Legal
Data Processing Addendum
Last updated September 2026
A plain-language summary of the processing relationship. The signed DPA is the operative document and takes precedence over everything on this page.
Roles
The customer is the controller of the content and personal data in its connected repositories and systems. Narraxio is the processor, acting on documented instructions.
What we process
Repository files the customer authorizes; content assets and relationships derived from them; source facts and messaging records the customer creates; provenance and version events; search indexes and embeddings; and AI context traces and proposals.
Sub-processors
Infrastructure, storage and AI providers, listed on the subprocessors page, with advance notice of additions and a mechanism to object.
AI providers as sub-processors
AI providers process customer content to generate proposals. They are named sub-processors, their retention and training terms are stated, and enterprise customers can restrict which may be used.
Security measures
Encryption in transit and at rest, tenant isolation across content, indexes and embeddings, least-privilege repository scopes, encrypted credential storage, access controls and audit logging.
International transfers
Where personal data leaves its region, standard contractual clauses and supplementary measures apply. Data residency options are available on enterprise plans.
Incident notification
Notification without undue delay and within the window stated in the signed DPA, with the information a controller needs to meet its own obligations.
Deletion and return
Structured export throughout the term, and deletion of the content graph, indexes, embeddings and context traces within the stated window after termination.
This is placeholder legal copy for the marketing site. Replace it with your reviewed Terms & Privacy before launch.