Privacy & Data Handling

This guide explains the product controls that affect data handling. It is technical documentation, not a substitute for the Privacy Notice or Data Processing Addendum. Cloudlayer’s Subprocessor List identifies providers, data categories, roles, and processing locations. The Security page records the security posture without claiming an unverified certification.

Roles and responsibility

Cloudlayer acts as a processor or service provider when it handles content for your configured workflow. You decide what to capture, upload, collect, generate, sign, deliver, and retain, and you remain responsible for the notices, rights, permissions, lawful basis, and data minimization that your use requires.

Cloudlayer separately acts as controller for account administration, billing, security, support, and its own website and service operations. The Privacy Notice explains that distinction and how a person can exercise a privacy right.

Data paths

A Cloudlayer workflow can involve several data classes:

Data	Examples	Control point
Source content	HTML, CSS, a URL, cookies, headers, template variables, uploaded files, or imported documents	Send only content you are authorized to use; avoid unnecessary personal data and secrets
Workflow records	Job state, artifact references, form definitions, submissions, signature events, delivery attempts, audit events, and errors	Workspace roles, tenant scope, retention, export, deletion, and audit controls
Output	PDF, image, video, captured page, completed form document, or signed record	Cloudlayer storage, customer storage, synchronous return, recipient delivery, and configured expiry
Destinations	Customer S3-compatible storage, Google Cloud Storage, webhook, email recipient, or integration	You choose the provider, account, endpoint, region, permissions, and transfer basis
AI input and output	Prompt, selected source content, instructions, suggestion, and feedback	An AI feature sends only the selected material to the disclosed model provider; review all output

Customer-directed storage and webhooks are not Cloudlayer-appointed subprocessors. They receive data only after you configure the destination. Test destination permissions with non-sensitive data before using it in production.

Storage choices

Choose a storage mode according to the workflow and your retention obligations.

Mode	Behavior	Use when
Cloudlayer-managed storage	Stores the artifact under the workspace’s access and retention controls	The artifact must remain available in Cloudlayer for download, delivery, audit, or later workflow steps
Customer-directed storage	Sends the artifact to a configured storage provider and region	Your organization manages the destination, lifecycle, access, and residency decision
Secure or zero-retention mode	Returns or delivers the result without making it a Cloudlayer-durable artifact; bounded operational records and temporary processing can still exist	The workflow does not need a retained Cloudlayer artifact and the selected API path supports the mode

For a synchronous request that supports it, storage: false asks Cloudlayer not to retain the generated output as a managed asset:

{
  "async": false,
  "storage": false
}

This setting does not mean that no data is processed. Cloudlayer still has to admit, secure, render, meter, and return the job. Bounded job, security, audit, billing, failure, and legal records can remain under their own retention rules. Temporary payloads remain only through the processing and recovery horizon and are then removed.

For a customer-directed destination, reference the saved configuration rather than sending storage credentials in each job:

{
  "storage": {
    "id": "your-storage-config-id"
  }
}

The storage adapter supports S3-compatible destinations and Google Cloud Storage where configured. Availability and limits follow your plan and order. A custom endpoint must pass the same destination, network, timeout, and secret-redaction checks as a named provider.

Synchronous and asynchronous processing

Synchronous work holds the request open until the result or terminal error is returned. Asynchronous work records an accepted job, processes it through the queue, and exposes status and delivery results. Retries use the same logical job and artifact identity so a retry does not create an additional billed result.

Both paths can create operational metadata. Output storage is a separate choice from job history, audit evidence, billing records, and security logs. A webhook receives only the bounded completion or failure contract sent to the endpoint you configured.

Secrets and capture credentials

URLs, proxy credentials, basic-auth values, cookies, headers, API keys, storage credentials, and webhook secrets require different handling from ordinary template variables.

Use saved encrypted configurations or secret controls where the product provides them.
Grant only the permissions and lifetime needed for the job or destination.
Do not place private keys or account passwords in HTML, template data, prompts, filenames, or support messages.
Rotate a credential after suspected disclosure and revoke the affected API key or destination.
Treat a webpage capture as access by your organization. Supplying a cookie or credential does not establish the legal right to use it.

Cloudlayer redacts secret fields from customer-visible history, errors, and application logs where those fields can appear. Cloudlayer does not promise that arbitrary personal data embedded in free text can always be recognized. Do not include a secret in an unrestricted text field.

Access and tenant controls

Data belongs to an account, organization, or workspace scope. Membership and role checks apply to templates, forms, submissions, contacts, artifacts, storage configurations, signatures, workflows, and audit history. Creator attribution does not replace tenant authorization.

Use separate API keys for separate systems and environments. Give service identities the minimum workspace and operation scope. Remove members and revoke keys when access is no longer required. Public forms, recipient links, and signing sessions use purpose-bound access rather than exposing a workspace credential.

Forms and signatures

A form owner controls questions, prefills, attachments, respondents, consent text, and retention. Collect only what the stated workflow needs. Do not put confidential values in a prefilled URL. Use authentication and save/resume controls that fit the sensitivity of the response.

Signature event history records the actions needed for workflow and audit evidence. That evidence does not decide whether a document or authentication method satisfies the law for a particular transaction. The Terms of Service explain the customer’s responsibility for electronic consent, signer authority, record delivery, and transaction-specific formalities.

AI features

An AI feature sends the prompt and source material selected for that operation to the model provider identified in the Subprocessor List. Do not submit sensitive or regulated data unless the feature and your order expressly permit it. Check facts, calculations, rights, bias, accessibility, and legal or technical requirements before using the output. See the AI Additional Terms.

Retention, export, and deletion

Retention depends on the data class, selected storage mode, workspace policy, plan, legal hold, and configured workflow. Product controls expose expiry, deletion, trash or recovery, and export where applicable. Customer-directed output follows the destination’s policy after delivery.

Account cancellation stops renewal but does not silently destroy Customer Data. Account deletion, workspace deletion, individual resource deletion, and retention expiry are distinct operations. Some billing, security, consent, dispute, backup, and audit records can remain for a limited legal or recovery purpose with use restricted to that purpose.

Plan your lifecycle before collecting data:

classify the source, respondent, signer, and output data;
select the minimum storage and history needed;
configure workspace access and customer destinations;
test export, deletion, destination failure, and credential rotation; and
document how your organization answers access, correction, deletion, and objection requests.

Regulated data

Cloudlayer is not enabled for protected health information or electronic protected health information. Do not send PHI or ePHI unless Cloudlayer has approved an eligible service scope in writing and both parties have executed the required business associate agreement.

Do not send payment-card data through templates, forms, captures, or ordinary API fields. Payment entry belongs in Stripe-hosted controls. Other sensitive data requires the relevant product support, contract, legal basis, and safeguards.