Skip to content

Ilyas is now Northmap. Same team, same product, new name. Why the new name

Northmap

Data Processing Agreement

Last updated: 30 September 2026

This Data Processing Agreement ("DPA") covers the personal data that Northmap SAS processes on behalf of its customers when they use Northmap. It applies automatically when a customer accepts our Terms of Service or signs an order form that refers to them. No separate signature is needed. If your organisation needs a countersigned copy, write to contact@northmap.ai.

The DPA consists of this Cover Page and the Common Paper DPA Standard Terms Version 1.1, which are incorporated by reference. If this Cover Page conflicts with the Standard Terms, this Cover Page controls. Capitalised words have the meanings given in the Cover Page or the Standard Terms.

Cover Page

Parties and agreement

  • Provider: Northmap SAS, a société par actions simplifiée with share capital of €10,000, registered under RCS Lyon 109 480 525, head office at 12 rue de la Part-Dieu, 69003 Lyon, France.
  • Customer: the company or person that accepted the Agreement.
  • Agreement: the Northmap Terms of Service, or any other agreement between Customer and Provider for the Cloud Service that refers to this DPA.
  • Service Name: Northmap, the software evaluation and IT portfolio decision platform available at app.ilyas.ai.

Subprocessors and security

  • Approved Subprocessors: the subprocessors in Provider's subprocessor list on the Effective Date of the Agreement, for the processing tasks described there. Provider sends the list to Customer on request at contact@northmap.ai.
  • Provider Security Contact: contact@northmap.ai, Northmap SAS, 12 rue de la Part-Dieu, 69003 Lyon, France.
  • Security Policy: Provider maintains the technical and organisational measures described in Annex II below. Provider is implementing an information security management system aligned with ISO/IEC 27001:2022, and shares its completed security questionnaire on request.

Legal terms

  • Changes to the Agreement: none.
  • DPA Liability Cap: the limitations of liability in the Agreement apply.
  • Governing Law and Chosen Courts: the same as the Agreement: the laws of France and the competent courts of Lyon, France.

International transfers

  • Governing Member State: France.
  • Data Exporter Role: Customer is a Controller (EEA SCCs Module Two), or a Processor acting on behalf of its own customers or affiliates (Module Three).
  • Data Importer Details: Northmap SAS, 12 rue de la Part-Dieu, 69003 Lyon, France, contact@northmap.ai. Role: Processor.

Provider is established in France and hosts Customer Personal Data in the European Union. A transfer from a customer in the European Economic Area or the United Kingdom to Provider is therefore not a Restricted Transfer. When a Subprocessor processes Customer Personal Data outside the European Economic Area, Provider relies on the EU–U.S. Data Privacy Framework where the Subprocessor is certified, or on the Standard Contractual Clauses between Provider and that Subprocessor.

Annex I: Description of processing

  • Categories of Data Subjects: Customer's authorised users; Customer's employees, contractors and stakeholders named in Customer Content; representatives of software vendors that Customer contacts through the Cloud Service.
  • Categories of Personal Data: identification and contact data (name, business email, job title, organisation); account and authentication data; usage and audit records (user identifier, actions, timestamps, IP address); and any personal data contained in Customer Content, such as documents, requirements, evaluations, meeting notes, vendor correspondence and chat messages.
  • Special Category Data: none. Customer will not submit special categories of personal data or data relating to criminal convictions.
  • Frequency of Transfer: continuous, for the duration of the Agreement.
  • Nature and Purpose of Processing: hosting and storage; search and retrieval; AI-assisted drafting, scoring, summarising and analysis; sending questions to vendors by email and receiving their replies; authentication; and support. Provider processes Customer Personal Data only to provide the Cloud Service under the Agreement and Customer's documented instructions. Provider does not use Customer Personal Data or Customer Content to train artificial intelligence models.
  • Duration of Processing: the term of the Agreement. Afterwards, Provider returns or deletes Customer Personal Data at Customer's instruction, as set out in Section 7.2 of the Standard Terms.

Annex II: Technical and organisational security measures

  • Hosting: Google Cloud in the European Union (Belgium). AI models run on Google Vertex AI in the same region.
  • Encryption: TLS for data in transit. Data at rest is encrypted by Google Cloud's default encryption (AES-256).
  • Tenant isolation: every record belongs to one customer organisation, and the database enforces this isolation.
  • Access control: multi-factor authentication is available to users, and role-based permissions apply inside each organisation. Provider staff access production through named accounts with multi-factor authentication and least privilege.
  • Secrets: application secrets are held in a managed secret store, never in source code.
  • Logging: audit records of user activity, sign-in events, data exports and AI requests.
  • Backups: automated backups of the production database.
  • Vulnerability management: security alerts are reviewed weekly. Critical vulnerabilities are fixed within 7 days and high ones within 30 days.
  • Secure development: automated checks before every release. Production data is not used in development or testing.
  • Incident response: Provider notifies Customer of a Security Incident without undue delay and no later than 72 hours after becoming aware of it.
  • AI: Customer Content is not used to train AI models, by Provider or, under Google Cloud's terms, by Google.