Data processing agreement

When your organization uses Docsheaf, some of the personal data in it belongs to people you’re responsible for — your teammates, and readers of your docs sites. Under data protection laws such as the GDPR, you are the controller of that data and Docsheaf is your processor. Our data processing agreement (DPA) sets out how we handle it. This page summarizes what it commits us to.

What we process for you

• Members’ names, email addresses and profile pictures, and their activity in your organization’s audit log.
• Content your organization writes, including any personal data you put in it.
• Analytics about readers of your docs sites: page views (with a daily-rotating hash, never the raw IP address), searches and page feedback.

What we commit to

• We process this data only to provide Docsheaf, following your instructions as expressed through the product and your agreement with us.
• People who can access it are bound by confidentiality.
• We protect it with the measures described on our security page — hashed passwords, sessions and tokens, encrypted two-factor secrets, role-based access, audit logs and encryption in transit.
• We use only the sub-processors we list, under agreements at least as protective, and tell you before adding new ones.
• We help you answer requests from the people whose data it is — access, correction, export and deletion are available in the product.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• When your organization is deleted, its data is deleted with it, including uploaded files and its audit log. Copies in backups expire on their normal schedule.
• We make the information needed to show compliance available, and answer reasonable security questionnaires.

International transfers

Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, the DPA relies on a recognized transfer mechanism such as the European Commission’s Standard Contractual Clauses.

Signing the DPA

If your organization needs a signed copy, email [email protected] with your organization’s legal name and address, and we’ll send it for signature.