Data processing agreement

This document summarises the data-processing agreement between a community and Savoir: who does what, for which purposes, with which subprocessors, under what security measures, and what becomes of the data at the end. The agreement in full is had by writing to us.

The roles

The community is the controller of the documents it uploads and of its members' personal information. It decides what is uploaded, who may read it, and how long it needs it.

Savoir is the processor. It handles that information on the community's behalf, on its instructions, and for nothing else. A community's instructions are what it does in the console: uploading a document, inviting a member, granting or withdrawing a right, deleting a document, closing the community.

Savoir remains the controller of its own customer-account information — the name and address of the person who created the community, and what invoicing requires.

The purposes

• Hosting a community's documents and making them readable by its members.
• Answering questions from those documents, naming the document and the section each answer came from.
• Keeping the list of members, their roles and their rights.
• Sending the product's messages: sign-in links, invitations, the weekly digest to the board.
• Keeping the trail of changes made in the console.

Nothing else. A community's documents are not used to train a model, are not shared with another community, and are sold to nobody.

The subprocessors

Four services, and no others: the database, the accounts and the file store; the sending of email; the engine that reads the documents and composes the answers; the platform that deploys the application and receives its crash reports.

The Security page names them one by one, says what each does and where it is, and carries the day a person last verified the list. That list is kept by a person, and the agreement in full names them at length.

The security measures

As the Security page states them:

• everything that travels between a browser, the application and the database goes over HTTPS;
• uploaded files live in a private store and open only through a signed, temporary link made for the person entitled to read them;
• every row and every file carries its community's id, and the database itself refuses any read that would cross that boundary;
• rights are granted key by key to three access groups, and withdrawing them can end open sessions in the same gesture;
• you come in by a link sent to your address; there is no password to steal.

Savoir holds no certification and has been through no external audit. What is written here is what the code does.

If there is a breach

If Savoir finds a breach affecting a community's information, it tells that community's administrator without undue delay, and says what it knows: what happened, when, which data is involved and what has been done. The community remains the one that decides which notices it must itself give to its members and to the authorities.

No figure in hours is promised here. If there is to be one, it will be written into the agreement in full before launch.

Duration and deletion

The agreement lasts as long as the community does.

• A deleted document stops being read and stops being cited from the moment it is deleted.
• A community that leaves downloads its whole archive from the console: the data of every table and the current file of every document, in one file.
• When a community is closed, what it holds is erased thirty days later, files included.
• The retention windows that apply before that — twenty-four months for the questions and for the trail of changes — are in the privacy policy and on the Security page.

Getting the agreement in full

Write through the contact form: the subject and the first sentence are filled in for you, and a person replies with the agreement and the subprocessor list.