Data Processing Agreement

Last updated: 29 July 2026

When you upload client information into ReguLume, you (the customer) are the data controller and ReguLume, LLC ("ReguLume") is the data processor. This page summarises the terms on which we process that content under Article 28 of the GDPR. A countersigned copy of the full DPA is available on request at info@regulume.com.

Scope and roles

We process customer content only to provide the ReguLume service and only on your documented instructions. We do not use customer content for our own purposes, and we do not use it to train third-party AI models.

Nature of processing

We store, organise, and retrieve the governance documents you upload, run AI-assisted analysis on them (obligation mapping, gap analysis, and the copilot), generate reports, and delete the documents on your instruction or at the end of the engagement.

Security measures

• Per-client logical isolation of customer content.
• Encryption of sensitive fields at rest and TLS in transit.
• Tenant-scoped access controls; no cross-tenant access.
• An append-only audit trail of platform actions.
• Personal data excluded from application logs.

Sub-processors

We use the sub-processors listed at regulume.com/subprocessors and give notice before adding new ones so you can object. Each sub-processor is bound by equivalent data-protection obligations.

International transfers

Customer content is hosted in the EU (Ireland). Where a sub-processor processes data outside the EU, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

Assistance and breach notification

We will assist you, taking into account the nature of processing, with data-subject requests and with your security, DPIA, and consultation obligations. We will notify you without undue delay after becoming aware of a personal-data breach affecting your content.

Return and deletion

On termination you may export your data. We will delete or return customer content within 30 days of termination, except where retention is required by law.

Audit

We will make available the information reasonably necessary to demonstrate compliance with these terms and will accommodate reasonable audit requests, subject to confidentiality.

Contact

To execute the full DPA or ask a question, contact info@regulume.com.