Customer-controlled data, processed for the evidence workflow.
This page summarizes the data-processing terms Evidiam expects to include in customer agreements. It is designed for diligence and onboarding, not as a substitute for counsel review.
Roles
The customer is the controller or business that determines why customer data is processed. Evidiam acts as processor or service provider for customer data submitted to the platform.
Processing purpose
Evidiam processes customer data to provide the service: authentication, tenant operation, evidence ingestion, requirement mapping, human approval workflows, packet generation, bank-review sharing, verification, support, security, and audit logging.
Data categories
Customer data may include business contact data, user account data, compliance documents, bank program evidence, operational records, customer-funds reconciliation data, lending or card-program evidence, audit events, and support communications.
Confidentiality
Evidiam personnel and service providers are expected to access customer data only as needed to provide, secure, support, or improve the service, and to protect it under confidentiality obligations.
Security measures
Evidiam uses tenant isolation, role-based access controls, WorkOS authentication, tokenized external sharing, audit logging, encrypted transport, least-privilege source connections, append-only event records, and controlled subprocessors.
Subprocessors
Evidiam uses subprocessors for hosting, database infrastructure, authentication, email, and optional AI drafting. The current list is published at /subprocessors.
Deletion and return
At termination or upon written request, Evidiam will return or delete customer data according to the applicable agreement, subject to legal obligations, backup retention, security logs, and audit-record requirements.
Incident notice
Evidiam will notify affected customers of confirmed security incidents involving customer data without undue delay and will provide information reasonably available to help customers meet their own obligations.