Data processing agreement

1. Overview

When you use a Verain product (such as Verain Finance) to process personal data, Verain acts as a processor on your behalf under Article 28 of the GDPR. Our DPA sets out how we process that data, the safeguards we apply, and your rights as the controller.

This is distinct from the Privacy Policy, which covers personal data we process as a controller for our own website and contacts.

2. Roles and responsibilities

You (the customer) are the controller: you determine the purposes and means of processing the personal data you bring into the product. Verain B.V. is the processor: we process that data only on your documented instructions and to provide the product to you.

3. Scope of processing

• Subject matter and duration: processing necessary to provide the product, for the term of your agreement.
• Nature and purpose: hosting, organising, analysing, and returning the data you connect, so the product can do its work (for example, answering questions about your financial data).
• Types of personal data: the categories you choose to connect. For Verain Finance this is typically business and financial records that may contain personal data (for example, names in ledgers, contacts, or approvers), plus the account details of your users.
• Data subjects: your authorised users, and any individuals whose personal data appears in the material you connect.

4. Our obligations as processor

• Documented instructions: we process personal data only on your instructions and for no other purpose. We never sell it, and we never use your data to train public or shared AI models.
• Confidentiality: personnel with access are bound by confidentiality obligations.
• Security: we apply appropriate technical and organisational measures, including encryption in transit, encryption of stored credentials, encrypted backups, tenant-isolated ledger storage, role-based access controls and an append-only audit log. Customer data is not shared across customers. See our security page for detail.
• Breach notification: we notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
• Deletion or return: at the end of the agreement we delete or return your personal data at your choice, subject to any legal retention requirements.
• Unlawful instructions: we will inform you if, in our view, an instruction infringes the GDPR or other data-protection law.

5. Sub-processors

You give general written authorisation for Verain to use sub-processors. We give prior notice of any intended addition or replacement so you may object on reasonable data-protection grounds; if an objection cannot be resolved, you may terminate the affected service. The exact set depends on the deployment you choose:

• Hosting (production): Netcup GmbH, Germany. Runs the Verain service and stores your data.
• Hosting (development and staging): Contabo GmbH, Germany.
• Backups: Hetzner Online GmbH, Germany. Encrypted backups.
• Error monitoring: Sentry, EU region, with personal data masked.
• Email delivery: SMTP2Go, for email the service sends.
• Model provider: Anthropic (United States) is the default for the hosted service. OpenAI or Google (Gemini) act as sub-processors only where configured for your deployment. Routes that keep inference in the EU (AWS Bedrock in Frankfurt, Google Vertex in the EU, Mistral) or use Azure OpenAI run under your own cloud account. With a self-hosted model, no third-party model provider is involved.

What reaches a hosted model provider is limited by design: reporting aggregates, account mapping labels, the questions users type in chat and the chat’s memory of the conversation, and booking lines limited to what a question needs, never bulk exports of your ledger. Which model provider is used is a choice per customer, confirmed in your DPA. Verain itself never trains models on your data. With a self-hosted model, no model-provider sub-processor is involved at all.

6. International transfers

Verain-hosted infrastructure, including storage and backups, runs in Germany. Where processing involves a provider outside the European Economic Area (for example the default model provider, Anthropic, in the United States), such transfers are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, with supplementary measures as appropriate. Choosing an EU model route or a self-hosted model avoids such transfers for inference.

7. Data-subject requests and assistance

We assist you, taking into account the nature of the processing, in responding to data-subject requests (access, rectification, erasure, and the rest), and in meeting your obligations around security, breach notification, and data protection impact assessments (DPIAs).

8. Audits

We make available the information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and subject to confidentiality.

9. Putting the DPA in place

The DPA is included with your service agreement. If you need it in advance, for your procurement or legal review, request the current version at [email protected] and we will provide it.

10. Contact