Skip to content
SIGNALIGENT
PricingGuidesSign inStart free trial

Data Processing Information

1. Scope

If you upload documents with personal data or monitor sources that contain it, we process that data on your behalf. This section is the data processing agreement under Art. 28 GDPR and the UAE Personal Data Protection Law and forms part of the Terms. You are the controller; we are the processor.

2. Our obligations

  • We process the data only on your documented instructions, which are given by the Agreement and your settings in the service, unless the law requires otherwise; we tell you if we think an instruction breaks the law.
  • Everyone with access to the data is bound to confidentiality.
  • We take the technical and organisational measures listed below and keep them up to date.
  • We help you answer requests from data subjects and meet your obligations on security, breach notification and impact assessments, as far as the nature of the processing allows.
  • We notify you without undue delay, and within 72 hours of becoming aware, of a personal data breach that affects your data.
  • At the end of the Agreement we delete the data, unless the law requires us to keep it. Until then you can export it under Settings.
  • We give you the information needed to show compliance. Further audits are possible after reasonable notice, at your cost, once a year.

3. Technical and organisational measures

  • Tenant separation enforced in the database (row level security), checked on every query.
  • Passwords stored as scrypt hashes; sessions as hashed tokens.
  • Encrypted connections (TLS) between your browser and the service.
  • Outbound fetching blocked from private and internal networks.
  • Documents stored outside the public web root and delivered only through share links you control.
  • Deletion according to plan history periods; access limited to the people who run the service.

4. Sub-processors

Resend (email), Anthropic (only if AI summaries are enabled), Railway (hosting and database). Paddle acts as an independent controller for payments. We announce new sub-processors 30 days ahead by email; if you object for good reason, you may terminate before the change.

Last updated: 16 October 2026.