Data Processing Agreement

This page summarizes how Dealenz processes customer data. Enterprise customers receive a signed copy on request before procurement review. Nothing here is legal advice; the signed agreement governs.

Roles and subject matter

The customer is the controller of deal content (contracts, counterparty details, uploaded files). Dealenz acts as processor, handling that content only to provide analysis, drafting, signing, monitoring, and support.

Subprocessors

Infrastructure and model providers with data access: Supabase (Postgres, Auth, storage; EU region), the configured AI providers used for extraction and synthesis, Paddle (software billing, merchant of record), Gmail API scopes granted by the customer (read threads, send alerts), and Vercel (hosting). The live list is confirmed in each signed DPA.

Security measures

AES-256 encryption at rest, TLS in transit, owner-scoped row-level security on every table, least-privilege service functions, SSO/SAML and TOTP two-factor authentication, immutable signature and version audit records. See /security for the current posture and SOC 2 Type II audit status.

Retention and deletion

Deal content is kept until the owner deletes the deal or the account. Deleting a deal removes its files, threads, documents, and monitoring state; deleting the account erases everything via Settings. Billing records and provider backups age out on their own schedules.

International transfers and breach notice

Primary processing and storage are in the EU. Where a subprocessor processes data elsewhere, transfers rely on that provider's adequacy coverage or standard contractual clauses. Breach notification follows GDPR timelines: without undue delay and within 72 hours where required.