Data processing agreement

Version 2026-09-03. This agreement supplements the terms of use and applies whenever you entrust Fortiche with personal data for which you are responsible: typically, that of the people who write to your agents. It is entered into pursuant to Article 28 of the General Data Protection Regulation.

1. Who does what

You are the controller. You decide why your agent exists, who it talks to, and what it retains. You are answerable for the lawfulness of that processing and for informing the data subjects.

CHECK EASY is your processor. We process this data solely on your instructions and to provide the service to you. We make no use of it for ourselves: no resale, no advertising, no model training.

For the data of your account (your email, your billing, your sign-in logs), the roles are reversed: we are the controller, and the privacy policy applies.

2. What is processed, for whom, and for how long

Sensitive data. The service is not designed for health data, biometric data, political, religious or trade union opinions, or data relating to criminal offences. You undertake not to entrust such data to your agents without first informing us and without our having agreed together on appropriate measures.

3. We act only on your instructions (Art. 28(3)(a))

We process the data only on your documented instructions, which include the configuration of your agents, including with regard to a transfer outside the European Union. If a legal obligation required us to carry out processing you have not requested, we would inform you before carrying it out, unless the law prohibits us from doing so.

If one of your instructions appears to us to infringe the Regulation, we inform you.

4. Confidentiality (Art. 28(3)(b))

Persons authorized to access the data are bound by a duty of confidentiality. Access is limited to what is necessary to operate the service and to provide the support you request. We do not read your conversations, unless you ask us to in order to resolve a problem.

5. Security (Art. 28(3)(c) and Art. 32)

• Encryption of exchanges in transit (HTTPS) across the entire service.
• Encryption at rest of the keys and access tokens you entrust to us.
• Passwords stored as hashes, never in plain text.
• Data segregated by account: an agent can only read its owner’s scope.
• Log of access and security events, retained and searchable.
• Regular database backups.
• Hosting in the European Union (Paris, France).

6. Sub-processors (Art. 28(3)(d))

You authorize Fortiche to engage the providers listed below, each bound by obligations equivalent to those of this agreement. This list is the same as the one in the privacy policy: it is kept up to date with the service, not copied by hand.

We inform you of any addition or replacement before it takes effect. You may object on grounds relating to data protection; failing agreement, you may terminate the affected part of the service without penalty.

Providers established outside the European Union act under the European Commission’s standard contractual clauses. Note that some channels (Telegram, Discord) and some model providers involve, by their nature, a transfer outside the Union: turning these channels on is a transfer instruction that you give with full knowledge of the facts.

7. The assistance we owe you with data subjects’ rights (Art. 28(3)(e))

If one of your data subjects exercises a right (access, rectification, erasure, objection, portability), it is up to you to respond. The service gives you the means to do so yourself: viewing and deleting conversations, exporting your account, revoking access. If a case goes beyond these tools, write to hello@fortiche.io and we will assist you within a timeframe compatible with your own.

If such a request reaches us directly, we do not answer in your place: we forward it to you.

8. Data breaches, impact assessments (Art. 28(3)(f))

In the event of a data breach affecting you, we inform you without undue delay and no later than 48 hours after becoming aware of it, with what we know: the nature of the breach, the approximate categories and volume concerned, the likely consequences, and the measures taken. It is up to you to notify the supervisory authority within 72 hours, since you are the controller; we provide you with what you need to do so.

We also help you, within the limits of the information available to us, to carry out a data protection impact assessment and a prior consultation if your processing requires it.

9. What happens to the data at the end (Art. 28(3)(g))

At the end of the contract, you choose: retrieve your data, or have it erased. Export is available at any time from your settings, without having to ask for it. If no choice is expressed, the data is erased at the end of a period of 30 days after the contract ends, except for what a legal obligation requires us to keep: accounting records, for 10 years.

Backups follow their own cycle and are overwritten no later than 30 days afterwards.

10. Audit (Art. 28(3)(h))

We make available to you the information necessary to demonstrate compliance with Article 28, and we allow for audits conducted by you or on your behalf, once a year, with reasonable notice, during business hours and without compromising the security of other customers. The costs of an on-site audit are borne by you, unless it reveals a failure on our part.

11. Records

We maintain the record of categories of processing activities carried out on your behalf, as provided for in Article 30(2), and make it available to the supervisory authority on request.

How to accept this agreement

This agreement is deemed accepted as soon as you use Fortiche to process personal data for which you are responsible. If your internal procedure requires a signed document, write to hello@fortiche.io: we will send you this text in a version ready for signature.