On client projects we act as your processor under a Data Processing Agreement (Art. 28 GDPR), signed with the MSA. We use carefully selected service providers bound by data processing terms. Clients can request our current list of sub-processors. We notify you of a personal-data breach without undue delay. Our SOC 2 readiness programme is in progress.
Key points
- Evaluator data and any task data passing through our platform is processed and stored on EU-based infrastructure.
- Any transfer outside the EEA needs your written approval and runs under the EU Standard Contractual Clauses. The UK and Switzerland are covered by EU adequacy decisions.
- Before any access to project data, evaluators sign an Evaluator Agreement, a CIIAA (confidentiality, and assignment of all work product to Sovrano AI) and an NDA, plus any addendum you require.
- We log who opened each item, when, and what they submitted. We keep the log for the life of the project, and you can export it per project.
- Retention follows your policy, and a Data Processing Addendum agreed with you takes priority. By default we delete your task data within 90 days of project end, including evaluator working copies, and send you a written deletion confirmation.
Evaluator identity
Every evaluator passes government-ID verification before live work, and we check their degree or enrolment with a verification provider. We check professional experience against their degree certificate and professional register. You can request an anonymised credential summary for every evaluator on your project.