Data processing agreement

This agreement is between your firm (“you”) and company name to be confirmed, a company registered in England and Wales with company number number to be confirmed, whose registered office is at address to be confirmed (“we” or “us”), and forms part of the terms of service.

For personal data in your assessments, you are the controller and we are your processor. If you are yourself acting as a processor for your customer, we are your sub-processor, and you confirm your customer has authorised that. Words such as “personal data”, “processing” and “personal data breach” have the meanings in the UK GDPR.

• Purpose and nature: storing and evaluating collector files, and producing findings, roadmaps, use-case assessments, blueprints and reports for you, as the terms describe.
• Duration: while your account is open, plus the deletion period in section 9.
• Personal data: the collector reads configuration settings and totals of AI usage and spend (calls, tokens and amounts per model or service, never who made the calls), not business data, but settings can identify people. For example: IAM user and role names, access key ages, Microsoft Entra object IDs and application names, policy and resource names that include a person’s name, and account aliases. Also the customer contact email addresses your firm sends collector instructions to, and any names, notes and use cases your firm enters about its customers, and the reports produced from them.
• Data subjects: your customers’ employees and contractors, and any other people named in what you upload or enter.
• Special category data: none is expected, and you agree not to upload it.

The collector’s documentation lists every setting it reads and every field it keeps. Its optional redaction setting replaces resource names with short codes before the file leaves your customer’s environment.

We process the personal data only on your documented instructions. These terms, this agreement and your use of Flightglass’s features are your instructions. If we’re required by law to process it in another way, we’ll tell you first unless the law forbids it. We’ll tell you if we think an instruction breaks data protection law.

Everyone at Flightglass who can access the personal data is bound by confidentiality, and accesses it only to provide, support or secure the service.

We protect the personal data with appropriate technical and organisational measures:

• Data is stored in the United Kingdom (AWS London region) and encrypted in transit (TLS) and at rest.
• Each firm’s data is isolated by database row-level security, tested automatically on every change against two firms, so one firm can’t read, change or link to another’s data.
• Files are kept in private storage and opened only through short-lived signed links.
• Sign-in uses one-time email links; no passwords are stored. Customer upload links are secret, expire after 14 days, can be withdrawn, and are stored only as a hash.
• Uploads, exports, approvals, deletions and invitations are recorded in an audit log that users can’t edit.
• Collector files are deleted automatically 90 days after upload. Server keys are kept only in server settings, never in the browser.
• The collector is read-only and open source, and never receives or stores cloud credentials.

You authorise us to use the sub-processors below. We have a written contract with each that protects the data at least as well as this agreement, and we remain responsible to you for them.

AI drafting sends Anthropic only the evaluated findings and use-case entries, never the uploaded file, and Anthropic doesn’t use them to train its models under its commercial terms.

We’ll tell your firm’s admins by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can’t address the objection, you may close your account and we’ll refund any prepaid subscription for the remaining period.

We store the personal data in the UK. Where a sub-processor processes it outside the UK, the transfer is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.

• Requests from individuals: if someone asks us directly about their data in your assessments, we’ll pass the request to you without responding ourselves, and help you answer it. You can also find, correct and delete data yourself in Flightglass.
• Personal data breaches: we’ll tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with what we know and what we’re doing. We’ll update you as we learn more.
• Impact assessments: we’ll give you reasonable help with data protection impact assessments and consultations with the ICO about Flightglass.

You can delete any assessment at any time, which deletes its files, results and reports immediately. When your account closes, we delete all remaining personal data in your assessments within 30 days, unless the law requires us to keep it. Export any reports you want to keep before you close the account.

We’ll give you the information you reasonably need to show compliance with this agreement, including our security documentation and, once completed, a summary of our independent security test. If that isn’t enough, you or an independent auditor bound by confidentiality may audit our compliance once a year (or after a breach), with at least 30 days’ notice, at your cost, in a way that doesn’t put other firms’ data at risk.

The liability terms in the terms of service apply to this agreement. If this agreement and the terms of service conflict about personal data, this agreement wins.

Data protection questions: contact email to be confirmed.