Skip to main content
WritingSignal

Enterprise Privacy

Data Processing and Enterprise Privacy

This page summarizes WritingSignal's processing boundaries for organizations evaluating the service and identifies enterprise terms that are not yet available.

Professional Review Required
This is a substantive pre-launch draft based on WritingSignal's implemented architecture. It is not yet legally effective and does not invent an operating entity, jurisdiction, certification, or compliance guarantee.

1. Processing Roles

For ordinary account use, WritingSignal expects to determine how necessary account, billing, security, and service data are processed. An organization may determine the purpose of writing it submits. Final controller, processor, and joint-controller classifications depend on the customer arrangement and applicable law.

Review Item: This page is not a Data Processing Agreement and does not create controller or processor commitments.

2. Data Categories and Purpose

  • Account identity and access data for authentication and authorization.
  • Private submitted writing and result objects for requested analysis or Humanizer revision.
  • Plan, usage, and payment-order metadata for entitlement and reconciliation.
  • Support, export, deletion, security, and privacy-safe operational records.
  • No submitted writing in ordinary analytics, queue messages, payment records, or routine email.

3. Security Boundaries

  • Server-side account ownership and authorization checks.
  • Private R2 objects with opaque keys and short-lived permissions where downloads are needed.
  • Signed webhooks, replay protection, rate limits, bounded requests, and idempotent background work.
  • Separate production, preview, test, and local environments.
  • Redacted Sentry monitoring and allow-listed PostHog events.
  • Deletion, retention, account-export, and operational-audit workflows.

4. Subprocessors and Transfers

WritingSignal's implemented architecture uses Namecheap VPS infrastructure, Clerk, Supabase, Cloudflare R2, NOWPayments, Resend, and an external AI processing service for Humanizer requests. Paystack is used only when card checkout is enabled. The final subprocessor list, processing locations, transfer mechanisms, contractual terms, and notice process must be verified before public enterprise use.

5. Deletion, Exports, and Backups

Authorized users can request account data exports and deletion through protected workflows. Active private content is purged through retry-safe background work. Managed database backups may retain inaccessible deleted fragments until expiry, targeted at no more than 30 days.

Enterprise legal holds, custom retention, regional storage, customer-managed keys, and administrative export controls are not part of the current product.

6. Current Enterprise Limitations

  • No signed enterprise Data Processing Agreement is currently offered.
  • No claim of SOC 2, ISO 27001, HIPAA, FERPA, GDPR, UK GDPR, or other certification or compliance status is made.
  • No single sign-on, SCIM, team workspace, regional hosting, or custom retention commitment is included in current plans.
  • Institutional use requires separate security, privacy, procurement, and legal review.

7. Contact

Organizations may send privacy and data-processing questions to support@writingsignal.com. Do not email private writing, credentials, or payment secrets.