Draft. A lawyer has not read this page yet, so it isn't in force. Highlighted passages are gaps for counsel to fill.
Data processing agreement
This agreement applies when files you upload contain personal data. It forms part of the terms of service. You are the controller and [LEGAL ENTITY NAME: placeholder] ("Offpeak") is the processor.
For counsel: the applicable law (GDPR, UK GDPR and others), signature mechanics, and the order of precedence against the terms.
What we process
| Subject matter | Running the models you select over files you upload, and returning the results |
|---|---|
| Duration | Until the files are deleted: 7 days from upload for inputs, 7 days from finishing for outputs. Deletion starts at 7 days and normally finishes within a further day. |
| Nature | Storage, automated decoding and inference, delivery through time-limited links |
| Personal data | Whatever your files contain, such as faces and other images of people, voices and speech, and anything said in a recording |
| Data subjects | Anyone pictured or recorded in your files |
| Special categories | Not intended. Your files might contain them, and you are responsible for that decision |
Our duties
- We process personal data only on your instructions. Submitting a batch is an instruction.
- We bind everyone with access to confidentiality.
- We don't use your files to train models, and we don't read them except where needed to investigate a reported breach of the acceptable use policy or where the law requires it.
- We help you answer data subject requests. Because files are deleted after 7 days, most requests resolve on their own.
- We tell you without undue delay after we become aware of a personal data breach. For counsel: a fixed notice period.
- We give you the information you reasonably need to show compliance. For counsel: audit rights and their limits.
Security
- Files sit in object storage, never in our database, and their object keys are random. The store's index keeps each file's key, size, type and time, and no content and no filename.
- The storage bucket is private. Only the gateway holds its keys, and workers and customers get signed links that expire.
- The upload and download links you receive are signed and last 1 hour. The links our workers receive are signed too, and last as long as a job can, 81 minutes at most.
- Workers accept no host but our storage, and decode each file in an unprivileged child process with no environment.
- Each job gets a fresh temporary directory, deleted afterwards.
- API keys are stored as hashes. Every read is filtered by account, and row level security applies to customer access.
- Logs exclude URLs, filenames, tokens and transcript text.
- Traffic is encrypted in transit. For counsel and the owner: confirm the at-rest encryption statement from each provider.
Subprocessors
You authorise the subprocessors on the subprocessors page. We bind each to duties no weaker than these, and we stay responsible for their work. For counsel: notice of new subprocessors and the right to object.
Transfers
For counsel: the transfer mechanism, such as standard contractual clauses, and the regions in use. The regions aren't fixed yet.
Retention and deletion
A job that runs hourly deletes inputs 7 days after upload and outputs 7 days after they finish. Deletion starts at 7 days and normally finishes within a further day. No personal data from your files is held in our database, and no filenames are stored. Records of finished items hold counts and codes only, and are removed after 90 days.