Data Processing Agreement

Roles

An insurer, broker, or channel partner running an operation on InsureFlow is the controller of the personal data in that operation. They decide what is processed and why.

Trisilva is the processor, acting on the controller's documented instructions and on nothing else. Where a further party is engaged to process data in the course of the service, that party is a sub-processor under Trisilva's instruction, and Trisilva remains answerable to the controller for what it does.

The DPA attaches to the Master Services Agreement as a schedule. Where a counterparty's procurement process requires a standalone instrument, the same content is executed separately. This page describes what that agreement contains; the executable text is released to a counterparty under the appropriate agreement, and the last section sets out how to request it.

What the agreement governs

• Scope. The categories of personal data processed, the purposes, the data subjects, and the retention periods, set per engagement rather than left general.
• Processor obligations. Processing on documented instructions only, confidentiality commitments from personnel, and the security measures below.
• Sub-processor authorisation. Prior written notice of a new sub-processor, with a right to object on reasonable grounds.
• Cross-border transfer. The specific safeguard applied to each transfer corridor.
• Data-subject rights. Requests reaching Trisilva are forwarded to the controller unanswered, with assistance in responding inside the legal timeline.
• Breach notification. Notice to the controller without undue delay and inside a defined window, with the detail a regulator notification requires.
• Impact assessments. Assistance with a DPIA where applicable law requires one, including technical documentation of the processing activity.
• Audit rights. A right to audit data-protection compliance, on notice.
• Return or deletion. Return or deletion of personal data on termination, with written certification available.

Applicable laws

The DPA names the law of each jurisdiction the engagement touches rather than referring to applicable law generally, because the obligations differ in substance across the region and a general reference leaves a controller unable to check compliance.

• Singapore. Personal Data Protection Act 2012 (PDPA).
• Vietnam. Personal Data Protection Law 2026 (PDPL) and Decree 13/2023 on personal data protection.
• Indonesia. Undang-Undang Pelindungan Data Pribadi (UU PDP).
• Philippines. Data Privacy Act.

Sector regulation covering insurance, healthcare, and financial services is identified per engagement and sits alongside the data-protection law.

Cross-border transfers

Personal data moves outside its originating jurisdiction only under a safeguard the law of that jurisdiction recognises. The mechanism is identified per transfer corridor rather than by a general reference to standard contractual clauses, because Vietnam's PDPL 2026 and Decree 13/2023 carry their own procedural requirements that a generic clause does not satisfy.

Where data is transferred between Trisilva entities, the same obligations apply through the group's internal agreements. Residency for a given engagement is set in that customer's DPA. The platform posture behind it is described on Security.

Sub-processors

Trisilva engages a defined set of sub-processors under contract. Each is bound to data-protection obligations equivalent to those Trisilva owes the controller, and Trisilva remains liable to the controller for their acts and omissions. A sub-processor that will not accept those obligations is not engaged on personal data.

The current list is provided on request under the relevant agreement rather than published, so that it stays accurate to the engagement it applies to.

Security measures

The agreement specifies the technical and organisational measures applying to the processing, covering access control on a least-privilege basis, identity and access logging, multi-factor authentication for administrative access, network segmentation, encryption, personnel security training, regular security reviews, and incident response. The measures specific to an engagement are appended to that engagement's DPA.

How the platform is built to hold those measures is set out on Security.

Audit

A controller may audit Trisilva's data-protection compliance on notice, annually and on reasonable grounds in between. Scope is limited to the processing of that controller's personal data, and another controller's confidential information is protected by redaction or on-site review, so an audit right cannot become a route to a competitor's operational detail.

Return and deletion

On termination, personal data is returned or deleted on the controller's instruction, with written certification of deletion available on request. Data held under a legal retention requirement, and backup copies that cannot be selectively deleted, remain subject to the confidentiality and security obligations until they expire.

Obtaining the agreement

The Data Processing Agreement, the sub-processor list, and the full security pack are available to customers and prospective customers for a data-protection or procurement review. Request them through Contact, selecting the security-pack enquiry type.

Questions for our data protection contact can be sent to privacy@trisilva.ai. How Trisilva handles personal data in its own right, rather than on a customer's behalf, is set out in the Privacy policy.

Terms · Privacy · Security and trust · Contact