For each engagement, we agree which data an application uses, where it is stored, who can access it and what happens if there is an incident. These are our principles. Your agreements sit in the data processing agreement and pilot plan.
Your organisation is the controller. Where Upsider processes personal data on your behalf, we act as the processor. For each engagement, we identify the data needed and apply data minimisation: we use it only for the agreed purpose. This is not legal advice.
Where needed, we put a data processing agreement in place before work starts. It records the purpose, the data involved, the retention period, sub-processors, security measures and how incidents are reported. You can request it in advance.
We prefer storage within the EU, and we work with our fixed team of developers in the EU. For each engagement, we agree where data is stored, what logging is needed and how backups are handled.
Customer data is not used to train AI models. Customer data goes to an AI system only as agreed. We use business-grade AI services from established providers, aligned with your policy.
We choose business-grade services with contractual terms on data use. We agree which service fits each application and class of data. You can rule out services. Where agreed, your staff check the outputs before they are used.
Access to your systems is through named accounts and limited by role. We log access and revoke it when the engagement ends. If an incident occurs, we report it as set out in the data processing agreement and within the applicable GDPR time limits, so you can meet your own responsibilities.
On request, we can send you the data processing agreement, the sub-processor list and a short description of our security measures. Email us using the address in the footer.
Data and security
On request, we can send you the data processing agreement, the sub-processor list and a short description of our security measures. Email us using the address in the footer.