Personal data protection

At Despapeliza, protecting personal data is not just a legal obligation: it is a founding principle in how we design, develop and operate our services. As a platform that manages sensitive digital documents and electronic signatures, we handle personally identifiable information (PII) with the highest standards of confidentiality, integrity and availability, in full alignment with the ISO/IEC 27001 framework.

What personal data we protect

Our platform may process different categories of personal data, including:

• Full names, national identity documents and digital signatures.
• Email addresses, phone numbers and session metadata.
• IP addresses and geolocation data.
• Sensitive documents uploaded for signature (for example, employment contracts, confidentiality agreements, forms with health information).

We apply the principles of data minimization and purpose limitation, so that we only collect and process what is strictly necessary to provide our services, and only for the intended and consented purposes.

ISO/IEC 27001: the framework for data security

Despapeliza’s approach to personal data protection is structured within our Information Security Management System (ISMS), certified under ISO/IEC 27001, the leading global standard for managing information security risks.

As part of this system, we have implemented and continuously maintain ISO 27001 Annex A controls, including:

• A.9 Access control: role-based, least-privilege access with secure identity management.
• A.10 Cryptographic controls: encryption of data at rest and in transit using AES-256 and TLS 1.2 or higher.
• A.12 Operations security: server hardening, patch management and log auditing.
• A.13 Communications security: secure APIs, VPN tunnels and endpoint protection.
• A.18 Compliance: adherence to privacy laws and contractual data processing agreements.

Backed by Microsoft Azure: a secure, compliant cloud foundation

Our infrastructure is hosted entirely on Microsoft Azure, one of the most secure and most compliant cloud platforms in the world. Azure gives us a robust, enterprise-grade foundation to uphold our data protection commitments.

Some of its main advantages:

• Geo-redundant storage and automated backups, which ensure high availability and disaster recovery.
• Azure Defender and Security Center for real-time threat detection and risk scoring.
• Compliance with more than 100 global standards, including ISO/IEC 27001, SOC 2 and GDPR, among others.
• Virtual network isolation, private endpoints and Azure Key Vault for secure management of keys and credentials.
• Full support for data residency requirements: your information can be hosted in the appropriate region, in compliance with the applicable national legislation.

By combining our ISO 27001-certified practices with Azure’s native security and compliance controls, we deliver a resilient, auditable environment for processing personal data at scale.

Legal compliance and regulatory readiness

We actively comply with international and local privacy regulations, including:

• General Data Protection Regulation (GDPR, European Union).
• California Consumer Privacy Act (CCPA, United States).
• Law 19,628 on the Protection of Private Life (Chile).
• Data protection obligations specific to certain sectors or customers, where applicable.

We maintain up-to-date data processing agreements (DPAs) and enable data subjects to exercise their rights (access, rectification, erasure, objection and portability) through secure workflows.

Privacy by design and by default

From system architecture to the interface and user experience, our platform follows the principles of Privacy by Design:

• Privacy impact assessments (PIAs) for every new feature.
• Opt-out by default where applicable.
• Anonymization or pseudonymization techniques for analytics and internal processing.
• Minimal exposure of personal data during document workflows.

Monitoring, auditing and continuous improvement

Our ISMS includes a continuous improvement model based on:

• Regular internal audits and reviews of control effectiveness.
• Automated monitoring of Azure resources and data access logs.
• Penetration testing and ethical hacking carried out by third parties.
• A documented corrective and preventive action (CAPA) process for identified risks.

We use Drata to automate and monitor the performance of ISO 27001 controls in real time, which ensures that our personal data protection practices remain compliant, transparent and continuously improving.

Transparency and customer trust

Transparency is key in our relationship with our customers. That is why we make the following available:

• A publicly available Privacy Policy and Data Protection Addendum.
• Real-time compliance status through our Drata portal.
• Detailed documentation on how your information is processed, stored and protected.

At Despapeliza, personal data protection is built into every layer of our infrastructure and processes, from our code to our hosting provider. By combining ISO 27001-certified controls with Microsoft Azure’s advanced security architecture, we ensure that your data is always managed in a secure, auditable and compliant environment that you can trust.