Data Processing Agreement

If your organisation needs a DPA (GDPR Art. 28, UK GDPR, or equivalent) to use ScientistWorkbench, we sign one. Our standard DPA incorporates the EU Standard Contractual Clauses where applicable and lists our model-hosting and sandbox-compute provider (USA), Fly.io (application hosting and database, USA), Tigris Data (object storage, USA), Stripe (payments) and Resend (transactional email) as sub-processors.

Requests go to ops@scientistworkbench.com with your organisation name, the email on the account, and your jurisdiction. We reply with the document for signature within five business days.

What we can say today

• We process the prompts and files you submit solely to run the job you asked for and to return its outputs to you.
• Inputs are uploaded to the sandbox provider, mounted read-only into a per-job sandbox, and the upload is deleted after mounting. Outputs are stored under per-tenant keys and deleted per the retention policy (90 days for artifacts; the result document is kept while the account exists, or until you ask us to delete it).
• Prompts and outputs are processed by our model and sandbox provider under commercial terms; they are not used to train models.
• Do not submit personal data that you are not entitled to process, and do not submit secrets. Pseudonymise where you can.

This page is informational and is not itself a contract. See also the privacy policy and the terms of service.