Coda

GDPR overview

GDPR compliance is documented rather than claimed. The trust centre lists the GDPR alongside CCPA and HIPAA, and a public Data Processing Addendum at coda.io/trust/dpa carries EU and UK standard contractual clauses, a security annex and a named sub-processor list. Article 27 representatives are appointed for the EEA (VeraSafe Ireland Ltd) and the UK (VeraSafe United Kingdom Ltd), and an external Data Protection Officer is designated: Bird and Bird DPO Services SRL in Brussels, at dpo.superhuman@twobirds.com. The company certifies under the EU-U.S. Data Privacy Framework with its UK extension and the Swiss-U.S. DPF, falling back on standard contractual clauses for other transfers. Access, rectification and erasure rights are described, French post-mortem data instructions are mentioned specifically, and an AI training control sits in the account settings. ISO 27001, 27017 and 27018, SOC 2 Type 2 and SOC 3 complete the picture; the privacy policy is dated 6 July 2026.

Who owns the data?

Under the Terms of Service in force since 29 October 2025, you own all right, title and interest in your User Content, and the inputs and outputs of the generative AI features count as your User Content too. In exchange you grant Superhuman a worldwide, non-exclusive, royalty-free licence to use, store, reproduce, publish, display, modify and create derivative works from it, strictly to operate the service. Superhuman keeps the intellectual property in the service, its documentation and usage data, and may use your feedback without compensation. Third-party Packs can access the content you pass to them, and business accounts are governed by the DPA and directed by the account administrator.

Reuse rights

You can reuse your own material freely: the terms let you export or delete your User Content at any time while the account exists, and because AI inputs and outputs are treated as your User Content, anything the assistant produces can be reused, published or adapted without asking for further permission. Two limits are worth knowing. First, the terms warn that other users writing similar prompts may receive identical or similar outputs, and those outputs are not yours. Second, you may not use the service to train competing foundation or language models. Publishing a doc as a public website is allowed but governed by a separate publishing policy, and Packs distributed on the marketplace fall under the Superhuman Developer Terms.

Data retention & training

Hosting summary

The Data Processing Addendum states that Superhuman may process customer personal data in the United States and in any other location where it or its sub-processors run processing operations. The security annex specifies that Docs is hosted on Amazon Web Services, with key management through AWS KMS and production data replicated across several AWS availability zones and into a second geographic region, which is not named. Encryption is TLS 1.2 or higher in transit and AES-256 at rest. Every third-party sub-processor on the published list is based in the United States, while internal subsidiaries also cover Germany, Poland, Ukraine and Canada. Transfers from the EEA, the United Kingdom and Switzerland rely on the Data Privacy Framework and, failing that, on standard contractual clauses. No European or regional hosting option is announced anywhere on the site. On availability, Enterprise customers get a 99.9% commitment, with daily and cross-region backups and recovery procedures tested at least once a year.