What the platform collects, why, who processes it and how to exercise your rights.
Effective September 2026
Evidra, located in Abuja, Nigeria, operates Evidra, an evidence first platform for RFPs, security questionnaires and due diligence questionnaires. In this policy "we" means Evidra and "you" means a person using the site or the product, or an organization that has an account.
Questions about this policy go to hello@evidra.xyz. Security questions go to security@evidra.xyz.
We collect only what the service needs to work.
Each kind of data is used for one purpose.
Where data protection law requires a legal basis, we rely on the contract with your organization for account, organization, customer and usage data; on our legitimate interest in running a secure service for technical data; and on your request for contact messages. Where consent is required, for example for product emails that are not about your account, we ask for it and you can withdraw it at any time.
The providers below process data for us under contracts that restrict them to that purpose. Changes to this list are published on the security page before they take effect.
Customer content is kept for as long as your organization keeps it. Deleting a document removes its chunks from your search index within minutes and deletes the file from storage. Deleting a questionnaire removes its questions, answers, evidence links, comments and activity. Closing an organization removes all of its data from the database, the index and file storage.
Account data is kept while the account exists and deleted when the account is closed, except where a law requires us to keep a record for longer. Server logs are kept for ninety days. Contact messages are kept until the conversation is closed and for twelve months after.
Authentication, the application database and uploaded files are held on Google Cloud in the European Union multi region. Vercel serves the site and runs the application from a global edge network. Where data leaves the region in which it was collected, we rely on the transfer mechanisms in our provider contracts.
Connections use TLS. Data at rest is encrypted by the storage providers. The browser never reads the database directly; every query runs on the server scoped to the organization, passages are indexed per organization, and roles are checked on the server for every action. The security page describes these practices in full and states plainly that no certification is held yet.
You can access, correct, export and delete the personal data we hold about you. Organization members do this through the product; anyone can email hello@evidra.xyz. Where the law gives you further rights, for example to object to processing or to complain to a supervisory authority, those rights are unaffected by this policy.
The service is for organizations and is not directed at anyone under eighteen. We do not knowingly collect data from children.
When this policy changes, the new version is published here with a new effective date, and organizations with an account are told by email before a material change takes effect.