Data Processing Agreement: Change History

The current version is the Data Processing Agreement. These are the changes made before the latest update.

What changed on 4 November 2026

• Section 5.1: the Twilio SendGrid entry now says that email is sent from an EU regional account, with data stored and processed in the EU. We now give the transfer basis for the fonts, icons and script library that application pages load: Font Awesome (EU-US Data Privacy Framework) and jsDelivr (UK adequacy decision, with the content delivery providers it uses). We no longer plan to host these files ourselves.
• Section 4: at the end of the service we delete or return your personal data at your choice, unless Union or Member State law requires us to keep it.
• Section 5.2: we also give 30 days’ notice before replacing a sub-processor, not only before adding one.
• Section 9: the Google reCAPTCHA wording now also covers the forms on our website.

What changed on 2 November 2026

• Section 5.1: the Microsoft Entra External ID and Twilio SendGrid entries now say that their terms allow limited transfers outside the EEA (security and fraud signals, vendor support), and the Google reCAPTCHA entry now says that it loads on application pages.
• Section 6: we corrected the sign-in description (Google account or one-time email code; a one-time email code is a single factor), and described how documents are separated between tenants and where database backups are held.
• Section 9: we said that case content stays in the EEA and named the services that may transfer limited data outside it.

What changed on 30 October 2026

• Section 1: we added our company registration number (CRO No. 579894).
• Section 3.3: we added user account data and audit trail data to the categories of personal data, and noted that uploaded documents may contain special category data.
• Section 4: we added that your instructions cover transfers to third countries, that we process data otherwise only where EU or Member State law requires it (and tell you first, unless that law forbids it), that we immediately tell you if an instruction infringes data protection law, and that our assistance covers prior consultation with the supervisory authority (Article 36).
• Section 5.1: we added Microsoft Defender for Cloud, said that Stripe.js loads in the browser on application pages, including the public request portal, and listed the fonts, icons and script library that application pages load from third-party servers, with their transfer basis. The Entra External ID entry now gives its location as the EEA (Microsoft-managed tenant data location) instead of naming one Azure region.
• Section 5.1.1: we renamed it “Development Tools” and said that the AI coding assistant does not process customer personal data.
• Section 5.2: we said how we notify you of a new sub-processor and what happens if you object.
• Section 5.3: we added that sub-processors are bound by the same data protection obligations as this DPA and that we remain fully liable to you for them.
• Section 9.1: we added the EU-US Data Privacy Framework, which section 9 already relies on.
• Section 10: we added automatic cancellation after 30 days of non-payment, the reminder 10 days before deletion, immediate deletion when the last admin deletes the account, how long backup copies last, and how we keep audit logs: in pseudonymised form, with a retention period of 7 years by default (on request, 3 to 10 years, which applies to entries written after the change), as an independent controller for our own service records and legal claims, which you authorise by accepting this DPA.
• Section 11: we added that we allow for and contribute to audits, including inspections, by you or an auditor you mandate.

What changed on 14 October 2026

• Section 5.1.1: we removed Anthropic, Inc. (via Microsoft Azure AI Foundry). We used this Claude deployment to help with production settings and Azure configuration issues. We had listed it as an EU-resident service, but on 8 October 2026 we found that its deployments were Global deployments, so processing was not limited to the EEA. To avoid any risk of a data leak, we stopped using it and deleted its Claude deployments on 13 October 2026. We do not use any AI assistant on customer production data.
• Section 5.1: the Microsoft Azure entry now lists the Azure services that process your data and the second copy of documents in North Europe (Ireland). The Stripe entry now says that Stripe may process billing data in the United States. The Azure OpenAI, Document Intelligence and AI Language entries now say what each service keeps.
• Section 6: we removed wording that overstated our release process, and described the checks we run. We also corrected the wording on sign-in, tenant isolation, logging and backups.
• Section 9: we replaced the reference to Microsoft’s EU Data Boundary with the Azure regions we use.
• Section 11: we listed the reports we can give you.

Questions: dpo@sarportal.com.