Data processing agreement
How we process personal data on behalf of your firm, in line with Article 28 of the UK GDPR and EU GDPR.
Roles
Your firm is the data controller. doclasso is the data processor and acts only on your instructions.
What we process, and for how long
Client contact details and the documents your clients submit, for as long as your subscription is active, plus the retention period you set for files held in our bucket.
Security measures
Encryption in transit and at rest. A private file bucket served only through short-lived signed links. Row-level security so one firm can never read another firm’s data. Client link tokens that are long, random, stored hashed and revocable. Rate limiting, and executable uploads blocked.
Sub-processors
Supabase (database, file storage, sign-in), Vercel (hosting), Stripe (billing), Resend (email), Twilio (SMS) and Google (Drive). Meta is added if you use WhatsApp, and Dropbox if you connect it. Email privacy@doclasso.com for the current list.
Personal data breaches
If a breach affects your clients’ data we will tell your firm without undue delay, with what we know and what we are doing about it.