Data-processing terms should match the actual service.

1. Current DPA status

Civerent does not currently present this page as an executable Data Processing Addendum. A customer requiring a DPA should request legal and procurement review before submitting regulated or contract-restricted personal information.

Any final DPA must identify the contracting parties, processing details, applicable law, transfer mechanism, security terms, audit rights, deletion obligations, and authorized signatures. Only a mutually executed document creates those customer-specific commitments.

2. Processing roles

Civerent may act as a business or controller for account administration, website operations, security, billing administration, and direct business communications. Civerent may act as a service provider or processor when handling customer content on behalf of an organization using the platform.

The applicable role depends on the information, purpose, customer instructions, and governing law. Customers remain responsible for having authority and a lawful basis to submit and instruct processing of customer content.

3. Customer instructions and use

• Civerent processes customer content to provide, secure, maintain, support, and improve contracted service functions.
• Customers control what governance records, evidence, users, and organizational information they submit, subject to applicable product functionality and agreements.
• Customers must not submit classified information, complete payment-card data, credentials, or specially regulated information unless Civerent has expressly confirmed the applicable environment and terms in writing.
• A lawful instruction does not require Civerent to provide a capability, location, certification, or contractual commitment that has not been agreed in writing.

4. Subprocessors and transfers

Civerent uses core providers for hosting, database and authentication services, payment processing, and communications. The current provider list and purposes are published on the Subprocessors page.

Information may be processed in the United States and other locations where Civerent's providers operate. Required transfer mechanisms, residency restrictions, and change-notice rights must be confirmed in an applicable signed agreement.

5. Security and incident handling

Civerent uses the access, tenant-isolation, database, evidence-integrity, secure-development, and incident-handling measures described in its Security and Trust Center materials.

No public page creates a customer-specific breach-notification deadline, audit right, recovery objective, or service level. Those commitments require a signed agreement where applicable.

6. Individual rights and deletion requests

When Civerent processes customer content solely for a customer, the customer ordinarily determines how an individual request should be handled. Civerent may direct the requester to that customer and provide reasonable product or operational assistance under applicable terms.

Identity, authority, scope, legal exceptions, account security, and retention requirements may need to be verified before information is accessed, corrected, exported, or deleted.