Effective 20 September 2026
This agreement is between SOREG LTD (“Soreg”, “we”), a Delaware corporation, and the customer that subscribes to the Soreg service (“Customer”, “you”). It forms part of the Terms of Service and governs any processing of personal data we carry out on your behalf.
The Soreg gateway runs on your infrastructure. Your records are queried in your environment, masked in your environment, and re-identified in your environment. The software contains no telemetry and makes no outbound connection to us. Your regulated data does not reach Soreg at all, and there is nothing in our systems for us to lose, disclose or be compelled to produce.
What we do process is the ordinary business information that comes with having an account: the names and work contact details of your administrators and billing contacts, and whatever your staff put in a support request. That is the real subject matter of this agreement, and sections 2 and 3 describe it honestly rather than pretending it is larger than it is.
If someone on your team sends us a log file or a database extract when asking for help, that is the one realistic way your regulated data ever reaches us. Section 3 says what we do about it.
1.1 “Data Protection Law” means every law on the protection of personal data that applies to a party's processing under this agreement, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and comparable US state laws including those of Virginia, Colorado, Connecticut, Utah and Texas.
1.2 “Customer Personal Data” means personal data that we process on your behalf under this agreement, as described in Annex I.
1.3 “Gateway Data” means the records that the Soreg software queries, masks, re-identifies and logs inside your environment. Gateway Data is not Customer Personal Data, because we do not process it — see section 2.
1.4 “controller”, “processor”, “data subject”, “processing”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR, and their equivalents in the CCPA (“business”, “service provider”, “consumer”) are read accordingly.
1.5 Roles. You are the controller of Customer Personal Data. We are your processor. For Gateway Data, you are the controller and there is no processor: the processing takes place entirely on systems you control.
1.6 We act as an independent controller, not your processor, for a narrow set of things we must do for ourselves: keeping billing and tax records, maintaining our own security and access logs for the soreg.ai website and our account systems, and complying with our own legal obligations. Our Privacy Policy covers those. This agreement does not.
2.1 The Soreg gateway is distributed as software you install. It runs on infrastructure you own, lease or control. It connects to databases you control, using credentials you hold, and to a model provider account in your own name.
2.2 The software contains no analytics, no usage telemetry and no diagnostic beacon. In normal operation its only outbound network connection is to the model provider endpoint you configure. We commit to this in section 5 of the EULA, including a commitment not to introduce such a component quietly in an update.
2.3 It follows that we do not receive, store, have access to, or have the technical ability to retrieve: the records in your connected databases; the queries your staff ask; the masked payloads sent to your model provider; the re-identified results returned to your staff; your audit log; or your field classifications and role definitions.
2.4 This is an architectural fact, not a policy commitment, and you do not have to take our word for it. You control the network the software runs on and can verify its egress yourself. Section 3 of the EULA expressly permits you to test this, and any other property of the software, on your own deployment without asking us.
2.5 If you are completing a security questionnaire, the accurate answers are that Soreg does not host, store or have access to your data; that there is no data residency question to answer for Gateway Data because it never leaves your chosen region; and that our sub-processors have no access to it either, because we have none to give them. Annex III lists the sub-processors that touch the limited Customer Personal Data we do hold.
3.1 The categories of Customer Personal Data we process, the data subjects, the purposes and the retention periods are set out in Annex I. In summary they are: account and administrator contact details; billing contact details; licence key issuance records; and the contents of support requests.
3.2 Support requests are the realistic risk. The most likely way Gateway Data ever reaches us is that someone on your team attaches a log file, a stack trace, a configuration export or a database extract to a support ticket. We ask you not to, and the Documentation explains how to redact first. But it happens.
3.3 If it happens, then in respect of that data: we process it solely as your processor and solely to resolve the request; we do not copy it out of the ticket, index it, or use it for any other purpose; we do not use it to train or fine-tune any model; we delete it as soon as the request is resolved and in any event within 30 days; and we will tell you it happened if what you sent contained special category data under GDPR Article 9, or sensitive personal information under the CCPA, so you can assess it on your side.
3.4 We will not ask you to send us unredacted production data. If a problem genuinely cannot be diagnosed without it, we will say so and we will agree a method with you first, rather than inviting you to paste it into an email.
4.1 We will process Customer Personal Data only on your documented instructions, including as to international transfers, unless required to do otherwise by law that applies to us. If that happens we will tell you first, unless the law prohibits telling you.
4.2 Your instructions are: this agreement, the Terms of Service, your configuration and use of the Service, and any further written instruction you give us. If we think an instruction breaches Data Protection Law, we will tell you and may pause that processing until it is resolved.
4.3 We will not sell or share Customer Personal Data, will not retain, use or disclose it for any purpose other than performing the Service, will not use it outside our direct business relationship with you, and will not combine it with personal data from another source except as the CCPA permits a service provider to do.
4.4 We will not use Customer Personal Data to train, fine-tune, evaluate or improve any machine learning model, whether ours or anyone else's.
4.5 We will ensure that anyone we authorise to process Customer Personal Data is bound by a duty of confidentiality that survives the end of their engagement, and is given access only to what their role requires.
4.6 We will assist you, taking into account the nature of the processing and the information available to us, with your obligations under Articles 32 to 36 GDPR and their equivalents — security, breach notification, data protection impact assessments and prior consultation.
5.1 We will implement and maintain the technical and organisational measures set out in Annex II, and will not materially reduce them during the term.
5.2 We may update those measures as technology and threats change, provided the overall level of protection does not fall.
5.3 You are responsible for security in your own environment — the infrastructure the gateway runs on, the databases it connects to, the credentials it uses, and your configuration of it. We cannot see any of that and cannot protect it. Nothing in Annex II is a statement about the security of your deployment.
6.1 You give us general authorisation to engage sub-processors. Those engaged as at the date of this agreement are listed in Annex III and on our sub-processor page.
6.2 We will impose on each sub-processor, by written contract, data protection obligations at least as protective as those in this agreement, and we remain fully liable to you for their performance.
6.3 We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your account contact and by updating the sub-processor page. You may subscribe to notifications on that page.
6.4 If you reasonably object on data protection grounds within that 30 days, tell us at privacy@soreg.ai and we will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the Service and we will refund prepaid fees for the unused period. That is your remedy, and we will not treat the objection as a breach by you.
6.5 No sub-processor has access to Gateway Data, because we do not have access to it.
7.1 If we receive a request from a data subject relating to Customer Personal Data, we will not respond to it ourselves except to confirm receipt and direct them to you. We will forward it to you without undue delay.
7.2 We will assist you, by appropriate technical and organisational measures and so far as is reasonable, to respond to requests to access, correct, delete, restrict, port or object. Given how little we hold, this is usually a short exercise.
7.3 For Gateway Data, we cannot assist, because we hold none of it. Responding to data subject requests about your own records is something you do in your own environment — and the gateway's audit log is designed to help you show what was accessed, by whom, and what the model saw.
8.1 If we receive a binding legal request for Customer Personal Data, we will notify you before disclosing anything, unless legally prohibited. If prohibited, we will use reasonable efforts to have the prohibition lifted and will tell you as soon as we may.
8.2 We will challenge a request we consider unlawful, disproportionate, or inconsistent with the law of the requesting authority, and will disclose only the minimum the request requires.
8.3 We cannot be compelled to produce Gateway Data, because we do not hold it. A request for your records would have to be served on you. Some customers regard this as the single most useful property of the architecture, and it is a fair reading.
9.1 We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data.
9.2 The notification will describe, so far as we know at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures we have taken or propose to take; and a contact point. Where we cannot provide everything at once, we will provide it in phases without further undue delay.
9.3 We will not make a public statement identifying you in connection with a breach without consulting you first, unless legally required.
9.4 A security incident in your environment is not a breach of Customer Personal Data and we will not know about it. You are welcome to tell us at security@soreg.ai if the software is implicated, and we will help.
10.1 On termination, and at your choice, we will delete or return Customer Personal Data, and delete existing copies, within 60 days — unless law requires us to keep it, in which case we will keep only what is required, for only as long as required, and continue to protect it under this agreement.
10.2 Backups are overwritten on their ordinary cycle, which does not exceed [VERIFY — state your actual backup retention here] days.
10.3 Gateway Data needs no deletion step, because it is already only in your hands. Section 9 of the EULA confirms that your data, your audit log and your evidence packs stay with you when the licence ends.
11.1 We will make available to you the information reasonably necessary to demonstrate our compliance with this agreement, and will contribute to audits conducted by you or an auditor you appoint.
11.2 In the first instance we will respond to a reasonable written request, including a completed security questionnaire and any third-party assessment reports we hold. Given the architecture, this is usually sufficient, and we would rather answer your questions properly than send you a certificate.
11.3 If that is genuinely not sufficient for your regulatory obligations, you may conduct an on-site or remote audit, on 30 days' written notice, no more than once in any twelve months, during business hours, subject to confidentiality, and without unreasonably disrupting our operations. You may audit more often if a supervisory authority requires it or following a personal data breach. You bear your own costs; we bear ours.
11.4 An auditor who is our competitor may be refused, and we may require them to sign a reasonable confidentiality undertaking.
12.1 We are established in the United States and process Customer Personal Data there. Our sub-processors' locations are in Annex III.
12.2 Where you transfer Customer Personal Data subject to the GDPR to us, the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are incorporated into this agreement by reference and completed as follows: the optional docking clause in Clause 7 applies; Option 2 (general written authorisation) applies in Clause 9(a) with a notice period of 30 days; the optional redress clause in Clause 11(a) does not apply; the governing law in Clause 17 is the law of Ireland; the forum in Clause 18(b) is the courts of Ireland; Annex I, II and III of the Clauses are the Annexes to this agreement.
12.3 For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated, with Tables 1 to 3 completed from the Annexes to this agreement and Table 4 specifying that neither party may end the Addendum as set out in Section 19. For Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss FADP, the competent authority being the Federal Data Protection and Information Commissioner.
12.4 We have not yet appointed a representative in the European Union or the United Kingdom under Article 27 GDPR. Until we do, direct any request or complaint to privacy@soreg.ai, which we monitor and which reaches us directly. We will update this section and our Privacy Policy when the appointment is made.
12.5 Because Gateway Data never leaves your environment, the transfer analysis for your regulated records is straightforward: there is no transfer to us to assess. Where your model provider is in another country, that transfer is between you and the provider, and it concerns a masked payload rather than identifiable records.
13.1 For the CCPA, you are the business and we are a service provider. We receive Customer Personal Data solely to provide the Service under the Terms of Service.
13.2 We certify that we understand the restrictions in this section and will comply with them. Specifically, we will not: sell or share personal information; retain, use or disclose it for any purpose other than the business purposes specified in this agreement, including for a commercial purpose other than providing the Service; retain, use or disclose it outside the direct business relationship between us; or combine it with personal information received from another source, except as CCPA regulations permit a service provider to do.
13.3 We will notify you if we determine we can no longer meet those obligations. You may, on notice, take reasonable and appropriate steps to stop and remediate unauthorised use, and you have the right to take reasonable steps to ensure we use personal information in a manner consistent with your obligations.
13.4 Under the comparable laws of Virginia, Colorado, Connecticut, Utah, Texas and other states, you are the controller and we are the processor, and the obligations in this agreement are intended to satisfy the contractual requirements those laws impose.
14.1 This agreement forms part of the Terms of Service. It takes effect when you accept those terms and lasts as long as we process Customer Personal Data, plus any period required by law.
14.2 If this agreement conflicts with the Terms of Service or the EULA on the processing of personal data, this agreement wins. On anything else, the Terms of Service win. If this agreement conflicts with the Standard Contractual Clauses, the Clauses win.
14.3 Each party's liability under this agreement is subject to the limitation of liability in section 14 of the Terms of Service, to the extent permitted by law — except that nothing limits a data subject's rights under the Standard Contractual Clauses or any liability that cannot lawfully be limited.
14.4 This agreement is governed by the law stated in section 18 of the Terms of Service, except where the Standard Contractual Clauses or Data Protection Law require otherwise.
14.5 If you need a countersigned copy for your records, write to privacy@soreg.ai and we will send one. A Word version is available on request for your own review and redlining.
Data exporter (controller): the Customer identified in the order or subscription confirmation. Contact: the account contact on file. Activities: use of the Soreg service and software. Role: controller.
Data importer (processor): SOREG LTD, 2810 N Church St, PMB 924048, Wilmington, DE 19802-4447, United States. Contact: privacy@soreg.ai. Activities: providing the Soreg account, subscription, licence keys, updates, documentation and support. Role: processor.
| Categories of data subjects | Your personnel and contractors who administer, use or pay for the Service: named account administrators, billing contacts, and anyone who contacts our support. Incidentally, and only where section 3.2 applies, individuals whose data appears in material your staff send us in a support request. |
|---|---|
| Categories of personal data | Name; work email address; work telephone number where given; employer and job title; account identifiers and licence key issuance records; billing contact details and transaction records; the content of support correspondence and anything attached to it; authentication and access records for our account systems. |
| Special category data | None is requested, required or expected. It could only reach us through the support channel described in section 3.2. Where it does, the measures in section 3.3 apply and we will notify you. |
| Gateway Data | Not transferred. Your regulated records, queries, masked payloads, re-identified results, audit logs and configuration remain in your environment. We have no access to them and no ability to retrieve them. |
| Frequency | Continuous for account and authentication data for the duration of the subscription; occasional and event-driven for support correspondence and billing. |
| Nature and purpose | Creating and maintaining your account; issuing and renewing licence keys; delivering software updates and documentation; invoicing and collecting fees; providing technical support; maintaining the security of our own systems; meeting our legal obligations. |
| Retention | Account and administrator records: for the subscription term plus 24 months. Licence key issuance records: for the subscription term plus 24 months. Billing and tax records: 7 years, as an independent controller under section 1.6. Support correspondence: 24 months from closure. Material falling under section 3.2: deleted on resolution and in any event within 30 days. |
| Sub-processor transfers | As set out in Annex III, for the duration of the subscription. |
Where the GDPR applies by virtue of Article 3(2), the supervisory authority is that of the Member State in which the representative under Article 27 is established, once appointed. Until then, the authority of the Member State in which the data subjects whose data is transferred are located.
These measures apply to our systems and to the limited Customer Personal Data described in Annex I. They say nothing about the security of your own deployment of the gateway, which is yours to configure and defend — see section 5.3.
| Access control | Access to systems holding Customer Personal Data is restricted to personnel who need it. Administrative access requires multi-factor authentication. Access is reviewed on role change and revoked on departure. [VERIFY] |
|---|---|
| Encryption | Personal data is encrypted in transit using TLS 1.2 or above. Data at rest in our cloud services is encrypted using the provider's platform encryption. [VERIFY] |
| Minimisation by architecture | The product is designed so that regulated data never reaches us. This is the primary technical measure and the reason the rest of this annex has so little to protect. |
| Segregation | Customer records are logically separated by account. Production and non-production environments are separate, and production personal data is not used in testing. [VERIFY] |
| Resilience and backup | Account and billing systems are hosted on managed cloud services with the provider's redundancy. Backups are encrypted and retained on a defined cycle. [VERIFY — state the actual cycle, and make section 10.2 match] |
| Logging | Administrative access to systems holding Customer Personal Data is logged, and logs are retained for a defined period. [VERIFY] |
| Secure development | Changes to the Software are version-controlled and pass an automated test suite before release. Releases are versioned and accompanied by a changelog. Security-relevant fixes are identified as such in release notes. |
| Vulnerability management | Dependencies are monitored for published vulnerabilities and updated on a risk-assessed basis. A security contact is published at security@soreg.ai. [VERIFY — the vulnerability disclosure policy is still open on the launch tracker] |
| Personnel | Everyone with access to Customer Personal Data is bound by written confidentiality obligations that survive the end of their engagement. [VERIFY] |
| Incident response | We maintain a documented process for identifying, assessing and notifying personal data breaches, with the notification commitment in section 9. [VERIFY — write the process down if it is not written down] |
| Sub-processor assurance | Sub-processors are engaged under written contracts containing data protection terms at least as protective as these, and are selected on the basis of their published security and compliance posture. |
| Deletion | Personal data is deleted on the schedule in Annex I and on termination under section 10. |
The current list is always at soreg.ai/subprocessors. As at the effective date it is:
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Corporation | Azure hosting for the website and account systems; Microsoft 365 for business email | Account and administrator contact details; support correspondence | United States |
| HubSpot, Inc. | Customer relationship management | Name, work email, company, job title, organisation size | United States |
| [PLACEHOLDER — payment processor not yet selected] | Payment processing and invoicing | Billing contact details and transaction records | — |
No sub-processor has access to Gateway Data. We have none to give them.
Cloudflare and Calendly are used on the soreg.ai website only, for cookieless traffic counting and for booking calls. They do not process Customer Personal Data under this agreement, and our Privacy Policy describes them.