Vesence procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ 9.2 In the event that Vesence is in breach of its obligations under the DPA, Vesence must remedy the deficiency within thirty (30) days of Vesence being notified of the breach, or within the time period agreed between the Parties. If Vesence fails to remedy a material deficiency within the agreed time period, Customer has the right to terminate the subscription of the Services (and thereby the Agreement) with immediate effect or the longer period of notice notified by Customer.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Personal data processing is performed exclusively within the EU/EEA.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ In the performance of the Agreement, Vesence will process personal data on behalf of Customer, as data processor. The Parties have entered into a data processing agreement to regulate such processing, forming part of the Agreement as Appendix 3.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Vesence shall process personal data in accordance with the provisions of the Agreement, including the Security Requirements in Appendix 4 .” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ " Standard Contractual Clauses " or sometimes also referred to as the "EU Model Clauses" means the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, based on the Commission Decision (EU) 2021/914 of 4th June 2021. The terms "controller", "processor", "data subject", "processing", "personal data", and "personal data breach", shall have the same meanings as set out in article 4 of the GDPR.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 1.2 By executing an Order Form that references this DPA, the Customer agrees to the terms and conditions set out herein and that this DPA shall form an integrated part of the Agreement.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Vesence shall upon the Customer's request, make all necessary information available to demonstrate compliance hereof and allow for audits, including inspections, to be performed by the Customer (or an independent third-party auditor mandated by the Customer that is reasonably acceptable to Vesence and subject to signature of a confidentiality agreement with Vesence) of Vesence relevant to the personal data processed under this DPA.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 1.4 The Customer acknowledges that Vesence, in its capacity as an EU-based processor of personal data, is required to enter into data processing agreements with data controllers on whose behalf Vesence processes personal data within the provision of the Services. Thus, the provision in this DPA applies between the Parties even if the GDPR is not applicable to the Customer.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Version 1.3.0 · Effective 21 August 2026 This Data Processing Agreement forms part of the Vesence agreement together with the applicable Order Form, the General Terms and Conditions , the Service Description , and Vesence's Security Requirements . The current list of sub-processors engaged under this DPA is published at vesence.com/subprocessors .” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (c) Vesence shall destroy all Customer Data held by Vesence within six (6) months.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ 9.1 The DPA is effective from the effective date of the Agreement or, where this DPA is entered into on a standalone basis, from the date on which the Parties sign or otherwise agree to this DPA, and in each case for as long as Vesence processes personal data on Customer's behalf.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Considering the nature and purpose of the personal data processing, i.e., that each processing is instantaneous, no personal data is stored, resulting in no retention beyond the ongoing deletion performed within the Services, except for personal data included in prompts in so-called "agents" created by the Customer (only applicable to the Vesence Web Application), which will be retained until deleted by the Customer. However, the Customer may choose to activate Cloud agents, as made available to the Customer in the Vesence Web Application, in order to store conversation information and uploaded files between sessions. This functionality is optional and not activated by default, unless actively chosen by the Customer. The Customer may at any time choose to deactivate Cloud agents. If activated by the Customer, conversation information and uploaded files are retained for later sessions until (i) deleted by the Customer, (ii) the Customer deactivates Cloud agents, (iii) ceases to use the Services, or (iv) requests that such data is removed. The data is stored in Vesence's Microsoft Azure environment. Unless otherwise explicitly stated, the terms and conditions of the Agreement apply in relation to Cloud agents, including in relation to non-use of data to train AI models and tenant isolation. Notwithstanding the foregoing, where Usage-Based Pricing is enabled for the Customer, personal data necessary to display Vesence Credit consumption will be retained for the duration of the Agreement or until Customer requests it to be deleted.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (b) Vesence shall, upon Customer's request, provide Customer copies of Customer Data stored in Vesence Systems; and” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (a) Customer shall destroy any and all Vesence Data held by Customer;” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ 9.3 When the Agreement expires or terminates, Vesence shall, based on Customer's instructions, delete or return to Customer, in a manner acceptable to Customer, all personal data, and delete existing copies unless storage of personal data is required pursuant to European Union law or the Member State's national law. Vesence undertakes to actively seek instructions from Customer without delay.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 7.2 Subject to section 7.3 below, the Customer hereby gives its general written consent and authorization to Vesence to use Sub-processors for the processing of personal data solely for the purposes set forth in this DPA. The current list of Vesence Sub-processors is available at https://www.vesence.com/subprocessors (" Sub-processor List "). Vesence will keep the Customer informed of any new appointments or replacement by updating the Sub-processor List before authorizing any new Sub-processor(s) to process personal data in connection with the provision of the Services. In order for the Customer to receive notifications of updates to the list of sub processors, the Customer shall use a URL tracking service. Certain Sub-processors are optional for the Customer as indicated in the Sub-processor List where personnel with administrative privileges can chooses between AI model providers.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 7.1 Vesence may delegate the processing of personal data to a Sub-processor. Vesence shall ensure that it has concluded a data processing agreement with such Sub-processor on terms equivalent to and not less restrictive than the provisions in this DPA. Where a Sub-processor fails to fulfil its data protection obligations, Vesence shall remain liable for the performance of such Sub-processor's obligations.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 7.3 The Customer may object to Vesence's use of a new Sub-processor by notifying Vesence in writing within ten (10) business days from when the Sub-processor List was updated. In the event that the Customer objects to a new Sub-processor, Vesence will use commercially reasonable efforts to provide the Services without engaging the Sub-processor subject to the objection. If such a work-around is not possible, the Customer shall be entitled to terminate the subscription of the relevant Vesence Service. In the event of such termination, the Customer shall not be entitled to any refund of any fees paid to Vesence within the scope of the Agreement.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 8.2 Notwithstanding section 8.1, the Parties shall always have the right to share necessary information on a need-to-know basis with their affiliates, sub-contractors, external advisers, potential investors and any external consultants who they may engage, regardless of the function and the conditions under which they are engaged by such a Party. This is provided that the Party disclosing such information has ensured that the parties receiving such information are bound by confidentiality undertakings materially equivalent to those set out in this section 8. For the avoidance of doubt, the confidentiality undertaking shall not limit Vesence's right to identify Customer as a customer of Vesence and use Customer's name, pursuant to Section 6.4.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 14.3.2 Vesence may use subcontractors for the performance of its obligations under the Agreement. Vesence is fully responsible and liable for all acts (including omissions) of its subcontractors and shall cause each of its subcontractors to comply with all applicable obligations, terms and conditions of the Agreement.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 1.4 If the Order Form states that the Services are provided as a Pilot, the Agreement shall apply with the deviations set out in Section 13, which, for the avoidance of doubt, shall take precedence over other terms of the Agreement in the event of inconsistency.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 13.1 If the Services are provided as a Pilot, what is set out in this Section 13 applies.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 13.2 The Pilot is provided for the limited evaluation period set out in the Order Form and will thereafter automatically expire. This notwithstanding, each Party is entitled to terminate the Pilot prior thereto without cause by providing three (3) days' written notice. If the Parties, during the term of a Pilot, enter into a new Order Form for the regular provision of the Services (i.e. not for evaluation purposes), the Pilot will automatically terminate at that date.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 13.3 In deviation of Section 3, Vesence will provide the Pilot Services at its sole discretion, solely on an as-is basis and without any warranties whatsoever. Customer acknowledges and accepts that (i) Customer may not be provided with the full Services functionality as set out in the service descriptions, (ii) no service levels apply, (iii) Vesence, without prior notice, may change, delete, or add Services functionality (iv) Vesence, without prior notice and without cause, may restrict or terminate Customer's access to the Services, and (v) Vesence does not warrant that the Services are free from Defects or that it will remedy any identified Defects.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 13.4 Unless otherwise set out in the Order Form, the Pilot is provided free of charge. Vesence may at its sole discretion restrict how many Customer users that can access the Services and/or how much Customer can use the Services.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.