Data processing summary for clients

How SolaraoLabs handles personal information on your behalf when we build, host or support software for you. This summarises the processor commitments required by Article 28 of the UK GDPR; the full data processing terms form part of your project agreement.

Last updated: 2 November 2026

Roles

When you share personal information with us for a project — for example customer or staff data in files you upload to the workspace, in test data, or in a system we build or support for you — you are the controller and SolaraoLabs is your processor. For our own account, enquiry and relationship records about you, we are the controller, as described in our privacy policy.

Our commitments as your processor

• Instructions. We process your personal data only on your documented instructions (the quotation, project agreement and your written requests), unless the law requires otherwise, in which case we will tell you first where we are allowed to.
• Confidentiality. Everyone at SolaraoLabs who can access your data is bound by confidentiality.
• Security. We apply appropriate technical and organisational measures (see below).
• Sub-processors. We use only the sub-processors listed below, under written terms that give your data equivalent protection, and we will tell you before adding or replacing one so you can object.
• Assistance. We help you respond to requests from individuals exercising their rights, and with security, breach notification and data protection impact assessments relating to our services.
• Personal data breaches. We notify you without undue delay after becoming aware of a breach affecting your data, with the information you need to meet your own obligations.
• End of the project. At the end of the services we delete or return your personal data, as you choose, unless the law requires us to keep it.
• Audits. We make available the information you reasonably need to show compliance with these obligations, and allow for and contribute to reasonable audits.
• International transfers. We only transfer your data outside the UK with the safeguards UK law requires.

Security measures in our workspace

• All traffic is encrypted with HTTPS, with strict transport security and browser security headers.
• Access is by invitation only and limited to your organisation’s members and the members of our team assigned to your work, according to their role.
• Our staff accounts must use two-step verification.
• Uploaded files are checked for type and size, stored privately, and can only be downloaded by authorised project members.
• Requests that change data are protected against cross-site request forgery, and public forms are rate limited.
• Significant actions, such as approvals and file uploads, are recorded in an audit log.
• The database is hosted by a managed provider with encrypted storage and backups.

Current sub-processors

• Clerk, Inc. — workspace sign-in and account security.
• Our website hosting provider — application hosting.
• Our managed database provider — database and file storage, with backups.
• Resend — sending service emails such as invitations and notifications.

Requests and questions

To request our full data processing terms or ask about how we handle your data, email support@solaraolabs.co.uk. We may need to confirm your identity before acting on a request.