DPA, sub-processors, DPIA pointers and assurance

A procurement, security or privacy reviewer uses this page to find what Noxtica provides for a vendor review. It points to the public documents, explains the sub-processor and assurance pages inside Backoffice, and says where to ask for support material that is not public.

This page does not summarise the legal documents and does not describe the terms they contain. Read the documents themselves. It also does not restate what independent assurance exists. The Security and trust evidence page states that.

What it is

Availability: depends on your plan, role and the modules enabled for your organisation.

Public documents

Backoffice also serves a copy of each document inside the console: Terms, Privacy, Cookies, Acceptable Use, Legal notice, Subprocessors, Disclaimer and DPA. When Noxtica publishes a new edition of a document that users accept, Backoffice can ask each user to accept it again. The re-acceptance prompt covers Terms, Privacy, Acceptable Use, Disclaimer and DPA.

Sub-processors in Backoffice

Open Backoffice → Privacy & Legal → Sub-processors. The page covers one relationship: the Noxtica AI assistant acting as a sub-processor when it makes changes inside your workspace. The page states that this follows your organisation accepting the relationship and recording a lawful basis for it. The acceptance is a signed receipt, not a toggle.

The page shows the status “Accepted” or “Not accepted”. When accepted, it shows a line such as “Article 6(1): … · receipt v… · recorded by …”. You record, change or revoke the acceptance in the Legal Basis Register under the entry “Assistant write actions”. Revoking takes effect at once and does not ask for a basis again. The page also links to the full sub-processor list. For the public list, use Subprocessors.

Platform Assurances

Open Backoffice → Privacy & Legal → Platform Assurances. The page is read-only and has nothing to switch, accept or request. It names five categories that the platform keeps responsibility for:

The page links to the Privacy Policy, the sub-processor list and the Terms of service for the contractual side.

Compliance page

Open Backoffice → Privacy & Legal → Compliance. The page shows placeholder rows for compliance documents. Their Download buttons are disabled, and the tooltip says compliance documents will be available through the customer success portal. The rows are not evidence that a report exists. When the EU AI Act policy is enabled for your organisation, the page also shows the Article 50 transparency disclosure policy for verified AI agents. It is observe-only: you choose “Shadow (observe only)” or “Dry-run (preview template)”, and no disclosure is injected into responses.

DPIA support

This documentation set links no DPIA. Ask your account team for DPIA support material. When you turn on session replay, Backoffice asks you to enter the real DPA or DPIA reference for your own assessment. See Legal basis register and receipts.

Security posture, vulnerability reports and status

• The Security and trust evidence page lists what Noxtica publishes about controls, cryptography boundaries and module data scope.
• Vulnerability reports go to the contact named in the file /.well-known/security.txt on noxtica.com. The file has an Expires field. Check that the date has not passed before you rely on the file.
• Service state is at https://status.noxtica.com. The status page is not a contractual SLA. See Uptime checks and status.
• Request procurement material for the exact service and deployment you review through Contact.

Which route answers which question

Prerequisites

• For the sub-processor acceptance, the administrator role and a multi-factor method. Recording a basis asks for a fresh check.
• A decision from your counsel on whether and on which basis your organisation accepts the AI assistant for write actions. Write actions apply when the assistant is enabled for your organisation.
• For procurement material, the name of the service, the modules and the deployment you review.

Steps

1. Collect the public documents

Open DPA, Subprocessors, Privacy Policy and Terms. Add the version you reviewed and the date to your vendor record.

2. Decide on the AI assistant

1. Open Backoffice → Privacy & Legal → Sub-processors.
2. Read the status, “Accepted” or “Not accepted”.
3. To accept, select Record the acceptance in the Legal basis register. Read the disclosure, choose the Article 6(1) basis, tick the acknowledgement and submit. See Legal basis register and receipts.

3. Review what Noxtica keeps responsibility for

Open Backoffice → Privacy & Legal → Platform Assurances. Read the five categories. Record the page in your vendor review as a statement, not a control.

4. Ask for DPIA and procurement support

Send a request through Contact or to your account team. Name the service and modules you review and the questions you need answered.

5. Register the vulnerability contact

Open /.well-known/security.txt on noxtica.com. Copy the contact and check the Expires date. Add the status page to your monitoring tools.

Verify it works

• Sub-processors shows “Accepted” with a receipt line, or “Not accepted” before you record one.
• The Legal Basis Register entry “Assistant write actions” shows “Asserted” and the same receipt version.
• The audit log shows tenant_legal_basis_asserted for the acceptance and tenant_legal_basis_revoked after a revocation.
• The public documents open at the addresses above.
• Platform Assurances lists the five categories and shows no control.

Troubleshooting

Related

• Security and trust evidence: what Noxtica publishes about security and assurance.
• Legal basis register and receipts: record the sub-processor acceptance.
• Privacy and compliance controls in Backoffice: map of every privacy page.
• Uptime checks and status: the status page and incident feed.
• DPA, Subprocessors and Privacy Policy: the public legal documents.