Software for law firm privacy teams

Privacy documentation your lawyers review, not retype

The facts and drafting groundwork prepared in one place, with every open point marked as a gap for a lawyer to resolve.

Scan your clients’ websites Start free trial →

Associates retyping client facts

Facts are collected once and reused across the DPA, privacy policy, records of processing and retention schedule.

Responsibility stays with counsel

Regimes and the controller or processor role are suggested with the trigger shown, and applied only when a lawyer confirms.

Firm precedent, not generic text

Your precedent clauses become firm templates used instead of generated text.

See the workspace you'll open on Monday

A demo practice with 12 fictional clients. Every screen below is the real product, rendered from that workspace.

Every client of the practice on one page, with what each one needs next — an interview to finish, a document to regenerate, a questionnaire to check.

app.clausebench.com/clients — demo workspace

Clients

12 clients in your practice

Client

All clients12 clients

Needs attention11 clients

Out-of-date documents6 clients

All good0 clients

Search clientsViewStatusRegimeOwner

Client	Progress	Documents	Gaps	Next action	Updated
🇩🇪 Ardent Robotics GDPR · EU AI Act	70%	—	0	Continue the interview: 7 answers left	7 days ago
🇮🇪 Bramble Health GDPR	100%	14 total	5	Review the subprocessor list	2 days ago
🇮🇪 Idlewood Labs GDPR	58%	—	0	Continue the interview: 8 answers left	3 days ago
🇳🇱 Kestrel Logistics GDPR · NIS2	100%	20 total · 5 out of date	0	Regenerate 5 documents	5 days ago
🇩🇰 Marrow Data GDPR	100%	14 total	0	Review the subprocessor list	13 days ago
🇩🇪 Northwind Analytics GDPR	100%	14 total · 4 out of date	0	Regenerate 4 documents	3 days ago
🇩🇪 Oakhill Fintech GDPR · NIS2 · EU AI Act · DORA	100%	35 total · 3 out of date	1	Regenerate 3 documents	9 days ago
🇧🇪 Pelham Systems GDPR · NIS2	100%	20 total	0	Review the subprocessor list	9 days ago
🇸🇪 Quillon Software GDPR	100%	14 total · 3 out of date	0	Regenerate 3 documents	6 days ago
🇫🇷 Sable CommerceWatchlist No regimes confirmed	—	—	0	Start the interview	21 days ago
🇬🇧 Tallow & Finch UK GDPR	100%	14 total · 3 out of date	0	Regenerate 3 documents	4 days ago
🇳🇱 Verity Staffing GDPR	100%	14 total · 4 out of date	0	Regenerate 4 documents	8 days ago

Enterprise vendor security questionnaire.xlsx

Tallow & Finch

Of 24 questions: 16 confirmed, 5 to check, 3 gaps

#	Question	Answer	Status	Source
1	Is customer data encrypted at rest?	Yes. All customer data is encrypted at rest.	Confirmed	security_whitepaper#infrastructure
2	Is data encrypted in transit?	Yes. All traffic uses TLS.	Confirmed	security_whitepaper#practices
3	Do you enforce multi-factor authentication for staff?	Yes, for all staff accounts.	Confirmed	access_control_policy#authentication
4	Where is customer data hosted?	In the EU, on Microsoft Azure (Frankfurt).	Confirmed	security_whitepaper#infrastructure
5	Do you have a documented incident response process?	Yes. A written runbook, tested twice a year.	Confirmed	incident_response_policy#process
6	How long do you retain customer data after termination?	90 days after the contract ends, then deleted.	Confirmed	retention_schedule#table
7	Do you use subprocessors?	Yes. The current list is published with our DPA.	Confirmed	subprocessor_list#table
8	Will you notify us of new subprocessors?	Yes, in advance, as set out in the DPA.	Confirmed	dpa#subprocessors
9	Who is your privacy contact?	[email protected]	Confirmed	privacy_policy#controller
10	Do you sign a data processing agreement?	Yes. Our DPA follows Article 28 UK GDPR.	Confirmed	dpa#gdpr_art28
11	How do you handle data subject requests?	Through a documented procedure with a one-month response target.	Confirmed	dsar_procedure#handling
12	Is production access restricted?	Yes, to named engineers with just-in-time access.	Confirmed	access_control_policy#production_access
13	Do you export data on termination?	Yes, on request before deletion.	Confirmed	dpa#termination
14	Do you process special category data?	No.	Confirmed	privacy_policy#data_collected
15	Do you process children's data?	No.	Confirmed	privacy_policy#data_collected
16	Where are your customers located?	The United Kingdom, Germany and the Netherlands.	Confirmed	privacy_policy#controller
17	Do you perform background checks on employees?	Drafted from general policy wording; please confirm with HR.	Check	—
18	How often do you review access rights?	Access is reviewed when roles change; the review cadence is not documented.	Check	—
19	Do you have a business continuity plan?	A plan exists in outline; testing frequency needs confirmation.	Check	—
20	Do you classify data by sensitivity?	Customer data is treated as confidential; a formal scheme is not documented.	Check	—
21	Do you have cyber insurance?	Outside the scope of the documents; please confirm.	Check	—
22	Have you had an independent penetration test in the last 12 months?	Not currently in place. Planned; timing to be confirmed.	Gap	—
23	Do you hold ISO 27001 certification?	Not currently in place.	Gap	—
24	Do you run security awareness training for all staff?	Not currently in place. Planned; timing to be confirmed.	Gap	—

Quillon Software

Trust Center

Quillon Software

How Quillon Software protects the data of its customers: security measures, subprocessors, retention and documents.

Security overview

Overview

Quillon Software runs a multi-tenant service in the EU. Customer data is logically separated per customer and never used to train models.

Infrastructure

Hosted on Microsoft Azure in EU (Frankfurt), with encrypted storage and daily encrypted backups kept for 30 days.

Security practices

Multi-factor authentication for every staff account, named-engineer production access, code review for every change and an incident runbook tested twice a year.

Data protection measures

Hosting provider: Microsoft Azure
Customer data is encrypted at rest
All traffic is encrypted in transit (TLS)
Multi-factor authentication is enforced for staff

Subprocessors

Subprocessor	Legal entity	Country	Purpose	Transfer mechanism	Data processing agreement
Amazon Web Services	Amazon Web Services EMEA SARL	LU	Amazon Web Services for service delivery	SCC	https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
Intercom	Intercom R&D Unlimited Company	IE	Intercom for service delivery	DPF	https://www.intercom.com/legal/data-processing-agreement
Mixpanel	Mixpanel, Inc.	US	Mixpanel for service delivery	DPF	https://mixpanel.com/legal/dpa/
Sentry	Functional Software, Inc. d/b/a Sentry	US	Sentry for service delivery	DPF	https://sentry.io/legal/dpa/
Stripe	Stripe Payments Europe, Limited	IE	Stripe for service delivery	DPF	https://stripe.com/legal/dpa

Data retention

Data	Retention
Customer data after the end of the relationship	90 days after the contract ends
Technical logs	30 days
Support conversations	2 years
On termination of the contract	Exported to the customer, then deleted

Documents

Security documentation and reports

Security overviewupdated 2026-09-19Download

Privacy

Privacy policyupdated 2026-09-20Download

Legal

Data processing agreementupdated 2026-09-18On request

Privacy contact

[email protected]

Vendor changes

43 open changes across your clients

TwilioCriticallegal entity changeddetected 2 days ago
Twilio now contracts EU customers through Twilio Ireland Limited instead of Twilio Inc.
AffectsKestrel Logistics· regenerate DPA, Subprocessor list
MixpanelNotablesubprocessor addeddetected 5 days ago
Mixpanel added a new sub-processor for data warehousing in the United States.
AffectsMarrow DataQuillon Software· regenerate Subprocessor list
AnthropicNotabledpa updateddetected 6 days ago
Anthropic's Data Processing Addendum has been added to their legal documents. This document is now available for review by organizations that need to establish data processing terms with Anthropic.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 6 days ago
Anthropic removed the Data Processing Addendum section heading from their document.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
MailchimpNotablenew versiondetected 6 days ago
Mailchimp updated its Data Processing Addendum to English on September 26, 2024, replacing the previous German version. The document defines key terms including sub-processors, sensitive data restrictions, and Mailchimp's role as a processor handling customer data, which affects how organizations must document processing activities and manage their subprocessor lists.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 6 days ago
Anthropic added a Data Processing Addendum to its legal documents. This document establishes the terms for how personal data is processed when using Anthropic's services.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
CohereNotablesubprocessors changeddetected 6 days ago
Cohere removed New Hire Screening from its subprocessor list. This means the vendor is no longer identifying this function as a subprocessor that processes your data.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
MailchimpNotabledpa updateddetected 6 days ago
Mailchimp updated its Data Processing Addendum to a German-language version with expanded definitions and clarified obligations. The changes include more detailed scope of prohibited data (Sensitive Data), additional references to multiple data protection frameworks including US state laws and the Australian Privacy Act, and restructured sections on roles, sub-processor management, and security measures that align with European standard contractual clauses.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
BirdNotabledpa updateddetected 3 days ago
Bird's Data Processing Agreement was updated with 31 lines added and 6 removed, though the added content appears to be formatting artifacts or corrupted text that does not reflect substantive legal changes to the agreement terms.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 4 days ago
Anthropic removed the Data Processing Addendum document from their legal documentation.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected yesterday
Anthropic's Data Processing Addendum has been added or updated. This establishes the contractual terms governing how personal data is processed when using Anthropic's services.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 5 days ago
Anthropic removed the "Data Processing Addendum" document reference from their documentation, which means the separate DPA document is no longer listed or available.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 5 days ago
Anthropic added a Data Processing Addendum (DPA) section to their legal documents, which establishes the terms for processing personal data and defines roles, obligations, and mechanisms for compliance with data protection regulations.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 3 days ago
The Data Processing Addendum section was added to the document.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
Amazon Web ServicesNotablesubprocessors changeddetected 2 days ago
AWS updated their subprocessor list by adding Partners and Resources as new entries and removing More.
AffectsNorthwind AnalyticsOakhill FintechQuillon SoftwareVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
AttioNotabledpa updateddetected 2 days ago
Attio updated its DPA effective September 2026, adding Swiss Federal Act on Data Protection to the list of applicable laws and clarifying that Switzerland is included in the definition of countries with adequate protection standards. The data processor handling call transcription changed from Gladia SAS to Baseten Labs, Inc., effective October 26, 2026, and Attio added a 72-hour breach notification deadline and explicit obligations around data deletion requests and sub-processor contracting standards.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
ChargebeeNotabledpa updateddetected 2 days ago
Chargebee's Data Processing Agreement was updated with minor wording changes to the description of their churn prevention and payment recovery features. This does not materially affect your data processing obligations or the scope of data handling documented in your agreement.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
ChargebeeNotablesubprocessors changeddetected 2 days ago
The subprocessor list was updated with a capitalization change in the service name for the churn prevention tool. This change should be reflected in your record of subprocessors to maintain accuracy with Chargebee's current documentation.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
SalesforceNotablesubprocessors changeddetected 2 days ago
No changes to the subprocessor list were detected.
AffectsKestrel LogisticsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
CalendlyNotablesubprocessor addeddetected yesterday
Calendly added HubSpot as a subprocessor, enabling integration with HubSpot forms for meeting routing. This means HubSpot will process personal data as part of Calendly's service and should be added to your subprocessor list and data processing documentation.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
BirdNotablesubprocessors changeddetected 3 days ago
Bird's subprocessor list was updated with 31 new entries added and 6 entries removed. The added entries appear to contain corrupted or unreadable data that cannot be clearly identified, while the removed entries were related to onboarding and API setup documentation.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
PostmarkNotabledpa updateddetected yesterday
Postmark removed promotional content about AI coding agents and email skills from their DPA, reducing the document by 4 lines of marketing material.
AffectsNorthwind Analytics· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
CalendlyNotablesubprocessors changeddetected 3 days ago
Calendly updated its subprocessor list by removing 4 entries and adding 4 new ones, replacing documentation focused on privacy, security, and data storage with content about event management and automation features.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
AnthropicNotabledpa updateddetected 2 days ago
The Data Processing Addendum title reference was removed from Anthropic's documentation.
AffectsVerity Staffing· regenerate DPA, Privacy policy, Record of processing, Subprocessor list
CalendlyNotablesubprocessors changeddetected 2 days ago
Calendly's subprocessor list was updated with 3 new entries and 4 removed entries. The changes include additions related to data subject rights and deletion processes, and removals of documentation about Managed Events and Managed Automation features.
AffectsVerity Staffing· regenerate DPA, Record of processing, Subprocessor list
SlackNotablesubprocessors changeddetected 2 days ago
I cannot write a change note because the detected facts show no lines were added or removed from Slack's subprocessor list.
AffectsVerity StaffingTallow & Finch· regenerate DPA, Record of processing, Subprocessor list
DatadogMinordpa updateddetected 10 days ago
Datadog published a new version of its DPA with updated security measures.
AffectsMarrow DataBramble Health· regenerate DPA
Google WorkspaceMinortrust page updateddetected 6 days ago
Google Workspace updated its trust page content from German to Polish language. This change affects the presentation of security and compliance information to Polish-speaking organizations but does not alter the underlying security features, data processing practices, or commitments documented in data processing agreements.
AffectsBramble HealthVerity StaffingTallow & Finch
MailchimpMinortrust page updateddetected 6 days ago
Mailchimp's trust page was updated to include expanded English-language security and compliance information, replacing what appears to have been German-language content. The added content details data center locations in the United States, encryption standards, employee security practices, insurance coverage for cyber and data privacy incidents, and compliance certifications including SOC 2 and ISO 27001, which may be relevant for documenting security controls in data processing agreements or subprocessor assessments.
AffectsVerity Staffing
StripeMinortrust page updateddetected 6 days ago
Stripe's trust page now lists Poland as a location where data processing occurs instead of Germany.
AffectsNorthwind AnalyticsQuillon SoftwareTallow & Finch
CohereMinortrust page updateddetected 6 days ago
Cohere removed the section describing their new hire screening process and confidentiality agreement requirements from their trust page. This may affect documentation of their personnel security controls in your records of processing.
AffectsVerity Staffing
Google WorkspaceMinortrust page updateddetected 6 days ago
Google Workspace updated its trust page with German language content replacing Polish language content. The changes do not appear to affect the substantive security, compliance, or data processing commitments documented for the subprocessor list or data processing agreement.
AffectsBramble HealthVerity StaffingTallow & Finch
MailchimpMinortrust page updateddetected 6 days ago
Mailchimp updated its trust page with a German-language version containing the same security and compliance information as the English version, including details about data center security, encryption standards, security certifications (SOC 2, ISO 27001), and insurance coverage. The change appears to be a localization of existing content rather than a substantive policy change, though the German version removes mention of staffed guard stations at office locations that was in the English original.
AffectsVerity Staffing
StripeMinortrust page updateddetected 6 days ago
Stripe's trust page was updated to list Germany as a location instead of Poland, which may affect where customer data is processed or stored according to their subprocessor list.
AffectsNorthwind AnalyticsQuillon SoftwareTallow & Finch
Microsoft 365Minortrust page updateddetected 3 days ago
Microsoft updated its trust page by replacing specific event registration information for a London event on October 20 with generic digital trust and cybersecurity content. This change does not affect the subprocessor list, record of processing, or data processing terms.
AffectsKestrel LogisticsPelham Systems
CloseMinortrust page updateddetected 4 days ago
Close's trust page was updated with a navigation link ("Skip to content"). This change does not affect subprocessor lists, processing records, or data processing agreement terms.
AffectsVerity Staffing
BambooHRMinortrust page updateddetected 4 days ago
BambooHR's trust page was updated with new entries dated 2026-09-21 and removed older entries from 2026-09-16. The change affects the current record of which subprocessors or processing activities are documented for this vendor.
AffectsVerity Staffing
BambooHRMinortrust page updateddetected yesterday
BambooHR's trust page was updated with 3 new lines and 3 removed lines, which may indicate changes to subprocessor details, processing activities, or security certifications that should be reviewed against your current records of processing and data processing agreements.
AffectsVerity Staffing
Microsoft 365Minortrust page updateddetected yesterday
Microsoft 365's trust page was updated with new references to Copilot products and removed previous Copilot categorizations. This may affect documentation of which AI-powered processing services are covered under their data handling commitments.
AffectsKestrel LogisticsPelham Systems
Amazon Web ServicesMinortrust page updateddetected 2 days ago
The AWS trust page removed a "More" link and added a "Partners" section, which may affect how subprocessor information is organized or accessed for compliance documentation.
AffectsNorthwind AnalyticsOakhill FintechQuillon SoftwareVerity Staffing
ChargebeeMinortrust page updateddetected 2 days ago
Chargebee's trust page updated its description of the churn prevention feature with minor wording changes, changing "Prevent & Predict" to "Prevent and Predict" and adjusting capitalization.
AffectsVerity Staffing
BambooHRMinortrust page updateddetected 3 days ago
BambooHR updated their trust page with a new timestamp, replacing the previous one from approximately 5 minutes earlier.
AffectsVerity Staffing
StripeMinortrust page updateddetected 3 days ago
Stripe removed "Stripe Signals" from their trust page documentation. This may affect records of what data processing services or features are currently listed as available.
AffectsNorthwind AnalyticsQuillon SoftwareTallow & Finch

Every change is read by a person before it reaches you. Nothing is sent to your clients.

Fictional practice and clients. No customer data is shown.

Start free trial Open the full demo →

A good fit if

A privacy or data protection group advising many clients
Firm precedents you want applied consistently
Clients who need documents and trust pages under the firm's brand

Walk through your portfolio with us

Your clients, not a demo practice
What we would automate first, and what stays your judgement
An honest answer when the fit is wrong

Prefer to look first? The read-only demo needs no account at all.

1Leave your work emailOne field. No phone number: we do not need it to prepare for the call.
2Pick a timeWe reply with times within two working days. Thirty minutes is enough.
3Walk through your own clientsWe run the diagnosis on your client list first, so the call is about your portfolio rather than a demo script.

See what changed since your clients' policies were written

Enter up to ten client websites. Free, no sign-up, the first report in about a minute.

Scan your clients' websites or start a free trial →

Client

Progress

Documents

Gaps

Next action

Updated

🇩🇪

Ardent Robotics

GDPR · EU AI Act

70%

—

Continue the interview: 7 answers left

7 days ago

🇮🇪

Bramble Health

GDPR

100%

14 total

Review the subprocessor list

2 days ago

🇮🇪

Idlewood Labs

GDPR

58%

—

Continue the interview: 8 answers left

3 days ago

🇳🇱

Kestrel Logistics

GDPR · NIS2

100%

20 total · 5 out of date

Regenerate 5 documents

5 days ago

🇩🇰

Marrow Data

GDPR

100%

14 total

Review the subprocessor list

13 days ago

🇩🇪

Northwind Analytics

GDPR

100%

14 total · 4 out of date

Regenerate 4 documents

3 days ago

🇩🇪

Oakhill Fintech

GDPR · NIS2 · EU AI Act · DORA

100%

35 total · 3 out of date

Regenerate 3 documents

9 days ago

🇧🇪

Pelham Systems

GDPR · NIS2

100%

20 total

Review the subprocessor list

9 days ago

🇸🇪

Quillon Software

GDPR

100%

14 total · 3 out of date

Regenerate 3 documents

6 days ago

🇫🇷

Sable CommerceWatchlist

No regimes confirmed

—

Start the interview

21 days ago

🇬🇧

Tallow & Finch

UK GDPR

100%

14 total · 3 out of date

Regenerate 3 documents

4 days ago

🇳🇱

Verity Staffing

GDPR

100%

14 total · 4 out of date

Regenerate 4 documents

8 days ago

Question

Answer

Status

Source

Is customer data encrypted at rest?

Yes. All customer data is encrypted at rest.

Confirmed

security_whitepaper#infrastructure

Is data encrypted in transit?

Yes. All traffic uses TLS.

Confirmed

security_whitepaper#practices

Do you enforce multi-factor authentication for staff?

Yes, for all staff accounts.

Confirmed

access_control_policy#authentication

Where is customer data hosted?

In the EU, on Microsoft Azure (Frankfurt).

Confirmed

security_whitepaper#infrastructure

Do you have a documented incident response process?

Yes. A written runbook, tested twice a year.

Confirmed

incident_response_policy#process

How long do you retain customer data after termination?

90 days after the contract ends, then deleted.

Confirmed

retention_schedule#table

Do you use subprocessors?

Yes. The current list is published with our DPA.

Confirmed

subprocessor_list#table

Will you notify us of new subprocessors?

Yes, in advance, as set out in the DPA.

Confirmed

dpa#subprocessors

Who is your privacy contact?

[email protected]

Confirmed

privacy_policy#controller

Do you sign a data processing agreement?

Yes. Our DPA follows Article 28 UK GDPR.

Confirmed

dpa#gdpr_art28

How do you handle data subject requests?

Through a documented procedure with a one-month response target.

Confirmed

dsar_procedure#handling

Is production access restricted?

Yes, to named engineers with just-in-time access.

Confirmed

access_control_policy#production_access

Do you export data on termination?

Yes, on request before deletion.

Confirmed

dpa#termination

Do you process special category data?

No.

Confirmed

privacy_policy#data_collected

Do you process children's data?

No.

Confirmed

privacy_policy#data_collected

Where are your customers located?

The United Kingdom, Germany and the Netherlands.

Confirmed

privacy_policy#controller

Do you perform background checks on employees?

Drafted from general policy wording; please confirm with HR.

Check

—

How often do you review access rights?

Access is reviewed when roles change; the review cadence is not documented.

Check

—

Do you have a business continuity plan?

A plan exists in outline; testing frequency needs confirmation.

Check

—

Do you classify data by sensitivity?

Customer data is treated as confidential; a formal scheme is not documented.

Check

—

Do you have cyber insurance?

Outside the scope of the documents; please confirm.

Check

—

Have you had an independent penetration test in the last 12 months?

Not currently in place. Planned; timing to be confirmed.

Gap

—

Do you hold ISO 27001 certification?

Not currently in place.

Gap

—

Do you run security awareness training for all staff?

Not currently in place. Planned; timing to be confirmed.

Gap

—

Security overview

Overview

Quillon Software runs a multi-tenant service in the EU. Customer data is logically separated per customer and never used to train models.

Infrastructure

Hosted on Microsoft Azure in EU (Frankfurt), with encrypted storage and daily encrypted backups kept for 30 days.

Security practices

Multi-factor authentication for every staff account, named-engineer production access, code review for every change and an incident runbook tested twice a year.

Subprocessors

Subprocessor	Legal entity	Country	Purpose	Transfer mechanism	Data processing agreement
Amazon Web Services	Amazon Web Services EMEA SARL	LU	Amazon Web Services for service delivery	SCC	https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
Intercom	Intercom R&D Unlimited Company	IE	Intercom for service delivery	DPF	https://www.intercom.com/legal/data-processing-agreement
Mixpanel	Mixpanel, Inc.	US	Mixpanel for service delivery	DPF	https://mixpanel.com/legal/dpa/
Sentry	Functional Software, Inc. d/b/a Sentry	US	Sentry for service delivery	DPF	https://sentry.io/legal/dpa/
Stripe	Stripe Payments Europe, Limited	IE	Stripe for service delivery	DPF	https://stripe.com/legal/dpa

Data

Retention

Customer data after the end of the relationship

90 days after the contract ends

Technical logs

30 days

Support conversations

2 years

On termination of the contract

Exported to the customer, then deleted

Privacy documentation your lawyers review, not retype

Associates retyping client facts

Responsibility stays with counsel

Firm precedent, not generic text

See the workspace you'll open on Monday

Clients

Interview · Idlewood Labs

Confirmed answers

Still to ask

Ask the client

Data processing agreement

Parties and roles

Subject matter and duration

Processing on instructions

Security measures

Subprocessors

Enterprise vendor security questionnaire.xlsx

Quillon Software

Security overview

Overview

Infrastructure

Security practices

Data protection measures

Subprocessors

Data retention

Documents

Security documentation and reports

Privacy

Legal

Privacy contact

Vendor changes

Watchlist

A good fit if

Walk through your portfolio with us

See what changed since your clients' policies were written

Privacy documentation your lawyers review, not retype

Associates retyping client facts

Responsibility stays with counsel

Firm precedent, not generic text

See the workspace you'll open on Monday

Clients

Interview · Idlewood Labs

Confirmed answers

Still to ask

Ask the client

Data processing agreement

Parties and roles

Subject matter and duration

Processing on instructions

Security measures

Subprocessors

Enterprise vendor security questionnaire.xlsx

Quillon Software

Security overview

Overview

Infrastructure

Security practices

Data protection measures

Subprocessors

Data retention

Documents

Security documentation and reports

Privacy

Legal

Privacy contact

Vendor changes

Watchlist

A good fit if

Walk through your portfolio with us

See what changed since your clients' policies were written