Data processing

Last updated 18 September 2026.

This page is a description, not an executed agreement. If you need a signed Data Processing Agreement — and if you are procuring this properly, you do — email prasanna@aruk.ai and we will get one to you. We would rather tell you that plainly than publish a document that reads like a contract and is not one.

What follows is the substance your reviewer will ask about, stated as fact so you can assess us before paperwork starts.

Roles

For the records you upload, you are the controller and we are the processor. They are your company's data; we hold them to run checks you asked for, and for no other purpose. For your own account details — your name, email and optional phone — we are the controller, because that is our relationship with you rather than with your data.

What we process, and why

Categories	Supplier master records and invoice records, in the columns our published template defines. These are commercial records. They are not intended to contain special-category personal data, and we ask you not to send any — a supplier contact name is the most personal thing the template has room for.
Data subjects	Your suppliers and, incidentally, whichever of your staff appear as approvers or requesters in the records you send.
Purpose	Running our detection checks against those records and returning the result to you; and improving the product based on where it falls short on real data, which is the design-partner exchange.
Duration	Until you ask for deletion, or until the demo tenant is shut down.

Sub-processors

Amazon Web Services	Hosting (EC2), the database (RDS PostgreSQL) and outbound email (SES). Region `us-east-1`, United States.

That is the complete list. If we add one, this page changes before it processes anything of yours.

International transfer

Processing happens in the United States. If you are in the EU or the UK that is a transfer, and a full agreement would carry the Standard Contractual Clauses. Raise it with us early rather than late — if your policy requires EU residency we would rather tell you now that we do not offer it yet.

What protects it

Tenant isolation enforced by the database, not only by application code: the tables holding your records carry row-level security policies keyed to your tenant, so another customer's query cannot reach your rows even through a bug in our code.
Encryption in transit; the managed database is encrypted at rest.
Access limited to the three named people who build the product.
An audit trail of changes to your records, which is rather the point of a product like this one.

We are not SOC 2 certified. Type I is in progress. We will not imply otherwise, and we are happy to start on a departmental or P-Card scope while it completes.

Deletion, and proof of it

Email prasanna@aruk.ai. We delete everything you uploaded and write back to confirm it. The written confirmation is deliberate: a deletion you cannot evidence is not one your auditor can accept.

If something goes wrong

We will tell you. With three people and one deployment there is no incident bureaucracy to hide behind, and no useful purpose in delay.