Trust

Everything on this page is readable without logging in. If you need it in a form your security team can file, request the DPA directly.

Architecture

No database, server or infrastructure credential is ever entered on any elucide web page. Setup runs on your own infrastructure over local IPC -- see How it works.

Data processing agreement

A DPA template is available on request via Request access (select "Request a DPA").

Sub-processors

Our current sub-processor list is maintained in the DPA and available on request via the same form. We keep this list current rather than publishing a static copy here that can drift out of date.

What happens to the form on this site

The one form on this site is Request access. What you type there -- your work email, your organisation, and optionally your name and role -- is stored so that a person can answer you, and is used for nothing else. We keep it for 24 months and then delete it. We do not store your IP address; we store a salted hash of it, which lets us recognise abuse without keeping the address itself. You can ask us what we hold about you, and ask us to delete it, at the same address the form reaches.

The form is protected against spam by a proof-of-work check that runs in your own browser. There is no puzzle to solve, no image to click, no cookie, and nothing is sent to Cloudflare, Google or any other captcha service -- so submitting this form adds no third party to the list above. The notification that a request has arrived is sent through Microsoft 365, which is a sub-processor named in the DPA.

Compliance status, stated honestly

elucide has no production deployment yet -- our only live engagement is a single pilot with one healthcare organisation, which we do not name here. We are not claiming a certification we do not hold. As our compliance posture matures, this page will be updated to reflect exactly where we stand, not where we intend to be.

Data handling

Identity is managed by a self-hosted Zitadel instance on EU infrastructure. Prospect and tenant contact data is processed under a documented purpose and lawful basis -- ask for our processing record via Request access.