Data processing agreement

Summary of the DPA · version 2026-10-22

1. Roles

You are the controller of the documents you send. Tablewise is the processor. Where you process personal data, you confirm you have a lawful basis to do so.

2. Scope

Processing is limited to: receiving a document, converting it to Markdown, returning the result. Duration: the seconds a request takes. No storage, no indexing, no training, no human review.

3. Instructions

We process only on your documented instruction (the API call). We do not decide purposes or means. Any change of sub-processor is announced 30 days ahead; you may object and terminate without penalty.

4. Security measures

• TLS 1.2+ in transit; encrypted disks at rest for metadata.
• Documents in an ephemeral directory, deleted after the response.
• API keys hashed; no content in logs; least-privilege containers.
• Access to production limited to the operator, with 2FA.
• Backups of metadata only, never of document content.

5. Sub-processors

6. International transfers

Compute stays in the EU. Where a provider is in the US, transfers rely on the European Commission's Standard Contractual Clauses, with a transfer impact assessment on request.

7. Breach notification

We notify you without undue delay and within 48 hours of becoming aware of a personal data breach affecting your documents, with what we know and the remediation steps.

8. Deletion and return

Documents are deleted after each response; metadata is deleted 30 days after the request. On termination, metadata is deleted within 30 days. Nothing to export: we hold no document content.

9. Audit

Once a year, on 30 days' notice and under confidentiality, you may ask for a written security questionnaire or a remote review. On-site audits are available on Business.

Request the signable PDF: hello@tablewise.dev