Procys

GDPR overview

GDPR compliance is claimed explicitly and backed by documents rather than slogans. The security page presents Procys as GDPR-compliant, ISO 27001-certified and NIS2-ready, while the privacy policy, last updated on 3 December 2025, separates the roles precisely: controller for website, account and marketing data, processor for documents handled on a customer's behalf. A data processing agreement dated 9 December 2025 is published rather than merely offered, and grants an annual audit right on sixty days' notice. Rights under Articles 15 to 22 are enumerated and exercised through privacy@procys.com, with a one-month response window extendable by two. Transfers outside the EEA rely on standard contractual clauses. Two gaps remain: the subprocessor list is available on request only, and no Article 27 representative or data protection officer is named.

Who owns the data?

Procys defines Customer Data broadly in its terms: everything you upload plus the values its engine automatically extracts from those files. The data protection agreement then casts the customer as data controller and Procys as processor acting solely on documented instructions, which is the expected shape for a business document tool. What the site never does, however, is state in plain words that the customer owns its documents or the extracted output. Intellectual property in the platform and the API remains with Procys, and the licence granted is limited, non-transferable and revocable. Ownership of the data itself is implied by the processor role rather than declared outright.

Reuse rights

Extracted values come back to the customer through the interface, the API or a connected ERP, and nothing in the terms restricts what the customer then does with them: the processor arrangement means Procys acts on the customer's instructions, not the reverse. On its own side, Procys states that it does not sell, rent or trade personal data, and that AI models are isolated per customer to limit leakage between accounts. The gap worth naming concerns training. The self-learning engine openly improves from every document it processes, yet no page explains whether that learning ever leaves the customer's own model, and no opt-out mechanism is documented anywhere on the site.

Data retention & training

Hosting summary

Procys states that its platform runs on Google Cloud Platform, and that EU customer data, including e-invoices, is hosted there to satisfy European data residency requirements; financial documents are said to stay in Europe. No specific country or cloud region is ever named, so the commitment stops at continental level. The homepage muddies the picture slightly by mentioning that data is secured on AWS and Google Cloud storage, a reference to AWS that the dedicated security page does not repeat. The data protection agreement is broader still: it permits processing wherever Procys, its affiliates or its subprocessors operate, with standard contractual clauses, encryption, pseudonymisation and vendor assessments as safeguards for transfers outside the EEA. Encryption is AES-256 at rest and TLS 1.2 or above in transit. In short, European residency is claimed for customer data and is plausible, but it reads as a marketing statement rather than a contractual location commitment, and the contract itself reserves worldwide processing rights.