What procurement and IT get.
Data at rest in Frankfurt (EU). Sub-processor list, each with the provider’s own terms linked. DPA, signed online at sign-up. Technical and organisational measures on 1 page, written to be forwarded. No model of ours is trained on your data. No SOC 2 and no ISO 27001, and we do not imply one.
If your process requires an audit report, say so before you buy — we will tell you where that leaves us rather than run out the clock.