The paperwork, answered before it is asked

For what your organisation puts into the platform — messages, files, boards, time and personnel records — you are the controller and Enclessa the processor, acting on your documented instructions. For your account, billing and support correspondence, Enclessa is the controller under its privacy notice. Lawful basis, retention decisions and transparency towards your staff stay with you.

The Article 28 agreement is part of the terms of service and applies from first use. A signed counterpart is issued on request through the enterprise contact. It is published and binding but has not had an external legal review. No turnaround for a signed counterpart and no acceptance of customer paper is committed; confirm either before relying on it.

There are 6, for hosting and email, payments, push delivery and — only where the companion module is installed — the language model behind it, each bound by terms no weaker than Enclessa’s own and with Enclessa fully liable for them. The list in the agreement annex and the privacy notice is the same list. Monitoring is not outsourced. A new or replaced subprocessor is announced at least 30 days ahead in text form. You may object on a data protection ground and, if unresolved, terminate when the change takes effect — § 6 (2).

One European Union region, a German seller, content, files and databases in datacentres in Germany, email from our own servers there. A named country means an Enterprise dedicated deployment, operated by Enclessa — not self-hosting. Three things leave the EU, each named in the privacy notice: push notifications via Apple and Google (device token, title and sender line — never an encrypted message body); companion features, where installed, via OpenAI or through OpenRouter to Anthropic in the USA under standard contractual clauses and the EU-US Data Privacy Framework where certified; and desktop downloads from GitHub, which sees the IP address.

You owe the response; Enclessa makes it fast. The People module produces a per-person export, and an organisation-wide export in open formats is always available. End-to-end encrypted content is ciphertext Enclessa holds no key for, so it cannot be produced readably for anyone. Managed channels are covered normally. Assistance within ten working days, urgent requests without undue delay — § 7 (3), via privacy@enclessa.app.

Retention is configurable per organisation and defaults to keeping data. Per-team and per-channel retention is planned, not available. Data stays exportable for 30 days after the contract ends and is then deleted, backups included, within a further 30 days by a resumable purge scoped from the database schema. Invoices and accounting records are kept for eight years under § 257 (4) HGB and § 147 (3) AO, blocked from any other use.

Enclessa notifies the affected controller within 24 hours of becoming aware — § 8 (1) — with what is known, completing it afterwards: nature, categories and approximate numbers, likely consequences and measures taken. You decide whether the authority and individuals must be told. Breach correspondence runs through security@enclessa.app. Enclessa’s supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Deutschland, https://www.lda.bayern.de.

No certificate or audit report exists. Available on every plan under § 9: the published architecture and data model, the OpenAPI description, the security page in the terms of the Article 32 annex, one answered security questionnaire per calendar year, and an on-site inspection for concrete cause on 30 days’ notice.