Data processing
Last updated
A summary of the data processing agreement. Ask us for the signable version before you send any live document.
Draft. This document has not yet been reviewed by a lawyer. It describes our intended practice honestly, but it is not a substitute for the reviewed version, which will replace it before any paid engagement.
Roles
For shipment documents you send us, you are the controller and EntryWrite is the processor. We process that data only on your documented instructions, which in practice means: to extract, reconcile, validate and map it, and to return it to you.
Scope of processing
Categories of data: commercial and logistics data from shipment documents, which may include the names and contact details of staff at your company, your customer, the shipper and the consignee. Duration: for the length of the engagement, plus the retention window you set.
Security measures
TLS in transit, AES-256 at rest, role-based access control, least-privilege access for anyone operating the service, and an immutable audit log of access and field-level changes. The audit log is also what makes an entry defensible in a CF-28 or post-entry review.
No training on your data
Your documents and the data extracted from them are not used to train or fine-tune any model, and are not pooled with another customer's data. Where a third-party model provider is involved in processing, we contract for the same restriction.
Sub-processors
The current sub-processor list - covering hosting, email delivery and document processing - is provided with the signable DPA. We notify you before adding or replacing one, and you may object.
Retention and deletion
You set the retention window. Source documents can be purged as soon as an entry is exported. On termination we delete or return all personal data, at your choice, within 30 days.
Breach notification
We notify you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting your data, with what we know at the time.
Audit
You may request the information needed to demonstrate our compliance with these obligations, including answers to a security questionnaire. We are not currently SOC 2 certified, and we say so in the FAQ rather than leaving you to discover it.
Request the signed version
Email ariel@entrywrite.com. It is not gated behind a contract or a sales call.