Data processing summary

# Abrams Patch Assist — data processing summary

**Controller (client systems):** the client organisation.  
**Processor (engagement tooling):** Abrams Grp LLP, for portal account data and credentials you submit for the engagement.

## What we process

- Business contact email and name for portal login and engagement status
- Site URLs, hosting type, and time-boxed access materials you submit
- Stripe payment identifiers (no full card numbers stored by Abrams)
- Audit events (who accessed, when, action class)

## How we protect credentials

Access secrets are encrypted at rest (AES-256-GCM). They are not emailed in plaintext and are not written into Business Functions hub files or Core Governance. Grants expire automatically; you can revoke early.

## Retention

Engagement metadata and audit logs are retained for operational and accounting needs. Encrypted credentials are deleted or irreversibly revoked when access is revoked or the engagement closes.

## Subprocessors

Hosting for the portal (Abrams-operated infrastructure) and Stripe (payments). Details available on request at info@abramsgrp.com.

Back