Legal
Data Processing Agreement
VeriVeri — Multi-LLM Consensus Fact-Verification (customer-managed Azure application)
Version 2.0Last updated: 5 July 2026Effective: 5 July 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between you (the “Customer”, “Controller”) and Northloop Group AB, organisation number 559579-7787, Sweden (“VeriVeri”, “Processor”) for your use of the VeriVeri application and related support (the “Service”). It governs VeriVeri’s processing of personal data on your behalf pursuant to GDPR Article 28, and supplements the Terms of Service and Privacy Policy.
1. Scope — when this DPA applies
VeriVeri is delivered as a customer-managed Azure Marketplace Managed Application that you deploy into your own Azure subscription. The application, its database, its Key Vault and its connections to your AI models all run inside your cloud tenant. In normal operation VeriVeri does not receive or process the content you submit for verification, and for that content VeriVeri is neither controller nor processor.
This DPA applies to the limited circumstances in which VeriVeri processes personal data on your behalf — namely, when you request support and VeriVeri accesses the managed resource group that the application created in your subscription (for example, to diagnose an operational issue). In those circumstances you are the controller and VeriVeri is your processor.
This DPA does not apply to data VeriVeri collects as a controller in its own right (website enquiries and Azure Marketplace order/lead data), which is governed by the Privacy Policy.
2. Processing details (Art. 28(3))
| Element | Description |
|---|---|
| Subject matter | Support and troubleshooting of the Customer’s VeriVeri deployment, where performing that support requires access to personal data held in the managed resource group in the Customer’s subscription. |
| Duration | Only for the time necessary to perform the specific support task the Customer has requested, within the term of the Customer’s use of the Service. VeriVeri retains no copy of Customer personal data after the task is complete. |
| Nature and purpose | Diagnosing and resolving operational issues at the Customer’s request. VeriVeri does not use the data for any other purpose. |
| Types of personal data | Any personal data present in the Customer’s deployment — for example verification content stored in the audit log (if the Customer has payload storage enabled) and operator identities. Determined by the Customer’s configuration. |
| Categories of data subjects | Determined by the Customer; may include the Customer’s customers, employees, or other individuals whose data appears in submitted content. |
3. Processor obligations
VeriVeri shall:
- (a) Process only on documented instructions. Access the Customer’s environment only when the Customer requests support; a support request is treated as the Customer’s documented instruction. VeriVeri will not access the managed resource group absent such a request, except where required by EU or Member State law (and will inform the Customer of that requirement unless the law prohibits it).
- (b) Confidentiality. Ensure that personnel authorised to process the data are bound by confidentiality.
- (c) Security. Implement appropriate technical and organisational measures under Art. 32 — see Annex A.
- (d) Sub-processors. Engage sub-processors only under Section 5, imposing equivalent data-protection obligations by contract.
- (e) Assist with data-subject rights. Taking into account the nature of the processing, assist the Customer by appropriate measures in responding to requests to exercise data-subject rights (Art. 15–22). Because the Customer controls its own deployment and its data-subject-rights tooling (including a records-erasure function), such requests are ordinarily fulfilled by the Customer directly.
- (f) Assist with security & breach. Assist the Customer in ensuring compliance with Art. 32–36, including breach notification and data-protection impact assessments, taking into account the information available to VeriVeri.
- (g) Deletion / return. At the end of the provision of support, delete or return all Customer personal data and delete existing copies, unless EU or Member State law requires storage. In normal operation VeriVeri holds no copy of Customer content.
- (h) Audit. Make available to the Customer the information necessary to demonstrate compliance with this Article, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.
- Breach notification. Notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s data (Art. 33(2)).
4. Controller obligations
The Customer shall: (i) ensure it has a lawful basis for the processing carried out in its VeriVeri deployment, including any Art. 9 condition for special-category data; (ii) configure the deployment’s privacy controls (payload storage, PII masking, retention) appropriately for the data it processes; (iii) provide support requests as its documented instructions; and (iv) meet its own obligations as controller, including transparency to and rights of its data subjects.
5. Sub-processors
The Customer grants a general authorisation for VeriVeri to engage the following sub-processors in connection with support:
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft (Azure) | Underlying cloud platform on which the Customer’s managed application runs and through which support access is exercised | Customer’s chosen region (EU by design) |
VeriVeri maintains an up-to-date list of sub-processors and will give the Customer prior notice of any intended addition or replacement, allowing the Customer to object on reasonable data-protection grounds.
6. International data transfers
VeriVeri performs support from within the EU/EEA and does not transfer Customer personal data outside the EEA in the course of support. Where any transfer were to occur, it would be governed by an adequacy decision (Art. 45) or Standard Contractual Clauses with supplementary measures (Art. 46). The Customer’s own choice to route verifications to AI providers outside the EEA (for example an external OpenAI or Anthropic endpoint the Customer configures) is the Customer’s responsibility as controller.
7. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, to the extent permitted by applicable law. Nothing in this DPA limits any liability that cannot be limited under the GDPR.
8. Term and termination
This DPA takes effect when the Customer accepts it or the Terms of Service, and remains in force for as long as VeriVeri may process personal data on the Customer’s behalf. On termination, Section 3(g) governs deletion or return of data.
9. Acceptance
By deploying or using the Service, or by countersigning this DPA, the Customer accepts it. A countersigned copy is available on request from alex@northloop.se.
Annex A — Technical and organisational measures (Art. 32)
VeriVeri applies the following measures to support access. Many are enforced by the Azure Marketplace managed-application model itself:
- Least-privilege access. Support access is granted to a named Entra group holding the Contributor role on the managed resource group — deliberately not Owner — so VeriVeri cannot alter the Customer’s access control, policy or locks.
- Secrets protected. The Key Vault in the managed resource group is protected by a ReadOnly lock; VeriVeri holds no data-plane role that would let it read stored secrets directly.
- Access only on request. Support access is used only when the Customer has requested assistance (the documented instruction), by authorised personnel, and is time-boxed to the task.
- Logging. Actions taken in the Customer’s subscription are recorded in the Customer’s own Azure Activity Log / Monitor, giving the Customer an independent audit trail.
- Encryption & residency. Data is encrypted in transit and at rest by the Azure platform and remains in the Customer’s chosen region (designed to support EU data boundaries); VeriVeri exports no Customer content out of that environment.
- Confidentiality & least data. Personnel are bound by confidentiality; support is performed with the minimum data access necessary and, wherever possible, by guiding the Customer to self-serve using the application’s own dashboard, logs and diagnostics.