseudonymous company ids | [region, if used] |
8. Annex 2: technical and organisational measures (from the code)
- HTTPS only, through Cloudflare; the server opens no port to the internet.
- Agent keys and session tokens are stored only as SHA-256 hashes; sign-in codes are single-use and expire after 15 minutes.
- Sessions are HttpOnly, Secure, SameSite cookies valid 12 hours; signing and paying need a sign-in of the last 10 minutes.
- Roles per person (admin, approver, signer, viewer); agents cannot sign, approve or pay.
- Each company sees only its own data; level-2 and level-3 content opens to a buyer only after an NDA and a person's approval.
- The database runs on a private network with no route to the internet, under a role that owns only RFX's tables.
- Encryption at rest (AES-256-GCM) of the database, the activity log, signed documents and vendors' files, with a key held only by the RFX application: the database, its backups and the storage bucket hold nothing readable without it.
- Continuous write-ahead-log archiving, nightly base backups and dumps kept 14 days, point-in-time recovery; an encrypted off-site copy (file names and contents) every 5 minutes.
- An activity log of every agent action and every decision on the page, with secrets removed.
- Rate limits on sign-ins, mails, registrations and the assistant.
[organisational measures: who at RFX has access, how access is granted and reviewed, incident response]
9. International transfers
[standard contractual clauses or other basis, per sub-processor]
10. Deletion at the end
When a company leaves, [its content is deleted within [days]; backups age out within 14 days].
Last updated: [date]