Legal
Data Processing Agreement
For business customers who process personal data in PDFTrusted documents and need a GDPR Article 28 agreement with us as processor.
Last updated: October 19, 2026
1. Who processes what
You are the controller: you decide which documents go into the product and what they contain.
We are the processor: we process the document only to perform the job you asked for, and only for as long as that job needs it.
Processor entity: PDFTrusted (the operating entity is named on the signed agreement and in the Imprint)
2. What the signed agreement contains
- Processing only on your documented instructions, and confidentiality obligations.
- Technical and organisational measures: encryption in transit, least-privilege access to storage, automatic deletion, and per-job isolation.
- Sub-processor terms: the list below, advance notice of a new one, and a right to object.
- Assistance with your own data-subject requests, DPIAs and breach notification.
- Deletion or return of data at the end of the engagement.
- Audit rights, and which certifications or reports we can share.
3. Sub-processors
Every entry below is a service the product actually calls. If we add one that can receive personal data, this table changes before it goes live.
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Accounts, sign-in sessions and the application database | Email address, account identifiers, subscription state, usage counters |
| Cloudflare | Object storage (R2), inbound email routing, bot protection (Turnstile) | Temporary job files, shared/embedded documents, inbound support mail, bot-check tokens |
| Vercel | Hosting and serving the web application | Request metadata (IP, user agent) in edge and server logs |
| Railway | Conversion worker for Office, OCR, translation and other server-side jobs | The document being converted for the duration of the job |
| Lemon Squeezy | Checkout, subscription billing, invoices and tax handling | Name, email, billing address, tax identifiers, payment metadata (card data never reaches us) |
| Resend | Transactional email: sign-in codes, receipts, billing notices | Recipient email address and the message content |
| PostHog | Cookieless product and traffic analytics | Aggregate page and tool events, no document content |
| Sentry | Error monitoring so a failing job is visible to us | Error stack traces and request context; documents are not attached |
| Upstash | Rate limiting, quota counters and job locks | Hashed or opaque counters with short retention |
| Adobe | OCR and PDF conversion services for the tools that need them | The document being processed, for the duration of the job |
| OpenRouter | AI features: summarising, chatting with a document, question generation | Extracted text of the document you ask about, within the limits the tool states |
| Sign in with Google, and Drive import/export when you connect a Drive account | Account identity for sign-in; the files you explicitly choose in the Drive picker | |
| Sign in with Facebook, when you choose it | Account identity (email, name, profile identifier); nothing is posted to your account | |
| Dropbox | Dropbox import/export when you connect a Dropbox account | The files you explicitly choose in the Dropbox chooser or save dialog |
Hosting and storage regions are confirmed per project on request rather than listed here, so this page cannot drift out of date.
4. Retention
Temporary conversion artifacts are deleted within one hour, and the sweep that does it runs both on a schedule and after uploads. Files you deliberately save to PDFTrusted Storage stay while Pro is active, then for a 14-day grace period.
Shared links expire on the period you chose, and revoking one removes the stored file with it.
5. How to get it signed
Email support@pdftrusted.com with the subject “DPA request” and the legal name of your organisation. We reply with the agreement for signature, and with the current security documentation for your records.
If you need our sub-processor list as an attachment, or a specific region in writing, ask in the same message — those are answered per customer rather than promised generically here.