Data Processing Agreement
Version 4, approved 1 Nov 2026
This agreement covers personal information that Bluetrino SA PTY Ltd (the operator, "we") processes for the Customer (the responsible party) when providing ComplianceThing. It forms part of the Terms of Service and follows sections 20 and 21 of POPIA.
1. Scope
We process Customer Content only to provide, secure and support the service. Customer Content includes personal information in documents, assessments, chat history and signatory records. The data subjects are the Customer's employees, officers, contractors and anyone named in its documents.
2. Instructions
We process personal information only on the Customer's documented instructions. These terms and the Customer's use of the service are those instructions. We tell the Customer if we believe an instruction breaks POPIA.
3. Confidentiality
Our staff and contractors who can access Customer Content are bound by confidentiality. They access it only to provide support the Customer asks for, or to keep the service secure.
4. Security safeguards (section 19)
- Every user has an authenticator-based second step. Changing a password signs out the user's other sessions.
- Database policies isolate each organization's data. Access follows the roles the Customer assigns, and role changes take effect immediately.
- An append-only audit log records membership, role and security changes.
- Data is encrypted in transit and at rest.
- Production keys are kept to named operators.
5. Sub-processors
The Customer authorises the sub-processors below. We will give 30 days' notice of a new one, and the Customer may object on reasonable grounds. Each sub-processor is bound by written terms at least as protective as this agreement.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account data and Customer Content | Ireland (AWS eu-west-1) |
| Vercel | Hosting the web application | Data in transit while requests are served | Ireland (functions in Dublin); requests enter at the nearest edge, Cape Town for South African users |
| OpenAI | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR) | Document text and questions sent to the model; document files or images submitted for OCR | United States |
| Anthropic | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR), depending on the feature and provider selected | Document text and questions sent to the model; document files or images submitted for OCR | United States |
| Mistral AI | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR), depending on the feature and provider selected | Document text and questions sent to the model; document files or images submitted for OCR | European Union |
| Sentry | Error monitoring | Error reports: stack traces, page addresses and browser details. User details, request bodies and AI inputs and outputs are switched off | United States |
| Resend | Sending email | Name, email address, message content | Ireland (eu-west-1) |
| Cloudflare (Turnstile) | Bot protection at sign-in | IP address, browser signals | Global network |
| Optional sign-in | Name, email address | Global |
6. Transfers outside South Africa (section 72)
Customer Content is stored and processed in Ireland, where the GDPR applies. It leaves for the United States in two places: document text and questions sent to OpenAI, and error reports sent to Sentry. OpenAI may not use Customer Content to train its models and does not keep our responses; its abuse-monitoring logs are kept for up to 30 days. Each of these providers is bound by a data processing agreement that protects personal information in a way substantially similar to POPIA.
7. Security compromises (section 22)
We notify the Customer without undue delay, within 72 hours of becoming aware of a compromise. The notice includes what we know and the steps taken. We help the Customer notify the Information Regulator and data subjects.
8. Data subject requests
We pass any request about Customer Content to the Customer and help it respond. Customers can already view, correct and export most of this data in the service.
9. Return and deletion
The Customer exports its documents before the agreement ends. Once the closure is confirmed, we delete Customer Content straight away, including from sub-processors. Backups follow their normal expiry cycle. Data the law requires us to keep is kept only for that purpose.
10. Audits
We give the Customer the information it reasonably needs to show compliance with this agreement. That includes this agreement, our sub-processors' certifications and answers to security questionnaires, no more than once a year.