Data processing agreement (DPA)

This data processing agreement (the “agreement”) is entered into between your business, the customer, as controller, and VELM, a French single-shareholder simplified joint-stock company (SASU) with a share capital of €5,000, registered with the Paris Trade and Companies Register under number 104 221 841, with its registered office at 229 rue Saint-Honoré, 75001 Paris, France, which operates Truviate, as processor. It is the agreement required by Article 28(3) of Regulation (EU) 2016/679 (GDPR) and applies to the personal data contained in the documents you upload and in the records derived from them (the “customer data”).

The agreement forms an integral part of the terms of service and is accepted with them when the account is created, by the person entitled to bind your business. Its version and date appear at the top of this page; each version replaces the previous one for processing after its date. Where the agreement and the terms of service conflict on a data protection matter, the agreement takes precedence. “Personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have the meaning given to them by the GDPR.

As controller, you:

• alone determine the purposes and means of the processing of customer data, and ensure that it rests on a valid legal basis;
• are entitled to upload the documents you upload, including the personal data they contain, and have given data subjects the information required by Articles 13 and 14 of the GDPR;
• do not upload special categories of data (Article 9 of the GDPR) or data relating to criminal convictions and offences, as the service is not designed for them;
• give your instructions through the use of the service described in article 4, set the retention period of your workspace and perform yourself the deletions you consider necessary;
• answer the data subject requests you receive, VELM forwarding to you those it receives directly;
• keep your own records and, where applicable, carry out your impact assessments and prior consultations, with the assistance provided for in article 9.

You have the following rights: to give instructions and to be informed when an instruction appears to infringe the law (article 4), to be notified of a data breach (article 7), to object to a new sub-processor (article 8), to obtain the deletion or return of customer data at the end of the service (article 10) and to verify compliance with this agreement (article 11).

• Subject-matter: storage and analysis of the documents you upload in order to verify draft invoices against agreements and approved work.
• Duration: for as long as your workspace exists; processing ends with its deletion, subject to the retention periods stated in the privacy policy.
• Nature: storage, text extraction, AI-assisted extraction of billing terms from the agreement text, deterministic comparison of approved work and draft invoices, presentation of findings and evidence, and the audit trail.
• Purpose: to let you verify your invoices before you send them. VELM processes customer data for no other purpose, and never to train models.
• Types of data: identification and professional data as they appear in agreements and in time, expense and invoice exports — names, roles, email addresses, rates, hours, amounts and contract terms.
• Categories of data subjects: your staff and contractors, your clients’ staff and contacts, and any other person named in those documents.

VELM processes customer data only on your documented instructions. This agreement, the terms of service and your use of the service — including the retention period you set and the deletions you perform — constitute those instructions. Any further instruction is given in writing to support@truviate.com; VELM tells you whether it can act on it and on what conditions.

These instructions cover transfers of customer data outside the European Union, limited to the sub-processors of annex 1, for the roles and with the safeguard stated there. If, in the opinion of VELM, an instruction infringes the GDPR or other EU or member-state data protection law, VELM informs you without delay and may suspend the execution of that instruction until you have confirmed or amended it. VELM processes customer data outside your instructions only where EU or member-state law requires it, in which case it informs you beforehand unless that law prohibits it on important grounds of public interest.

Only persons who need access to operate the service have access to customer data, and each is bound by a contractual or statutory duty of confidentiality. Customer data is never shared with other customers.

VELM implements the technical and organisational measures described in annex 2 and in the security overview, and maintains them at a level appropriate to the risk, taking into account the state of the art and the nature of the customer data. Annex 2 contains only measures that are in place: a measure withdrawn from the service is removed from the annex by a new version of this page, and a new measure is added only once it is in service.

VELM notifies you of any personal data breach affecting customer data within 48 hours after becoming aware of it, by email to the owners of the workspace concerned. The notification contains, or is completed in stages as soon as the elements are available:

• the nature of the breach, with the categories and approximate number of data subjects concerned and the categories and approximate number of records concerned;
• the name and contact details of the contact point where more information can be obtained;
• the likely consequences of the breach;
• the measures taken or proposed to address it, including, where appropriate, measures to mitigate its possible adverse effects.

VELM documents the breach and assists you with your own notifications to the supervisory authority and to the data subjects (Articles 33 and 34 of the GDPR). It does not notify the authority or the data subjects on your behalf unless you instruct it in writing.

You give a general authorisation for the sub-processors listed in annex 1, for the roles stated there. VELM imposes on each of them, by contract, data protection obligations equivalent to those of this agreement and remains fully liable to you for their performance. Before a new sub-processor handles customer data, VELM updates annex 1 and notifies workspace owners by email with at least 30 days’ written notice; you may object on reasonable data protection grounds, in which case VELM proposes a solution or you may terminate the service under the terms of service.

Taking into account the nature of the processing, VELM assists you, with appropriate technical and organisational measures, in responding to requests from data subjects concerning customer data, and, given the information available to it, in meeting your obligations regarding security, breach notification, data protection impact assessments and prior consultation of the supervisory authority.

You can delete files, and the whole workspace, yourself at any time; nothing is recoverable after deletion. At the end of the service — deletion of the workspace, closure of the account or termination of the terms of service — you choose between the deletion and the return of the customer data still held.

Return: on written request sent to support@truviate.com within 30 days of the end of the service, VELM hands you a copy of the customer data still held, in a common, machine-readable format. This return is carried out by VELM, on request; it is not a feature of the application. Absent a request within that period, and after any return, VELM deletes the customer data still held: raw files through the retention process, other records with the deletion of the workspace, and any remaining data on your written request. Copies are kept only where EU or member-state law requires it, and only for that purpose.

VELM makes available the information necessary to demonstrate compliance with Article 28 of the GDPR, starting with this page, its annexes and the security overview. On written request, and no more than once a year, VELM answers first by providing documentation and, where that is not sufficient, allows and contributes to an audit, including an inspection, conducted by you or by an auditor you mandate, at your expense, on reasonable written notice and in a manner that does not compromise the security of other customers. VELM informs you if, in its opinion, an instruction given in that context infringes data protection law.

This agreement takes effect on acceptance of the terms of service and remains in force for as long as VELM processes customer data on your behalf, including after the end of the terms of service, until the deletion or return provided for in article 10. Its term and termination follow those of the terms of service (article 11 of the terms). Each party’s liability under this agreement is governed by article 10 of the terms of service, which applies to the agreement as it applies to the terms.

A dated PDF copy, signed by VELM, is available on request from david@truviate.com.

List in force at the date shown at the top of the page. For each processor: the purpose for which it is involved, the location where it holds the data for that role, and the safeguard on which a transfer outside the European Union relies. Processors that handle only account or billing data, for which VELM is the controller, are listed as well, for completeness, with what they receive.

• Vercel Inc., United States — hosting of the application and its server functions, scheduled jobs, content delivery and application logs; requests, including uploaded files while they are being processed, pass through its servers. Location: United States, with server functions executed in the Frankfurt region. Transfer safeguard: certified under the EU–U.S. Data Privacy Framework.
• Supabase, Inc., United States — database, file storage and authentication, including sessions, second factors and sign-in with Google. Location: project hosted in the European Union (Frankfurt, Germany). Transfer safeguard: the European Commission’s standard contractual clauses (Decision 2021/914), incorporated into its contract; the data is hosted in Frankfurt.
• Google (Google Workspace), Ireland — the support mailbox behind support@truviate.com, where the messages you send us are stored; receives customer data only if you attach it to a message yourself. Location: Ireland, with processing in the United States. Transfer safeguard: Google LLC is certified under the EU–U.S. Data Privacy Framework; the European Commission’s standard contractual clauses are incorporated into the Google Workspace contracts where required.
• Anthropic, PBC, United States — AI provider, for extraction of billing terms from the agreement text. Agreement text is sent for each request; under the provider’s standard API terms it may be kept, with the output, for up to 30 days (longer if an exchange is flagged for a policy violation). No zero-data-retention agreement is in place. Location: United States. Transfer safeguard: the European Commission’s standard contractual clauses (Decision 2021/914, modules 2 and 3), incorporated into its commercial terms.
• Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., United States — payment processing, invoicing and VAT determination; receives your billing details and your payment method, never customer data. Location: Ireland and United States. Transfer safeguard: certified under the EU–U.S. Data Privacy Framework; in addition, the European Commission’s standard contractual clauses (Decision 2021/914) are incorporated into its data transfer addendum.
• Resend, Inc., United States — transactional email: account messages (verification, sign-in, password and email changes, security notices), invitations and subscription notices; receives email addresses and the content of those messages, never customer data. Location: United States. Transfer safeguard: certified under the EU–U.S. Data Privacy Framework.
• Cloudflare, Inc., United States — bot protection (Turnstile) on sign-in, sign-up and public forms, which receives connection and browser signals, not document contents, and the DNS of our domain. Location: United States. Transfer safeguard: certified under the EU–U.S. Data Privacy Framework; the European Commission’s standard contractual clauses as a fallback.

Measures in place at the date of this version. Each exists in the code or the configuration of the service; none is a plan. Measures provided by a supplier are stated as such.

• All traffic is encrypted in transit (TLS); in production, the HSTS header enforces HTTPS for two years, subdomains included.
• A content security policy with a nonce generated for each request allows only the service’s own scripts, and the application forbids being embedded in a third-party frame.
• Encryption at rest of the database and the file storage: provided by the database and storage supplier (Supabase), for a project hosted in Frankfurt.

• Every business record carries the identifier of its workspace; the database’s row-level security returns only the rows of workspaces the signed-in user is a member of, whatever the query.
• Files are stored in a private bucket — no object is public — and the storage rules limit reading, uploading and deleting to the members of the workspace whose prefix contains the file.
• Workspace membership and role (owner or member) determine what a user can see and do; only owners manage members, and removing a member revokes their access immediately.
• High-privilege service credentials are loaded only in server-only modules, never in the browser.
• Findings and engine runs are written only by the server, and decisions are append-only: none of them can be altered from the client.

• Authentication is provided by the identity provider; VELM never stores passwords in clear text. Bot protection applies to sign-in, sign-up and the public forms.
• An enrolled TOTP second factor is required before the first document upload: agreement and export uploads are refused without an enrolled authenticator.
• Sensitive actions — member and invitation management, security settings, deletion of files and of the workspace — require a recent second-factor verification (AAL2); the database enforces that requirement itself through restrictive policies on the tables and storage concerned.
• From the security settings, a user can sign out their other sessions; a password change also signs out the other sessions.

• Append-only audit trail: rule confirmations, decisions on findings, membership changes and deletions are recorded with the author and the timestamp; workspace members can read it, nobody can alter or erase it from the application.
• Raw files that were not deleted are purged automatically in the daily pass that follows the end of the workspace’s retention period (30 days by default, adjustable between 7 and 90 days by the owner); the pass is protected by a shared secret and every deletion is recorded in the audit trail.
• Deleting a workspace deletes all of its records in cascade.
• Application logs accept scalar fields only; fields that could carry content or identifiers (text, excerpts, prompts, emails, tokens) are refused, and every string derived from an error goes through secret redaction before it is logged.

• Changes to the database schema are made only through additive, immutable migrations, checked by a guard in continuous integration before any production release.
• The measures in this annex are exercised by automated tests run on every change to the service, and the public pages that describe them are checked by tests against the code.