The Solves Data Processing Agreement.
A support desk holds your customers' personal data, so you need to know how it is handled. This page is a plain-English summary of the Data Processing Agreement we are preparing: the controller and processor roles, the security measures already in place, and the sub-processors involved. A full, signable version is in preparation before public paid launch and is available to pilot customers on request.
This is an honest pilot-stage summary, not a finished legal document.
The short answer
What this DPA is, and where it stands
A Data Processing Agreement records how Solves handles the personal data you put into your support desk: who is responsible for what, how it is protected, who else touches it, and what happens when you leave. A full, signable DPA is in preparation before public paid launch, and pilot customers who need one today can request the current draft through our contact page.
We are being straight about the stage we are at. Solves is an early pilot, and we would rather hand you a DPA we can stand behind than publish a hurried template. So this page summarises our intended handling truthfully: the roles, the controls already running, and the sub-processors involved. Where a control is planned rather than finished, we say so.
The data in question is mostly your customers' support content: the names, addresses and messages they send to your support address, plus the contact records and notes your team keeps. Under the intended DPA you stay the controller and Solves acts as your processor.
Roles
Controller and processor, set out plainly
Data-protection law splits responsibility between the controller, who decides why and how personal data is used, and the processor, who acts on the controller's instructions. The intended DPA records that split.
You are the controller of your customers' support content
You decide why you collect your customers' enquiries and how you answer them, so for that content you are the controller. Solves processes it on your behalf, only to run your desk: receiving email, turning it into owned tickets, storing the history, and sending your replies. We do not use it for our own purposes, sell it, or use it to train models.
Solves is the controller of your account data
For your own account details, such as your team's login information and the billing data needed to take payment, Solves is the controller, because we decide how that information is handled to provide and bill the service. Our privacy notice describes what we hold and why.
What we process, and on whose instructions
As your processor we handle the support content you route to Solves: message bodies and subjects, contact names, addresses and company names, saved replies, tags and the raw inbound payloads behind each ticket. We process it on your documented instructions, which are the configuration choices you make in the product.
Security measures
The safeguards already in place
The DPA describes the technical and organisational measures protecting your data. These are the ones running today.
Encryption at rest
All customer support content is encrypted before it reaches the database, using XChaCha20-Poly1305 with a per-organisation key. Each value is bound to its organisation, table and field, and decryption fails closed on any mismatch.
Authorised access only
Access to support content is restricted to the people you authorise, scoped by organisation, brand and ticket visibility. Every query is scoped to the organisation, so no one reaches past the boundary you set.
Metadata-only logs
We record what happened and how long it took, never the sensitive content. Bodies, subjects, addresses, secrets and payloads do not reach a log, and a sanitiser strips anything that does.
Email safety
Mailbox setup is verified before live sending, replies are locked to the ticket's brand and mailbox so nothing goes out under the wrong identity, and significant actions are recorded as metadata-only audit history.
Sub-processors
Who else processes your data
A sub-processor is a third party that processes personal data on our behalf to help deliver the service. We keep the list short and named, and we will tell you before adding a new one so you have a chance to object.
| Postmark | Email delivery: sending your outbound replies and receiving inbound mail for your verified mailboxes. |
|---|---|
| Stripe | Billing: processing your subscription payments. Stripe handles your card details; Solves does not store them. |
| Cloud hosting | A UK or EU cloud hosting provider runs the infrastructure your encrypted data sits on. |
The list above is the full set of sub-processors in the support flow today, and the current version always lives on the sub-processors page.
Leaving and your rights
Data return, deletion and assisting you
A DPA also covers what happens at the end: returning or deleting data, helping you meet requests from your own customers, and notifying you if something goes wrong.
Return and deletion when you leave
Your tickets, contacts and notes are yours. When you leave, you have a window to take your data before your workspace is closed. Built-in self-service export is still being finished, so for now we help you extract it on request, and we never hold it hostage. After the agreed period, your support content is deleted. We call these controls partly planned because that is the honest position today.
Helping you answer data-subject requests
When one of your customers asks to access or delete the data you hold about them, you remain responsible for answering as the controller, and the intended DPA commits us to assist you. Tenant isolation keeps each organisation's content separated.
Telling you if something goes wrong
If we became aware of a personal-data breach affecting your data, the intended DPA commits us to notify you without undue delay and to give you the information you need to meet your own obligations. We do not promise an uptime figure or claim a certification we do not hold.
A signable DPA is available to pilot customers on request
If you need a Data Processing Agreement in place before going live, get in touch through our contact page and tell us you are running the Solves pilot. We will share the current draft and put a signed agreement in place.
Saying it straight
What this page does not claim
It is easy for a data-protection page to imply more assurance than a pilot can honestly give. So here is what we are not saying.
We do not claim UK GDPR compliance as a badge, and we carry no certification marks we have not earned. We do not assert that a finished, countersigned DPA already exists for every customer; a full, signable version is in preparation, available to pilot customers on request meanwhile. We do not name a hosting provider beyond a UK or EU cloud host, promise an uptime figure, or guarantee email delivery.
FAQ
DPA questions, answered
Does Solves have a signable DPA today?
A full, signable DPA is in preparation ahead of public paid launch. We would rather ship one we can stand behind than publish a hurried template. In the meantime, pilot customers who need a DPA in place can request the current draft through our contact page.
Who is the controller and who is the processor?
For your customers' support content, you are the controller and Solves acts as your processor: we handle that data on your instructions to run your desk, and we do not use it for our own purposes or to train models. For your own account details, such as login and billing information, Solves is the controller.
Is Solves UK GDPR compliant?
We do not make a blanket UK GDPR compliance claim, because whether a deployment is compliant depends on how you configure and operate the product as well as on the software. What we can state concretely is that support content is encrypted at rest under per-organisation keys, access is authorised and scoped, and logs hold metadata only.
How do I get the DPA?
Ask through our contact page and tell us you need a DPA for the Solves pilot. We will share the current draft, talk through any clauses your procurement or legal team raises, and put a signed agreement in place.
Need a DPA in place for the pilot?
Request the current Data Processing Agreement and we will work through it with you, or read how we protect your data first.