> For the complete documentation index, see [llms.txt](https://docs.virusis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.virusis.com/legal/data-processing-agreement.md).

# Data Processing Notes

A one-line statement such as "always processor" or "always controller" is not sufficient for Virusis.

## General framing

In enterprise use, it is often the case that:

* the customer acts closer to a controller for the data it uploads
* Virusis acts closer to a service provider or processor in the scanning and technical processing layer

That distinction still needs to be clarified by use case and contract.

## Topics a DPA should define clearly

* which data types are processed
* retention periods
* subprocessors
* security measures
* incident notification timelines
* return and deletion flow

## Note

This page does not replace a signed DPA. It exists to connect the product's technical reality to contract preparation.