Data-processing information

Status of this document

This page explains processing responsibilities for hosted FourAPI conversions. It is not an executed data-processing agreement or a certification of GDPR compliance. Where an integrating developer supplies personal data as a controller or processor, the applicable processing agreement and provider arrangements must be completed before that use.

Roles and instructions

An integrating developer commonly determines why documents are collected and is their controller, or may act as a processor for another organisation. FourAPI’s role in document conversion may be processor or subprocessor depending on that relationship. FourPoint separately determines purposes for its own account administration and security records. Roles must be confirmed for each offered service.

Processing instructions should be limited to receiving authorised files, performing the selected conversion and returning the result. Categories of individuals and data depend on customer documents and must be specified in the agreement. Do not submit special-category, children’s, regulated or other highly sensitive information to the service while its processing safeguards are being configured.

Required agreement and safeguards

Processing safeguards, specify the subject matter, duration, nature and purpose, data types, categories of people, documented instructions, confidentiality, technical and organisational measures, subprocessor authorisation and change procedure, lawful transfers, assistance with rights requests and incidents, return/deletion, and proportionate audit arrangements.

Implemented application controls include scoped authentication, optional developer MFA and required owner MFA, quotas, bounded conversion admission, per-worker memory/CPU limits, non-persistent document transport and metadata-only account records. Deployment isolation, provider logs/backups, incident response and processing agreements require separate verification. No penetration-test certificate or complete secure-erasure guarantee is asserted.

The agreement must explain how incidents are reported without undue delay once known and how the controller receives the information needed to meet its obligations. No completed incident-response service or fixed reporting SLA is represented as already available.

Subprocessors, locations and deletion

Render hosts the website and API, Supabase provides authentication/database storage, Brevo handles configured email delivery and Cloudflare Turnstile verifies public-form security checks. The operator must maintain the applicable provider entities, services, regions, subprocessors and transfer safeguards. The API region alone does not establish the location of every provider operation. A payment provider is not active for FourAPI.

Document bytes use memory and worker pipes rather than intentionally created upload/result files. Worker processing ends on completion or the configured 60-second processing timeout, while parent memory and transfer have separate lifetimes. No secure-erasure deadline is certified. Metadata uses the 30/90/180-day request-driven retention described in Privacy; downloaded copies and provider logs/backups remain separate.