Your compliance documents are yours. We process them only to provide the service, never to train models, and we delete them when you leave. We use our own product to hold ourselves to the same evidence-based standard it helps you meet.
1. Who we are
StayEvident Ltd ("StayEvident", "we") provides compliance management software. For customer workspace data, we act as a processor under your instructions; for account and billing data, we act as a controller. Our Data Protection Officer can be reached at hello@stayevident.com.
2. What we collect
Workspace content — documents, risk registers, audit records and evidence you upload or connect. Account data — name, work email, role, authentication logs. Usage data — feature interactions and diagnostics, aggregated where possible.
3. AI processing
AI assessments run on your workspace content to assess it against the clauses of your adopted standards and identify gaps. To do this, relevant excerpts of your content are sent to our AI subprocessors (Anthropic for assessment, Voyage AI for search embeddings) under their commercial API terms. Your content is never used to train models, ours or anyone else's. AI outputs are suggestions that a person in your organisation confirms or overrides, and they remain inside your workspace.
4. Retention and deletion
Workspace content is retained while your subscription is active. On termination, you can download your documents and generated reports; we delete workspace content within 30 days and backups within 90. Audit logs of the deletion itself are retained as required by applicable law.
5. Subprocessors and transfers
We use a small set of subprocessors: application hosting, Cloudflare (file storage and this website), Anthropic and Voyage AI (AI processing), Polar (billing), Resend (email delivery) and PostHog (product analytics, only with your consent). Contact us for the current list with regions. Where personal data is transferred outside the UK or EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
6. Your rights
Depending on your jurisdiction, you may have rights to access, correct, export, or erase personal data, and to object to processing. Workspace members should route requests through their organization's admin; anyone can contact us directly and we'll respond within 30 days.