For your own business, or as a service you charge other businesses like yours for.
Nobody runs this lab yet. Take it, give it your hours and your prices, and it is yours.
Vendors, hosting regions, data categories, retention periods. Pasted, not connected.
The document buyers ask for first, with processing regions and the change notification regime.
The fields that repeat from one questionnaire to the next, answered once, versioned, reusable as is.
NotionThe message sent to customers when a subprocessor changes, before they find out themselves.
GmailThe security questionnaire always lands at the same moment: right as the deal is about to close. That is the worst time to improvise, and it is exactly what a three-person team with no answer library does. The problem is not knowing the answers, it is that eighty percent of the fields repeat from one questionnaire to the next and get rewritten every time, differently. The inconsistencies that follow look worse than the gaps themselves. What buyers actually ask for is a short, stable list of documents: a subprocessor list with processing regions, a data processing agreement, a filled questionnaire, a pen test summary, a change log, and increasingly a note on AI usage. None of that is a certification, and that is precisely what makes it doable.
Worth more in month six than in week one.
The collections belong to the lab, not to any single magik. Every magik reads them and every run adds to them, which is why this lab is worth more in month six than in week one.
They all start empty. The first run writes the first row.
It wears your name, not ours.
The same lab, under your name, your colours and your logo. Your customers never see ours.
AskMOJOOn the Pro plan, and not needed to take a lab. A fully bespoke theme exists as an upgrade, hand built rather than self-serve.
NotionGmailAnd whatever you already use: any tool available through an API or an MCP server, connected with your own account.
A tool built for exactly your job, and only that, will go deeper at that one job. This is for the jobs nothing covers, or the ones spread across three tools today.
No, and that has to be said before the first line. This pack prepares no audit and replaces no certificate. It sits deliberately below that tier: it lets a two-person team answer fast and without contradicting itself. Claiming otherwise would cost the one thing that makes this credible.
None. This is commercial pressure, not regulation: nobody fines you for a slow questionnaire, your buyer simply goes elsewhere or lets it drag. Speed of response signals seriousness more reliably than the answers themselves, and that is a founder observation, not a rule.
Because it is the one document that changes without warning. Every new vendor, every model swap, every AI feature shipped invalidates it. Buyers explicitly ask to be notified of changes, which is why the change log is an output of this lab and not a footnote.
Three things, and they are the three people forget: retention periods, the subprocessors actually called, and what your vendor contract says about training. Answering no on training without citing the clause convinces nobody now, and a buyer who has read ten answers knows it.
They exist, and several are cited by founders for monitoring subprocessor changes or hosting a public page. This page does not compare their prices, because we have not verified them. What can be said safely: the document pack exists before the tool, and most teams start by not having one.
A tool built for exactly two to ten person saas teams selling upmarket, and only that, will go deeper at that one job. This lab is for the jobs no tool covers, or the ones spread across three tools today, and it runs under your name.
Every audience is still open.
Nobody has taken a square on this idea yet. You declare your audience when you take the lab (“roofers in Brittany”, “plumbers around Paris”), and two people can start from the same idea on two different audiences without getting in each other’s way.
And it wears your name, not ours.
The bundle describes a lab that does not exist yet : the jobs it would do, and an example of each output.
Open Knowledge Format : plain markdown, re-importable into any agent. No account, no lock-in.
You hear about a competitor's price change from your lab, not from a customer asking why you cost more.
Web search
Firecrawl
ExaGive it five things you wrote. Everything it writes after that sounds like you, instead of sounding like a chatbot.
What the AI Act actually asks of you, in plain words, taken from the text and not from a consultant's slide.
Web searchFirecrawl| Vendor | Role | Region | Retention |
|---|---|---|---|
| Primary host | Database, files | EU, Ireland | Contract term + 30 d |
| Model vendor | Text generation | United States | Zero retention, contractual clause |
| Email delivery | Transactional | United States | 90 days of logs |
| Customer support | Conversations | EU, Germany | 24 months |
Two of the four vendors process outside the EU. Not a problem in itself, it is the line the buyer looks for first, and not having written it costs two round trips.
Subprocessors - version of 14 August 2026
This page lists the third parties that process our customers' data, what they process and where.
| SubprocessorSubprocessor | Data processedData processed | RegionRegion | SinceSince |
|---|---|---|---|
| Primary host | Customer content, backups | Ireland | 2024 |
| Model vendor | Text submitted for generation | United States | 2025 |
| Email delivery | Address, transactional content | United States | 2024 |
| Customer support | Support conversations | Germany | 2026 |
Change notification
Any addition or replacement is published here and emailed to account administrators thirty days before it goes live. A customer may object during that window, and an objection opens a conversation, not an automatic refusal.
Model training
No customer data is used to train a model. That statement rests on clause 7.2 of our contract with the model vendor, an extract of which is available on request. We would rather cite the clause than repeat the sentence.
What this page is not
It is not a certification, an audit, or a standalone contractual commitment. The data processing agreement signed with each customer remains the binding document.
| Field | Seen in | Answer | Reviewed |
|---|---|---|---|
| Encryption at rest | 9 questionnaires out of 9 | Stable since 2024 | 08/2026 |
| Two-factor authentication enforced | 9 of 9 | Stable | 08/2026 |
| Annual penetration test | 7 of 9 | Dated summary, last one 03/2026 | 08/2026 |
| AI usage and training | 5 of 9, rising | Rewritten 06/2026 | 08/2026 |
The last row is the only moving one, and it went from zero to five questionnaires out of nine in a year. That is the one to re-read before each send; the other three copy across as is.
Hello, Change notification under our data processing agreement, with thirty days notice. What changes: our customer support tool moves from a US-hosted vendor to a Germany-hosted one, effective 15 September 2026. Data concerned: support conversations, meaning the messages your users send us and our replies. No content produced inside the application is affected. What it changes for you: the processing region for those conversations moves from the United States to the European Union. Retention stays at 24 months. Existing history is migrated, not duplicated. If this change is a problem for you, reply to this message before 14 September. An objection opens a conversation, it triggers nothing automatic on our side. The current subprocessor list is published on our public page, and the change log is kept there. Regards, The team