Data Processing

For customer content submitted to Aformity by or on behalf of a business customer, the customer generally determines the purposes and means of processing. Aformity processes that content to provide the service and follow the customer's instructions, subject to the applicable agreement and law.

Depending on the privacy law that applies, the customer may be considered a controller, business, or equivalent role, and Aformity may be considered a processor, service provider, contractor, or equivalent role. The exact role may depend on the customer's location, the individuals whose data is processed, and the agreement between the parties.

Aformity processes customer content according to the customer's instructions as expressed through the service, an order form, support request, written agreement, product configuration, or other documented direction.

Aformity may process customer content to provide, operate, maintain, support, troubleshoot, secure, monitor, and improve the service; prevent abuse; comply with law; enforce agreements; and carry out other purposes permitted by the applicable agreement.

Customer content may include uploaded files, spreadsheet data, exports from legacy systems, source fields, destination fields, schema definitions, mappings, validation rules, cleanup rules, transformation logic, import-ready outputs, user comments, issue notes, workflow status, account metadata, and support communications.

Because customers control the content they submit, Aformity may not know every category of personal information included in a customer file. Customers should inspect and minimize files before upload and remove data that is not needed for onboarding preparation.

Unless Aformity expressly agrees in writing, customers must not submit protected health information, payment card data, government identifiers, tax identifiers, children's data, biometric data, credentials, secrets, private keys, criminal history data, precise geolocation, or other regulated or highly sensitive information.

Customers with HIPAA, payment card, government, strict residency, or sector-specific compliance requirements should not use Aformity for that data until the relevant requirements have been reviewed and expressly accepted in a written agreement.

Customers are responsible for the customer content they submit and for the actions of their authorized users. This includes determining whether Aformity is appropriate for the intended workflow and ensuring that the customer has all rights, permissions, notices, consents, legal bases, and contractual authority required to provide customer content to Aformity.

Customers are also responsible for reviewing validation results, mappings, transformations, recommendations, and exports before using them in a production import or customer launch.

• Limit submitted data to what is needed for onboarding preparation.
• Remove unnecessary personal information and regulated fields before upload.
• Maintain original source files and backups outside Aformity.
• Manage customer-side user access and internal approvals.
• Notify Aformity promptly of suspected unauthorized access, exposed credentials, or data handling concerns.

Aformity will process customer content for the purposes described in these terms, the Privacy Policy, the Terms of Use, and any applicable written agreement. Aformity will not sell customer content.

Aformity will use reasonable administrative, technical, and organizational safeguards designed to protect customer content, taking into account the nature of the service, the customer content submitted, and Aformity's stage of maturity. Specific security controls or commitments must be documented in a written agreement or security review material to be binding.

Aformity may use third-party service providers to support hosting, infrastructure, analytics, communications, support, security, and business operations. These providers may process customer content or related information as needed to provide services to Aformity.

Aformity does not currently publish a public named subprocessor list from this page. Customers requiring subprocessor notice, approval rights, regional limits, or vendor-specific commitments should request those terms before submitting customer content that is subject to those requirements.

Aformity operates primarily from Australia and may support customers in the United States and other locations. Customer content and related information may be processed in Australia, the United States, and other countries where Aformity or its service providers operate, unless a written agreement says otherwise.

Customers are responsible for determining whether international transfer restrictions apply to customer content. Where required, Aformity will work with customers to address appropriate transfer mechanisms in a written agreement.

If Aformity determines that a security incident affects customer content, Aformity will notify affected customers as required by applicable law and any applicable written agreement. Aformity may take steps to investigate, contain, remediate, and prevent recurrence of suspected incidents.

Customers must promptly notify Aformity if they become aware of suspected unauthorized access, data exposure, credential compromise, or misuse involving their account or customer content.

Where Aformity processes customer content on behalf of a customer, individuals should generally direct privacy or data rights requests to that customer. Aformity will provide reasonable assistance to customers as required by applicable law and contract.

If Aformity receives a request that appears to relate to customer content, Aformity may refer the requester to the relevant customer or ask the customer for instructions, unless prohibited by law.

Aformity retains customer content for as long as reasonably necessary to provide the service, meet operational needs, comply with law, resolve disputes, enforce agreements, maintain security, and follow customer instructions. Retention periods may vary by data type, workflow, account status, and agreement.

Aformity's detailed retention, deletion, export, and return commitments should be documented in a written agreement where the customer has specific requirements. Customers should maintain source-of-truth records and backups outside Aformity.

Aformity handles security questionnaires, procurement reviews, data processing questions, and enterprise documentation requests case by case. Aformity does not claim third-party audit certification or formal compliance coverage unless that claim appears in a signed agreement or official security disclosure.

Requests for data processing review can be sent to hello@aformity.com.

Aformity may update these Data Processing Terms from time to time. If changes are material, Aformity will provide notice through the website, service, email, or another reasonable method.