Legal
Data processing agreement
Available to all customers and countersigned on Enterprise plans.
Last updated March 2026
Roles
You are the controller of any personal data contained in the content you send. Verb Atlas acts as processor and processes that data only on your documented instructions.
Sub-processors
We maintain a current list of sub-processors, including cloud hosting and model providers, all bound to zero-retention and non-training terms. You are notified 30 days before any addition.
Security measures
Encryption in transit and at rest, workspace-level isolation, least-privilege access with audit logging, and customer CMS tokens encrypted at rest with per-tenant keys.
International transfers
Transfers are governed by standard contractual clauses. Data residency in the EU or the UAE is available on Enterprise plans.
Breach notification
We notify you without undue delay and within 72 hours of becoming aware of a personal data breach affecting your workspace.
Deletion and return
On termination, content is deleted within 30 days, or returned in a structured export first if you request one.