GDPR Art. 28 · SaaS

AVVault

Create, manage and track data processing agreements in a portal that involves both contracting parties, instead of chasing DPAs as PDF attachments through email folders.

Arrange a call

DPAs are mandatory, yet managing them is often still Excel plus email

Anyone who has third parties process personal data on their behalf (hosting, CRM, newsletter tool, payroll) needs a data processing agreement (DPA) under Art. 28 GDPR. Not every transfer of data is processing on behalf of a controller: if two parties jointly decide on purpose and means, they need an arrangement on joint controllership (Art. 26 GDPR), and anyone who processes data as an independent controller, such as a tax adviser or a bank, does not conclude a DPA but regulates the transfer on another basis. Whether a DPA is needed therefore depends on the roles in each individual case. In practice that means dozens to hundreds of DPAs, scattered across mailboxes and folder structures, with expiry dates nobody monitors systematically, and providers who send out new DPA versions by circular email while the old version still counts as “the valid one” somewhere.

AVVault maps this process as a portal that includes both sides: the client and the contractor each get their own view of the same agreement, connected through magic links instead of conventional login details. Anyone who receives a link from their service provider lands directly in the right context, without registering anywhere first. That turns every DPA sent out into an entry point for the other side. This viral effect was part of the concept from the start.

The target group is mainly companies with many data processing relationships (agencies, SaaS providers, mid-sized companies with a larger portfolio of service providers) and their contractors, who in turn have to pass DPAs on to their own sub-processors.

Core functions

  • Create, manage and version DPAs, with industry templates
  • Two-way portal: client and contractor see the same agreement from their own perspective
  • AI-assisted DPA analysis with a risk score, checking TOMs (technical and organisational measures), sub-processors and third-country transfers
  • Automatic expiry and compliance monitoring instead of a manual deadline list
  • Multilingual (DE/EN/FR/ES/IT/NL), EU hosting (Hetzner, Germany)