Data Processing Agreement

For organisation accounts, your company is the data controller for its members' monitored addresses and request history. Intrudly is the processor, acting only on documented instructions from your account administrators.

Processing covers monitored email addresses, exposure matches, and the deletion requests sent on members' instructions, for as long as the organisation's subscription is active plus the retention period in our Privacy Policy.

Intrudly uses a small number of EU-hosted infrastructure and email-delivery sub-processors, each bound by equivalent data protection terms. A current list is available on request from [email protected], with 30 days' notice before any new sub-processor is added.

• Encryption in transit and at rest.
• EU-only hosting, with no transfers outside it.
• No access to members' mail accounts — monitoring runs only against the addresses they register.
• Access to production data limited to staff who need it for support.

When an organisation's subscription ends, Intrudly deletes or returns all personal data processed under this agreement within 30 days, except where retention is required by law.

Enterprise accounts come with a signed, full-form DPA covering audit rights, breach notification timelines, and liability terms.