Data Processing Agreement

What this covers

This covers personal data lrnit processes on behalf of an organization: the people you invite into a workspace, what they study, how they perform, and any company documents you upload for course generation. It runs for as long as your workspace exists.

The data subjects are your employees, contractors and anyone else you invite. The data is their name, work email, role and department, their learning activity and assessment results, and the contents of documents your admins upload.

It does not cover someone who signs up to lrnit on their own account. There, lrnit is the controller and the Privacy Policy governs.

Controller and processor

Your organization is the data controller: you decide the purposes and the means. lrnit is the processor. Where one of our providers processes workspace data for us, we stay responsible to you for what they do with it.

Processing on your instructions

We process workspace personal data only on your documented instructions. Those instructions are: running the product for you, supporting it when you ask, and meeting a legal obligation we cannot avoid.

Training models on your data is not one of them. We do not do it, and the API terms of every provider we send data to withhold that right from them as well.

If we ever think an instruction from you breaks data protection law, we will say so instead of carrying it out.

Confidentiality

Access to workspace data is limited to the people who need it to run and support the service, and they are bound to keep it confidential.

Security measures

The measures behind this agreement are the ones on our security page, not a separate set written for procurement. In summary:

Traffic is encrypted in transit with TLS 1.2 or better, and data is encrypted at rest by our database and hosting providers with AES-256. Every table in the learner graph enforces row-level security, so one workspace cannot read another’s rows. AI calls run server-side only, and provider keys never reach a browser. Error monitoring excludes auth tokens, and we do not log credentials or personal data in production.

Membership, access and configuration events are written to a per-organization audit log whose rows are hash-chained to the row before them, so an edit or a deletion in that log is detectable.

Subprocessors

lrnit uses third-party services to run, and each one sees a defined slice of data. The current list, naming every provider, what it does and what it processes, is published on the security page and is the annex to this agreement.

It lives there rather than being restated here so that the two can never disagree. We remain responsible to you for every provider on it.

Requests from your people

If someone in your workspace asks to see, correct, export or erase their data, the product answers most of it without us: anyone can export their full learner graph as JSON from settings, and deleting an account removes their profile, courses, mastery records and generated content. Where a request needs us, we will help you answer it in time.

Personal data breaches

If we become aware of a personal data breach affecting your workspace, we will tell you without undue delay. We will not hold the first notification back waiting for a complete investigation.

That notification will give you what your own reporting duties need: what happened, which categories of data and roughly how many people are affected, the likely consequences, and the steps we are taking.

Return and deletion

You can export workspace data at any time while the workspace exists. Deleting your organization permanently removes the company data we hold: members, invites, course templates, uploaded documents, reports and the audit log. That deletion is immediate and irreversible, so treat it as final rather than as a request we can walk back.

Deleted rows age out of our providers’ database backups as those backups rotate, within 30 days.

Demonstrating compliance

We will give you the information you need to show this agreement is being met, and we will answer a security review directly. We hold no SOC 2, ISO 27001 or comparable certification, and we will not claim one until an independent auditor issues it. If procurement needs a deeper look, contact us and we will walk you through the architecture.

International transfers

lrnit runs a single production database, hosted in Tokyo (ap-northeast-1), with application compute in the same region. Our subprocessors operate in other countries, including the United States and the European Union; the list on the security page identifies each one.

Where a transfer leaves the EEA or the UK without an adequacy decision, it relies on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), using the controller-to-processor and processor-to-processor modules as applicable, together with the UK Addendum.

lrnit does not offer regional data residency. There is no option today to keep a workspace’s data in the EU, the UK or the Gulf, and we would rather say so here than let you discover it during a review.

Getting this counter-signed

This is the current draft of what we are prepared to offer, published so that procurement can read it before speaking to anyone. It has not been through outside legal review, and a counter-signed copy is not available yet.

Four things are deliberately left unset, because they are commercial commitments rather than descriptions of how the product works: an uptime service level, a cap on liability, how far in advance we notify you before a new subprocessor starts processing, and the signing entity. We would rather leave them open than publish a number nobody has agreed to.

If you need any of them fixed in writing, talk to us and we will settle them with you.