Trust & security — Contwave

Vendor pack

Ready for due diligence

Prepared in advance — not scrambled together after a deal is on the table.

Data Processing Agreement + DORA addendumArticle 28 terms plus DORA Art. 30(2) ICT provisions for financial entities.

Append-only, immutable audit logEvery decision recorded — what was checked, when, by whom.

AI-content disclosure (EU AI Act)Synthetic media marked per Article 50, platform-native where supported.

Brand-level data isolationEach brand's data isolated at the organization level.

Sub-processors fully disclosedThe full list and their regions, documented — with signed DPAs down the chain.

EU data residencyData hosted in the EU.

Your data

Contwave acts as your processor — on your instructions, for your purposes only.

GDPR

For your leads and audiences, you are the controller (GDPR Art. 28). We process on documented instructions.

Your data is never used to train or improve models — enforced down the sub-processor chain.

CHAIN

The full sub-processor list and their regions are documented and available on request.

The documents

Before you ever talk to sales.

Service, obligations, liability, governing law.

How we process data as controller, GDPR rights.

Article 28 processing terms, no AI-training.

Article 30(2) provisions for financial entities.

These documents are maintained by Plenvar Labs SRL and provided for transparency and procurement review.

A signed DPA, the sub-processor list, or a security questionnaire — just ask.