Data Processing Agreement

Last updated: 7 August 2026

This DPA forms part of the Terms of Service for organisations whose use of MEOs involves personal data. It reflects Article 28 UK GDPR.

1. Roles

The customer organisation is the controller of personal data contained in its projects, documents, files and form submissions. MEOs is the processor and processes that data only on the customer's documented instructions, which are given through use of the platform's features.

2. Scope of processing

Subject matter: provision of the MEOs platform. Duration: the subscription term plus the deletion window. Nature: storage, retrieval, display, document generation and export. Data subjects: the customer's staff, subcontractors and project contacts. Categories: names, work contact details, job roles, signatures, site photographs, and location stamps where the customer enables them.

3. Sub-processors

Current sub-processors: Vercel (application hosting), Neon (PostgreSQL database, Frankfurt), Vercel Blob (file storage, Frankfurt), Anthropic (AI text generation, only when the customer enables AI features), Stripe (payments, when enabled), Resend (transactional email, when enabled). We will give 30 days' notice before adding or replacing sub-processors.

4. Security

Measures include: encryption in transit (TLS) and at rest, tenant isolation enforced on every query, role based access control, optional two-factor authentication, hashed credentials and API keys, audit logging of state-changing actions, and rate limiting on authentication endpoints.

5. Assistance and incidents

MEOs will assist the controller with data subject requests and will notify the controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting their data.

6. Deletion and return

On termination, the customer may export content in standard formats. MEOs deletes the organisation's data per the retention terms in the Privacy Policy.

7. International transfers

Primary data storage is in the EU (Frankfurt). Where a sub-processor processes data outside the UK/EEA (for example Anthropic in the United States when AI features are used), transfers rely on the applicable adequacy regulations or standard contractual clauses in that sub-processor's terms.

These documents are working drafts prepared for MEOs and have not yet been reviewed by a solicitor. They will be finalised before paid subscriptions open.