DPA
Data Processing Addendum
How RequestFlow expects to handle customer and client data when a firm uses the product to collect documents.
Last updated: June 9, 2026
What this page covers
This page summarizes RequestFlow's data processing terms for launch. A paid account may receive a fuller DPA or customer agreement that controls if it conflicts with this summary.
Roles
For client documents and request data, the firm decides what to collect, from whom, and why. RequestFlow processes that data to provide the document collection service.
- The firm is responsible for client relationships, consent, professional obligations, and records-retention decisions.
- RequestFlow provides the request, upload, storage, scan, status, reminder, audit, and export tools.
- RequestFlow does not provide accounting, tax, payroll, legal, security, or compliance advice.
Processing activities
RequestFlow processes data to create requests, send client links, receive uploads, scan files, show item status, send reminders, support exports, process billing, and maintain security records.
- Uploaded files are stored privately and held behind server-side authorization.
- Request details, upload receipts, audit events, scan results, and export records support the product experience.
- Email delivery providers may process recipient and message details needed to deliver request links, reminders, and invites.
Service providers
RequestFlow uses a limited set of service provider categories for hosting, storage, email, billing, reliability monitoring, and optional export features.
- The current provider category summary is available at /subprocessors/.
- Google Drive export is a disabled-by-default feature and applies only when that export path is enabled.
- Material provider-category changes will be reflected on the public provider page.
Security measures
RequestFlow's launch security model includes HTTPS, private storage, firm-level data isolation, firm MFA, no-login client links with optional PINs, malware scanning before download, audit logs, retention rules, and support access grants.
- Raw link secrets, PINs, session secrets, connection tokens, secure file links, and file contents must not be logged.
- Files enter quarantine and must scan clean before staff download.
- Support access is disabled by default and requires an audited firm grant.
Return and deletion
RequestFlow supports export and deletion paths so firms can move or remove data according to their customer agreement and retention obligations.
- Generated ZIP exports expire after 24 hours.
- Organization deletion hard-deletes active data within 30 days, with backup expiration no later than 35 days.
- Billing records may be retained separately where accounting or legal obligations require it.
Questions before launch?
Tell us what your firm needs to know before launch, and we will follow up with the right privacy, terms, or security details.