Roles and instructions
The signed agreement must identify controller and processor roles for each dataset and limit processing to documented instructions.
Legal
Data Processing Framework
The minimum framework that must be converted into a signed DPA before production customer data is processed.
Last updated 18 August 2026
Required schedule
The DPA must state data categories, subjects, purposes, locations, subprocessors, retention, deletion, security measures and international-transfer safeguards.
Security and incidents
Access control, encryption, logging, vulnerability handling, backups, recovery and incident-notification duties must be measurable and evidenced.
Orchida boundary
The applicable Orchida entity, processing role, data location, retention and support obligations must be confirmed in writing. SolaBill will not invent or silently extend those terms.
Not a signed DPA
This public page is a transparency framework, not a contract. Production use requires a signed customer-specific DPA reviewed by qualified counsel.