SaaS Data Handling Statement

This page explains how data flows through Resilience Fabric. It is a transparency document; the binding terms are in the Data Processing Addendum and the master subscription agreement.

• Customer Content — data the customer uploads, integrates or generates inside the platform (framework mappings, evidence, policy texts, logs of approvals).
• Tenant Metadata — account ID, plan, regions enabled, sub-processor elections.
• Service Telemetry — operational service data (request traces, error rates, latency).
• Support Data — content a customer provides to TruSecure support channels.

1. Customer → Resilience Fabric via TLS-protected API or UI.
2. Resilience Fabric stores Customer Content in the EEA region of OVH HOSTING LIMITED — French and German datacenters.
3. AI tasks run on private inference infrastructure operated by TruSecure inside the EEA.
4. Customer Content is not used to train any model.
5. Outputs are stored alongside Customer Content in the tenant.
6. Customer Content is deleted on termination per the DPA.

OVH is engaged under a written agreement consistent with GDPR Art. 28 and the equivalent UK GDPR Art. 28. The Sub-processor List contains the current entry.

• In transit: TLS 1.3 (TLS 1.2 where required).
• At rest: AES-256 with keys held in an external key-management service.
• Per-tenant cryptographic isolation where supported.

OVH HOSTING LIMITED is an Irish-incorporated subsidiary of OVH Groupe SA, a French société anonyme. The sub-processor is established in the European Union and is not subject to U.S. jurisdiction by reason of its corporate structure. TruSecure has assessed the legal regime applicable to the sub-processor and considers that customer data held in OVH's French and German datacenters is not subject to extraterritorial U.S. legal access on the basis of the sub-processor's corporate structure. The transfer impact assessment is available on request. TruSecure does not represent that extraterritorial-access risk is zero; it represents that, on the documents reviewed, the risk is materially mitigated.

• TruSecure engineers may access Customer Content only to respond to a customer-initiated support ticket, to respond to a confirmed security incident, or as required by binding law.
• Each access is logged and made available to the customer.
• Confidentiality undertakings bind all TruSecure personnel with access.

• Within EU/EEA: no transfer mechanism required.
• From Romania to the United Kingdom, or from Romania to the United Kingdom via TruSecure's UK entity: covered by EU Commission Implementing Decision (EU) 2021/1772 (EU-UK adequacy), renewed on the applicable date.

The customer may, via the DPA and through the platform:

• export Customer Content in a machine-readable format at any time;
• request deletion at termination;
• subscribe to sub-processor change notifications;
• request a copy of access logs in respect of a specific event.

This page is a summary. In any conflict between this page and the DPA, the DPA prevails.