DocMark

DPA explainer

What the client-cloud data-processing arrangement covers, what 'bring your own LLM' means, and the questions to bring to your provider.

This covers data processing in Client cloud (Mode 2), where DocMark runs in your cloud tenant and authoring uses your own LLM subscription. On-prem (Mode 1) runs no AI and no external processing by default (an operator can enable AI engines; see security); DocMark cloud (Mode 3) is governed by our privacy policy and terms.

What “bring your own LLM” means

In Client cloud, the model that authors or researches content runs under your own account with the LLM provider you bring — Anthropic (Claude) today; support for other providers (OpenAI, Azure OpenAI, Google Gemini) is on the roadmap. Your key, your contract, your data terms. DocMark publishes recommended options but is not in the data path: content flows from DocMark-in-your-tenant directly to your LLM account and back, inside your own boundary.

What the data-processing arrangement covers

  • Who processes what. Your LLM provider processes the prompt/content you send for authoring or research. DocMark (the software) orchestrates and renders inside your tenant. DocMark the company does not receive your content in this mode.
  • One governed call. Authoring is a single call with a capped output-token budget to your LLM account (the optional agentic engine runs a multi-step session with no per-job spend cap), under that provider’s enterprise data terms — which you set in your contract with them.
  • Provenance. Researched facts come back with cited sources, and the deliverable records the brand-specification version that produced it.

Questions to bring to your LLM provider

When you scope your own LLM account for this, confirm with the provider:

  1. Training — is our data excluded from model training? (Enterprise terms usually exclude it — get it in writing.)
  2. Retention — how long is prompt/response data retained, and is zero-retention available?
  3. Region — can processing be pinned to a specific region or jurisdiction?
  4. Sub-processors — who else touches the data, and under what terms?
  5. Access & audit — what logging and audit visibility do you get?

DocMark’s role is to make these answers yours to set: the AI runs under your account, so your enterprise agreement with the provider governs the data — not us.

Last updated: 26 June 2026.