# Data Processing Agreement (DPA) — FluxeHRa E-Sign only

**Edition:** E-Sign only (lighter product — document e-signature without Full HR modules)  
**Status:** Template for customer legal review (not legal advice). Customize with counsel before signature.  
**Version:** 2.0 — October 2026

**FluxeHRa** is a registered brand of **Foil Envie SAS**.

This DPA governs processing for the **E-Sign only** product edition (`product_edition = esign_only`): native Fluxehra e-signature (and optional DocuSign) for PDFs including employment/HR-related contracts, **without** activating the Full HRIS module set.

**No medical / health data.** FluxeHRa does **not** process medical or occupational-health dossiers. Customers must **not** upload clinical records, medical certificates content intended as health data, or other data requiring French **HDS** (Hébergeur de Données de Santé) hosting. Standard EU hosting (Supabase Ireland / Vercel Dublin) applies; **HDS certification is not required** for this product scope and is **not** claimed.

---

## 1. Definitions

GDPR meanings apply. “E-Sign only edition” means the tenant mode that masks Full HR menus and limits the Service to e-signature operations, org setup subsets (SMTP, document senders, templates, audit), and related dashboards.

---

## 2. Scope and subject matter

1. **Subject matter:** Sending, routing, signing, sealing, storing, and downloading PDF envelopes; company signatory registry; evidence certificates; reminders/expiry.
2. **Nature and purpose:** Operate Fluxehra e-signature (**eIDAS SES**, optional **PAdES-B** integrity seal) and/or DocuSign when the Controller selects that engine.
3. **Data subjects:** signers (employees, company signatories, external recipients), Document Senders, org admins.
4. **Typical data:** names, emails, job titles, PDF contents the Controller chooses to upload (may include HR contracts), signature images, IP/UA, consent text snapshot, SHA-256 digests, optional PAdES thumbprint.
5. **Not included:** Core HR employee master data lifecycle, Performance, Learning, Compensation modules, payroll exports, employee self-service HR dossiers as in Full HR.

**Still allowed:** PDFs of an HR nature (e.g. employment contracts) as **documents to sign** — without turning the tenant into a Full HRIS.

---

## 3–4. Instructions & security

Processing only on Controller Instructions (envelopes, templates, SMTP). Security measures: RLS, private Storage under `org/{orgId}/esign/…`, hashed signing/download tokens and OTP, rate-limited public `/sign/` APIs, audit events, optional PAdES-B (`ESIGN_PADES_*`), DocuSign HMAC when used. MFA may apply to privileged roles.

---

## 5. Sub-processing

Same platform sub-processors as Full HR for hosting/SIEM (Supabase, Vercel, Axiom, optional Turnstile/Analytics/Sentry). Native Fluxehra e-signature is **not** a separate sub-processor. DocuSign only if the Controller enables that engine.

| Sub-processor | Purpose | Region / notes |
|---|---|---|
| Supabase | Database, Auth, Storage, Realtime | `eu-west-1` (Ireland) |
| Vercel | Next.js application & APIs | `dub1` (Dublin) |
| Axiom | Security SIEM telemetry (`SECURITY_EVENT` — no HR business payloads) | US East edge |
| Cloudflare Turnstile (optional) | Bot protection on selected auth flows | Cloudflare routing |
| Vercel Analytics / Speed Insights (optional) | Aggregated performance | `dub1` |
| Sentry (optional) | Technical error monitoring if configured | Depends on DSN |
| DocuSign Connect (optional) | Third-party e-signature when org chooses DocuSign instead of native Fluxehra e-signature | Customer DocuSign account |
| Customer SMTP / IdP / SFTP / webhooks | Customer-configured integrations | Customer region |

---

## 6–8. Transfers, breach, audit

EU/EEA primary hosting; breach notification without undue delay; reasonable compliance documentation on request.

---

## 9–12. Return/deletion, term, liability

On end of Service, delete/return envelopes and related Personal Data per Controller Instructions and product tooling. Term follows subscription. Liability follows master agreement.

**Note:** E-Sign only does not expose the Full HR DSAR employee-dossier tooling; Controller remains responsible for rights requests regarding signed PDFs it retains.

---

## 13. Governing law

Laws of **France**; **courts of Lyon, France**.

---

## Annex A — Processing details (E-Sign only)

1. Envelope metadata, recipient emails/names, PDF bytes, signature artefacts, evidence packs.
2. No medical data; no HDS claim.
3. Legal level of native engine: **SES** or **SES+PAdES-B** — not AES/QES/QTSP (`docs/esign-standards.md`).

---

## Contact & company

**Foil Envie SAS** — 8 rue Sylvestre, 69100 Lyon, France — RCS Lyon 949 663 124 — SIRET 94966312400012 — VAT FR56949663124 — contact@fluxehra.ai

Controller: ____________________________  Date: ___________  
Processor: Foil Envie SAS (FluxeHRa) _____________________________  Date: ___________