Data Processing Agreement

Last updated September 2026. This summarizes the terms on which Op by Op processes data on your behalf. We're happy to execute a signed DPA on your paper or ours — contact privacy@opbyop.com.

Roles

For the process knowledge and documents you submit, you (the customer) are the data controller and Op by Op is the processor, processing solely on your documented instructions to provide the service.

Scope & purpose

We process your content only to generate, store, and version your analyses and to operate and support the service. We do not use your content for advertising, resale, or model training, and we do not share it with model providers.

Categories of data

Account identifiers (name, work email, organization, role) and the engineering content you create or upload. Op by Op is a process-authoring tool and is not intended for special-category personal data; please don't upload patient data or other sensitive personal information.

Security measures

Encryption in transit (HTTPS enforced) and at rest, on SOC 2 Type II cloud infrastructure.
Database-enforced isolation between organizations; role-based access within an organization.
Append-only, tamper-evident audit logging of changes.
Uploaded source documents used transiently and then discarded (failed runs purged automatically).

Subprocessors

We engage a limited set of subprocessors (cloud hosting; enterprise AI infrastructure), each under contractual obligations to protect your data and process it only to provide their service to us. A named list is available on request, and we will give notice of material changes so you may object.

Confidentiality & personnel

Personnel with access to your content are bound by confidentiality obligations and access it only as needed to operate or support the service.

Data subject requests & assistance

We will assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, and assessment obligations.

Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your content, with the information reasonably available to us.

Return & deletion

On termination, we will, at your choice, return or delete your organization's content within a commercially reasonable period, except where retention is required by law.

International transfers

Where data is transferred across borders, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) as applicable.

This page summarizes our processing terms; a countersigned DPA is available on request. ← Back to Op by Op