Legal
Data Processing
How IDOP LABS processes personal data on behalf of organisations, the sub-processors involved, and how to request a data processing agreement.
Last updated:
Working draft. This text describes how the service works today. Before paid services begin it will be reviewed and completed with the operator’s registration details. Questions: legal@idoplabs.com
When an organisation uses IDOP Cloud and its members store personal data in their files, IDOP LABS may act as a processor on the organisation's behalf under the EU General Data Protection Regulation (Article 28). This page describes how we process such data and how to obtain a data processing agreement (DPA).
What we process, and how
- Content of files. We store and transmit the files you upload, and serve them to you and to the people you share them with. We do not read, parse or analyse file contents on our servers, except when an AI assistant you connected asks to read or change a document — then only that document, with your own access.
- Account data. Email address, display name, optional profile picture, folders, share links and settings, as described in the Privacy Policy.
- Purpose limitation. We process this data only to provide the service. We do not use it for advertising or to train models.
Security measures
- Row-level security enforced by the database for every request.
- Passwords handled by a dedicated authentication service; never stored or seen by us.
- Encryption in transit (TLS) for all traffic; providers encrypt stored data at rest.
- File contents are never directly addressable; every read goes through the service.
- Share-link passwords stored only as one-way hashes, with lock-outs after repeated failures.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Accounts, authentication, database | EU (Ireland) |
| Cloudflare, Inc. | Hosting, file storage, network protection | Global network |
| Resend (Plus Five Five, Inc.) | Account emails | EU (Ireland) |
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We will announce changes to this list in advance.
Requesting a DPA
A standard data processing agreement for organisations is in preparation and will be offered with team plans. If your organisation needs one now, write to legal@idoplabs.com.