Data Processing Agreement (DPA)
What is ComplianceForge?
ComplianceForge (complianceforge.app) is a Compliance-as-a-Service software product: an assistive software service that produces data-based material for companies and their experts — readiness checks, prioritized gap lists, document templates and recommendations. complianceforge.app by UGS Ltd — independent from US static template vendors. It is not an audit and not legal advice.
1. Parties and roles
This Data Processing Agreement forms part of the agreement between the customer (Controller) and Universal Global Services Ltd (UGS Ltd), Companies House No 17423506, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom (Processor), for the ComplianceForge software service (complianceforge.app).
Where the customer is a Controller, UGS Ltd processes personal data only on the customer's documented instructions. Where the customer uses the service for its own organization without external Controllers involved, the customer acts as Controller and, where applicable, UGS Ltd may act as Controller for billing and abuse-prevention records required to operate the service.
2. Subject matter, duration and scope of processing
Subject matter: processing of account data (email address, sign-in identifier) and content data entered into the readiness assessment wizard, gap lists and document generation fields, for the purpose of producing readiness scores, prioritized gap lists and generated document templates (Privacy, Terms, DPA, Cookie, Refund and AI-disclosure texts).
Duration: for the duration of the subscription, plus a retention period required for invoicing, audit trail of generated material (version history) and legal obligations. Upon termination, customer content is deleted or returned on request within a reasonable period, unless retention is required by law.
Categories of data subjects: customer personnel and, where the customer inputs such data, its own customers' contact persons. The guest path collects no data: no registration is required for public service pages, and no data is collected or stored on the guest path.
3. Nature and purpose of processing
Collection, storage, structuring, generation (document templates from customer data), export (MD/HTML with version history and generated-material stamp), deletion and backup of data. Purpose is strictly limited to providing the ComplianceForge software service as described on this site: readiness checks, gap lists, document templates and recommendations.
Personal data is not used for advertising, not sold, not shared for profiling, and not used to train third-party models. AI gap analysis runs on the operator's own LiteLLM instance with configured model routes; the customer's assessment data is processed only to produce the requested result.
4. Security measures (Art. 32 equivalent)
- Dedicated database instance with row-level security per tenant; application role cannot bypass policy boundaries.
- Encryption in transit (TLS 1.2+); authentication via Google OAuth and token-based sessions with expiry.
- Role-separated deployment: app, worker, database and web tiers run in separate containers.
- Access control on infrastructure level; secrets in environment files with restrictive permissions, not in the repository.
- Audit trail of generated material: version history with content hash and generated-material stamp; append-only audit log.
- Backups: host-level backup coverage with retention (daily/weekly rotation) documented in the infrastructure documentation.
- Sub-processor due diligence: only providers necessary to run the service (hosting, payments, transactional email); a list is available on request via [email protected].
5. Sub-processors
The customer authorizes the use of sub-processors that are strictly necessary to run the service: infrastructure hosting (European data centers), payment processing (Stripe, for checkout and invoicing) and transactional email delivery (for support and billing messages). A current sub-processor list is available on request; material changes are announced in advance where required, and the customer may object on reasonable data-protection grounds.
6. International transfers
Where processing involves transfers outside the UK/EEA, transfers are made under an appropriate safeguard (adequacy decision, standard contractual clauses or UK addendum) as applicable. The operator's entities and payment flows are documented in the terms.
7. Assistance and rights of data subjects
UGS Ltd assists the customer, as far as possible, with data subject requests (access, rectification, erasure, restriction, portability, objection), with prior consultation where required, and with breach notification without undue delay after becoming aware. The customer can exercise privacy requests via [email protected].
8. Deletion and return of data
At the end of the service, customer content is deleted or returned at the customer's choice, unless storage is required by law. Invoices and payment records are retained for the statutory bookkeeping period.
9. Audit
The customer may request information demonstrating compliance and may audit (or appoint an auditor to audit) the processing, once per year and with reasonable notice, subject to confidentiality and operational security. Documentation-based audits are offered first.
10. Limitation
This DPA covers processing of personal data within the ComplianceForge software service only. THIS IS NOT AN AUDIT AND NOT LEGAL ADVICE — this document is a contractual template provided for the customer's own review with its own experts; ComplianceForge does not act as an auditor and does not fulfil regulatory requirements on the customer's behalf. Final responsibility always remains with the customer and its own experts.
Effective: 2026-10-23. Version: 1.0. Questions: [email protected].