Data processing

Website data and product data

The Privacy notice covers website visitors and enquiries. Product processing will be described separately in the customer agreement and DPA, with the parties’ roles determined by their actual activities. Customers remain responsible for their own lawful instructions and notices.

Processing scope

The processing schedule will identify purposes, data categories, affected individuals, duration, permitted instructions and safeguards. Depending on the contracted features, relevant information can include identities, access records, device and infrastructure telemetry, SaaS and AI activity, service tickets and audit evidence.

Regions and support access

The planned hosted model uses AWS in the US or EU, with an assigned area disclosed before purchase and primary data and backups kept in that area. Exact regions and deployment controls still require verification. This product model does not describe the marketing website’s processing locations.

Remote support access and external AI inference are separate from storage residency. Support countries, providers and any applicable transfer safeguards must be disclosed and addressed in the agreement before access. No unrestricted worldwide access permission is implied.

Providers and external AI

A verified product subprocessor list will identify actual providers, functions and relevant locations. A shortlist is not an appointed provider list. External model processing requires authorization for that customer and deployment; the intended air-gapped model has no external fallback.

Retention, export and deletion

Retention schedules will distinguish activity and audit evidence from tickets, raw AI prompts, training examples and backups. Export, deletion and backup-expiry commitments must be specified and technically verified. The current draft periods are not presented here as effective service guarantees.

Assurance

SIMORIN is preparing its security and compliance approach. This page does not claim a completed SOC 2 examination, ISO certification, HIPAA eligibility or blanket regulatory compliance. Regulated processing needs the relevant agreements and verified safeguards before use.