How customer data is processed

Business customers normally control personal data they submit to workspaces; CompliClear processes that content to provide requested assessment, generation, evidence, storage, and collaboration functions. CompliClear separately controls account administration, direct billing records, service security, support, and its own legal evidence.

Documented instructions are the order, configured feature choices, authorized user actions, these published terms, and any signed order form. CompliClear will notify the customer if an instruction appears unlawful unless prohibited from doing so. Requests involving customer-controlled data are routed to the customer rather than answered outside its authority.

1. Clerk authenticates a verified account and workspace access is company-scoped.
2. Inputs and evidence are saved to the configured database or private object store.
3. When an authorized user requests AI generation, only relevant prompt context is sent to a configured AI provider.
4. Outputs, versions, notes, consents, and audit events are stored for review.
5. Exports and evidence downloads are authorized through the workspace rather than exposed as new public links.
6. Verified deletion removes active records and linked objects subject to customer instruction, backup cycles, legal holds, and applicable retention law.

The Data Processing Addendum contains Article 28-style processing terms, subject matter, data categories, security annex, subprocessor authorization, assistance, deletion/return, and transfer clauses. Enterprise customers needing signatures, customized instructions, SCC module selection, or audit evidence should contact founder@compliclear.com before uploading regulated personal data.

See the current provider register. Deployment region and transfer mechanism depend on the selected vendor account and contract. Where an EU restricted transfer occurs without adequacy, the parties must use the correct transfer tool and conduct the required transfer-risk review; publication of this page alone is not an executed SCC or TIA.

CompliClear uses authenticated access, private object references, transport encryption, audit events, and environment-managed secrets. Customers must avoid prohibited sensitive uploads and apply least privilege. Deletion of an account involving billing, legal holds, customer-controller instructions, provider records, or backups is verified and coordinated; it is not an unauthenticated one-click action.