Data processing agreement

Summia processes personal data on behalf of the customer, solely for the purpose of providing the Summia service to the customer. This agreement sets out the conditions of that processing.

This agreement applies for as long as the service is used. It ends when that use ends, subject to the obligations that survive it: deletion of the data (Article 9 of this agreement) and confidentiality.

Summia processes the data only on documented instructions from the customer. The use of the service, its settings, and this agreement constitute those instructions. If Summia considers that an instruction infringes the GDPR, it informs the customer.

The customer’s data is never used to train an artificial intelligence model, either by Summia or by its subprocessors.

Persons authorized to access the data have committed themselves to confidentiality. Their access is limited to what their duties require.

Summia implements technical and organizational measures appropriate to the risk, in accordance with Article 32 of the GDPR. These measures are described in Annex 1 and may change, provided that the level of protection is never reduced.

The customer authorizes Summia to engage the subprocessors on the list published on the Subprocessors page.

• Summia informs the customer of any addition or replacement at least 30 days in advance.
• The customer may object on legitimate grounds relating to data protection. If no agreement is reached, the customer may stop using the service.
• Summia imposes on each subprocessor obligations at least equivalent to those of this agreement, and remains liable to the customer for the performance of those obligations.

Summia assists the customer, insofar as possible:

• in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction of processing, data portability, objection);
• in carrying out, where applicable, a data protection impact assessment; and
• in consulting the supervisory authority where necessary.

In the event of a personal data breach, Summia notifies the customer without undue delay after becoming aware of it. The notification describes the nature of the breach, its likely consequences, and the measures taken or proposed.

When use of the service ends:

• Summia deletes the customer’s data within 30 days;
• copies held in backups are removed no later than 30 days after that, as the backups are rotated; and
• before the deletion, the customer may request to retrieve its data.

Data is kept beyond that only where required by law.

The data is hosted in France. When a subprocessor processes data outside the European Union, the transfer is governed by an adequacy decision of the European Commission or by the Commission’s standard contractual clauses. The list of subprocessors states the place of processing for each one.

Summia makes available to the customer the information necessary to demonstrate compliance with this agreement. The customer may have an audit carried out, at its own expense, no more than once a year and with 30 days’ notice, by an auditor bound by confidentiality. The audit must not compromise the security or confidentiality of other customers’ data.

This agreement is governed by French law. It follows the liability and jurisdiction rules set out in the Terms.

Hosting

• Data is hosted in the Paris region by Scaleway, a French hosting provider certified to ISO 27001.

Isolation

• Each account is isolated within the database itself.
• Access is granted only through explicit sharing, checked on every request.
• When in doubt, access is denied.

Artificial intelligence

• To build or change a table, AI models receive the request, the structure of the document, and a few sample values per column.
• To answer a question, they also receive the row labels and a limited number of results that have already been calculated.
• Finally, they receive the images and PDFs attached to a request, as well as dictation recordings.
• No data is used for training.

Encryption

• Communications are encrypted in transit.
• Backups are encrypted.

Authentication

• Sign-in by password, one-time code, or identity provider (Google, Microsoft).
• Codes are time-limited and stored in hashed form.
• Changing a password ends all open sessions.

Traceability

• Every change to a document is timestamped and kept in a history that cannot be rewritten.
• All sharing is logged.

Secure development

• The code is regularly audited against demanding security rules.
• Every change passes a suite of automated tests before going live.

Internal access

• Access to production systems is restricted to the people who need it.

The current list is published on the Subprocessors page.