Legal
Data Processing Agreement
This agreement describes how GRCDesk hosts customer workspace content, who can access it, how long evidence is kept, and what remains after a workspace is deleted.
Last updated on 21 October 2026.
For content the Customer puts into its workspace, the Customer is the controller and GRCDesk is the processor. GRCDesk processes that content to provide the platform, secure it, support the Customer, and delete it when a workspace deletion is requested.
For our own website, demo requests, and platform accounts, GRCDesk may act as a controller, as described in the Privacy Policy.
This Data Processing Agreement applies for the same period as the Terms of Service, including a pilot.
Questions about processing?
Use the same contact for retention, support access, and workspace deletion requests.
privacy@grcdesk.amSee also our Terms of Service, return to home, or request a demo.