1. Roles and instructions
The customer is controller/business for customer personal data; Vectiform is processor/service provider and processes data only to provide, secure, support and improve the subscribed service under documented instructions.
2. Confidentiality and security
Access is limited by role and tenant, secrets are managed outside source code, traffic is encrypted in transit, and backups and recovery procedures are maintained. Formal SOC 2 examination is not yet complete.
3. Subprocessors
Vectiform may use the providers listed in the subprocessor register. Vectiform remains responsible for their processing under applicable agreements and announces material changes.
4. Requests, incidents and cooperation
Vectiform assists with reasonable data-subject requests and regulator inquiries. Confirmed personal-data incidents affecting customer data are reported without undue delay with known scope, impact and remediation.
5. Return and deletion
Customers can export data during service. On verified deletion, live data and stored objects are removed and rolling backups expire within 30 days unless law requires retention.
6. International transfers
Where required, the parties will use applicable standard contractual clauses or another lawful transfer mechanism. This template does not alter an executed order form.