Data processing.
Every engagement runs under a signed data processing agreement. This page summarises its custody terms; the signed DPA governs.
Custody
A GDPR Article 28 data processing agreement is executed with every engagement, and an NDA is in place before any data discussion. Receipt of raw data is acknowledged with a SHA-256 manifest. Processing is EU-resident.
Access is single-operator; no subcontractors are engaged without written consent. Every custody event — receipt, processing, delivery, deletion — is recorded in an append-only log, and the full trail is delivered at handover.
Raw inputs are deleted within 30 days of acceptance. Deletion on request completes within 7 working days, with signed attestation. Transparency-log inclusion proofs and signed erasure attestations are in development, available from summer 2026, and will be included in deliverables at no charge.
What Survives Deletion
The deliverable survives: the versioned dataset, the provenance bundle, the evidence pack, the verification recipes, and the dataset documentation. Fingerprints and signatures reference content by hash; they do not contain raw inputs.
The Full Agreement
The full DPA is issued with the engagement scope. Request a copy before scoping: hello@staticsignal.co.uk