Data Processing Agreement

Last updated: 15 June 2026

1. Scope

This DPA applies when Ludoitte Oy processes personal data on behalf of a business customer using Evermail.

2. Processing Instructions

Evermail processes archive data only to provide upload, storage, indexing, search, export, deletion, security monitoring, and support.

3. Sub-Processors

Evermail uses Microsoft Azure for infrastructure, Stripe for billing, and optional Azure OpenAI features only when enabled by the customer.

4. Data Return And Deletion

Tenant administrators can request an Exit Package during active service, cancellation grace, or service wind-down windows. Zero-Access archives are returned as ciphertext and metadata, and require customer-held keys to decrypt.

5. Security Measures

Evermail uses tenant isolation, encryption in transit and at rest, role-based access control, audit logging, least-privilege operations, and guarded export/deletion flows.

6. Breach Notification

If Evermail becomes aware of a personal data breach affecting customer data, we will notify affected customers without undue delay.

7. Contact

For DPA questions, contact privacy@evermail.ai.