Quorin Technologies · Archon
Data Processing Agreement
Processor terms for customers whose own compliance framework requires one on file — including the reason why, in a normal deployment, there is nothing for us to process.
- Effective
- 9 August 2026
- Last updated
- 9 August 2026
Draft — not yet in force
This document is missing details that only Quorin Technologies can supply, and it has not been reviewed by a qualified lawyer in Zimbabwe. Do not rely on it, and do not present it to a customer, until both are done.
Outstanding
- · Full registered company name
- · Company registration number
- · Registered office address
Edit src/lib/legal/company.ts. This banner disappears by itself once nothing is outstanding.
1. The starting position
In a standard self-hosted Archon deployment, Quorin is neither a controller nor a processor of your personal data. The software runs on your infrastructure and writes to your database. We receive no copy of your records, no user directory, no audit trail, and no telemetry. A processor agreement normally describes what a processor may do with data it holds; here we hold none.
This agreement exists anyway, because quality managers and procurement officers are routinely required to produce a signed DPA for every supplier, and “there is nothing to process” is not something an assessor can file. It records that position formally, and it governs the narrow, optional circumstances in section 3 where we do process data on your behalf.
2. Parties and scope
This agreement is between Quorin Technologies of [TO BE COMPLETED] (“Quorin”) and the laboratory licensing Archon (“the Customer”). It supplements our Terms of Service and takes effect when the Customer accepts those terms.
The Customer is the controller of all personal data in its Archon deployment. Quorin is a processor only in respect of the processing described in section 3, and only while the Customer has elected to use the relevant service.
3. Where we do process data for you
There are three, all optional, and all off unless you turn them on or ask for them.
3.1 Support access
| Subject matter | Diagnosing a fault you have reported |
|---|---|
| Duration | The duration of the support case |
| Nature and purpose | Reading logs, screenshots, exports or database extracts that you send us, solely to diagnose and fix the issue |
| Types of data | Whatever the material you send us happens to contain |
| Categories of subject | Your personnel; potentially your subjects, if your records concern people |
We do not have standing access to your deployment. We can only see what you actively send us. We ask you to redact before sending, and we delete support material within 90 days of a case closing.
3.2 Cloud AI mode
Archon’s AI assistant is disabled by default. If an administrator sets it to cloud mode, the content submitted to it is sent to a third-party model provider. This contradicts the data-sovereignty position of the product, which is why Archon reports cloud AI mode as a failed control on the accreditation dashboard rather than letting it be switched on quietly.
In that configuration, the model provider is a sub-processor and the Customer is responsible for deciding whether that is lawful for its data. Local AI mode sends nothing outside the Customer’s network.
3.3 Hosted deployment
Where Quorin operates a deployment on the Customer’s behalf under a separate written agreement, that agreement’s terms apply and this section 3.3 is superseded by it.
4. Our obligations as processor
Where we act as a processor under section 3, we will:
- Process personal data only on the Customer’s documented instructions, including as to international transfers, unless required otherwise by law — in which case we will tell the Customer first, unless the law forbids it.
- Ensure that people authorised to process the data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures, having regard to the state of the art and the risk to data subjects.
- Engage sub-processors only under section 5, and remain liable for their performance.
- Assist the Customer, so far as reasonably possible, with data subject requests, security breach notification, data protection impact assessments and prior consultation.
- Notify the Customer without undue delay, and in any event within 72 hours, on becoming aware of a personal data breach affecting the Customer’s data.
- Delete or return the data at the end of the service, and delete existing copies unless required by law to keep them.
- Make available the information necessary to demonstrate compliance with this agreement, and allow and contribute to audits by the Customer or its auditor, no more than once a year unless a breach or a regulator requires otherwise, on reasonable notice and subject to confidentiality.
5. Sub-processors
The Customer gives general authorisation for Quorin to engage sub-processors. We will maintain a current list, and give at least 30 days’ notice before adding or replacing one. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may terminate the affected service.
Current sub-processors: our email provider, for correspondence; our payment providers, for payments the Customer initiates; and, only where cloud AI mode has been explicitly enabled by the Customer, the configured model provider. There are no others, because there is no hosted service to have any.
6. International transfers
Where processing under section 3 involves transferring personal data to another country, we will do so only under an appropriate transfer mechanism — standard contractual clauses, adequacy, or an equivalent safeguard recognised by the Customer’s applicable law.
7. Security measures
The technical and organisational measures built into Archon — the per-organisation audit hash chain, electronic signature capture with re-authentication, role-based access control enforced at a single authorisation chokepoint, field-level AES-256-GCM encryption, and organisation-scoped data isolation — are described in our Security Statement and form part of this agreement.
The Customer is responsible for the measures around them: server hardening, transport security, database access, backup, physical security, and the correct assignment of roles to people.
8. Liability
Liability under this agreement is subject to the limitations and exclusions in our Terms of Service.
9. Executing this agreement
This agreement is effective without signature once the Customer accepts our Terms of Service. If your quality system requires a countersigned copy, request one from quorinstartup@proton.me and we will return an executed PDF.