Draft, 14 September 2026. Not yet reviewed by qualified counsel; not to be relied on until it is. Written to the shape of GDPR Article 28 so that a European controller can sign it as is; the Standard Contractual Clauses are not needed while processing stays inside the EU (§8).
Between the Customer (the organisation that owns a workspace; the "Controller") and [legal entity], operating LumenNexus (the "Processor"). Part of the Terms of Service.
The Processor processes personal data contained in the Controller's workspace(s) — data products the Controller loads, documents it indexes, and the governance record around them — for the duration of the workspace and the retention period the Controller sets after it closes.
Hosting, storing, indexing for the workspace's assistant, applying the Controller's quality rules and clearance policy, rendering exports the Controller requests, backing up, and recording every governed action in an audit trail. The Processor acts only on the Controller's documented instructions, which are: these terms, the settings the Controller makes in the workspace, and any written instruction from the workspace owner.
Whatever the Controller loads. The platform requires every product to carry a sensitivity label and a residency, and enforces them; it does not inspect content to discover categories. The Controller is responsible for labelling special-category data as such and for having a lawful basis to process it. Typical subjects: the Controller's customers, employees and suppliers, and the Controller's own members (whose account data is described in the Privacy Notice, where the Processor is controller).
The Processor will:
docs/SOC2-CONTROL-MAPPING.md.The Controller warrants it has a lawful basis for the data it loads, labels it truthfully, sets roles, clearance and residency for its members knowingly, and gives instructions that comply with the law.
The Controller gives general authorisation for the sub-processors listed in SUB-PROCESSORS.md. The Processor will notify the workspace owner at least 14 days before adding or replacing one; the Controller may object in writing within that time, and if the objection cannot be resolved may terminate the affected workspace without penalty. The Processor imposes on each sub-processor obligations no less protective than these and remains liable for their performance.
Once a year, or after a security incident affecting the Controller, the Controller may audit the Processor's compliance: first by reviewing the published control mapping, the platform's ops status, the workspace's own audit trail and posture page; then, if those do not answer, by written questions; and if still unanswered, by an on-site or remote inspection at a mutually agreed time, at the Controller's cost, under confidentiality.
Personal data is stored and processed in the European Union (Hetzner, Germany/Finland). Model inference for the assistant runs either on private infrastructure the Processor operates or on an endpoint the Controller selects; a workspace's no-egress policy refuses any public endpoint. If the Processor ever transfers data outside the EEA it will do so under Chapter V GDPR (adequacy decision or Standard Contractual Clauses) and tell the Controller first.
The Processor will notify the workspace owner without undue delay and within 72 hours of confirming a breach affecting the Controller's data, with what happened, which products and labels are involved, what has been done and what the Controller should do, followed by a written report. The incident procedure is docs/INCIDENT-RESPONSE.md.
On closure of a workspace: no member can open it; its data is retained under the Controller's retention rules and then deleted, with legal holds honoured; backups age out within 14 days of deletion. Erasure of a person pseudonymises them and keeps the events (the audit trail must remain a record); the Processor will explain this to a data subject on request.
As in the Terms of Service, §11.
What follows is what the platform does, each with where the evidence is. The full mapping, including what is not in place, is docs/SOC2-CONTROL-MAPPING.md, and a test in the repository fails if any cited evidence stops existing.
| Measure | How |
|---|---|
| Tenant isolation | Row-level security, forced, on every table holding workspace data; a request with no tenant context reads and writes nothing; the API role cannot bypass it |
| Access within a workspace | Clearance is hierarchical and residency independent, both predicates in the database policy; a column above the reader's clearance is masked |
| Authentication | PBKDF2-SHA256 (600,000 iterations); a second sign-in step by emailed code when mail is connected; ten failures per account in fifteen minutes and the next attempt is refused before any hash is computed |
| Sessions | Opaque token, hashed at rest, HttpOnly/Secure/SameSite, 14 days |
| Joining and leaving | Invites are hashed tokens shown once; an inviter cannot grant more than they hold; removal and closure keep every record; erasure pseudonymises |
| Audit trail | Append-only, hash-chained, verified per tenant; the verifier says what it does not cover |
| Egress | A workspace may refuse any public inference endpoint; alerts name a finding and never carry its content |
| Transport | TLS with automatic certificates and HSTS at the edge; CSP; webhook signatures verified over the raw body |
| Change control | Every change passes the gate (unit tests, four browser suites, provenance scrub, migrations applied twice) and CI before deploy; secrets never pass through CI |
| Backups and recovery | Nightly logical backup, verified readable, mirrored off-host, 14 days; restore rehearsed weekly into a scratch database and compared with production |
| Logging | Every service's log exported nightly and before every deploy; 90 days, off-host |
| Monitoring | Read-only ops status polled by an external monitor that alerts on any transition into warn or critical |
| Not yet in place | Peer review of changes (single operator), a third-party penetration test, encryption at rest beyond the provider's, a full host-rebuild rehearsal |
See SUB-PROCESSORS.md.