Legal and compliance
Everything about what Vitreco is, what it holds and who can reach it. All of it is public, none of it is behind a sign-in, and each one says what it is for so you can read the two that matter to you instead of all seven.
What you are agreeing to
The contract, and the notice that sits alongside it.
The agreement itself: what the service is, what it costs, how it renews, how it ends, and what happens to a workspace afterwards.
Read by: Whoever signs. Version 2026-09-04, recorded against the account that accepted it.
What is held about a person, why, for how long, and who can reach it. Written for the person it is about rather than for a regulator.
Read by: Anybody using Vitreco, and anybody deciding whether to.
What happens to the data
Your organization is the controller of your people's data and we process it on your instructions. These are the documents that say so precisely.
The Article 28 terms: scope, instructions, confidentiality, subprocessors, assistance, deletion, audit, and the transfer clauses.
Read by: A buyer's legal or procurement team, usually first.
Every third party that touches anything, what it touches, where it runs, and how you are told before that list changes.
Read by: The same team, usually second.
The Article 30 record: each activity, our role in it, the data, the lawful basis and the retention period.
Read by: A data protection officer, or a regulator asking.
The Article 35 assessment for deploying this: the risks of a tool that holds what people say about work, and what is done about each.
Read by: Anybody who has to sign off the deployment internally.
How it is built
The claims a security review checks, written so they can be.
Encryption, access, dependencies, backups, incident response, and what has not been done yet — including the audits nobody has commissioned.
Read by: A security reviewer, and anybody who would rather read the gaps than be told there are none.
Something not answered here? Write to [email protected]. If your organization needs a signed copy of the addendum, a security questionnaire filled in, or a term changed, that is a conversation rather than a form.