Register of Processing Activities

Published under UK GDPR Article 30 — Last updated: 1 September 2026

Data Controller Details

Controller Name: AgentOS Proptech Group Ltd
Territory: United Kingdom
Data Protection Contact: privacy@agentos.com
Applicable Legislation: UK GDPR; Data Protection Act 2018

What is this document?

UK GDPR Article 30 requires organisations that process personal data to maintain a written record of all processing activities. This Register of Processing Activities (ROPA) documents each distinct processing activity carried out by AgentOS Proptech Group Ltd, including its purpose, legal basis, data categories involved, data subjects affected, recipients, retention periods, international transfer mechanisms, and security measures applied. This document is reviewed and updated whenever a new processing activity is introduced or an existing one materially changes.

Personal Data Breach Notification Procedure (UK GDPR Art. 33)

AgentOS Proptech Group Ltd operates a documented incident response procedure in compliance with UK GDPR Article 33. In the event of a personal data breach likely to result in risk to individuals, we will notify the ICO within 72 hours of detection. Our breach detection sources, severity classification matrix, DPO escalation procedure, 72-hour ICO notification decision tree, and affected-user notification template are documented in our Incident Response Runbook, which is available on request at privacy@agentos.com — the same channel this page offers for executed DPAs. The runbook is maintained in a private repository, so there is no public link that would resolve for a reviewer. Breach incidents are automatically triaged by the breachIncidentTriage workflow — see processing activity PA-010 below. To report a suspected breach, contact privacy@agentos.com immediately.

Processing Activities

PA-001

User Account Registration & Authentication

Purpose: Create and manage user accounts; authenticate users when they sign in to the service.
Legal Basis: Contract (Art. 6(1)(b))
Data Categories: Full name
Email address
Profile image URL (when supplied by the identity provider)
Central identity-provider account identifier (OIDC subject) and the associated sign-in tokens, encrypted at rest
Data Subjects: Landlords and their organisation members
Recipients / Sub-processors: SaaS Factory central identity provider (SF Auth) — performs all authentication; this Service holds no password
Neon Inc. (database)
Vercel Inc. (hosting)
Upstash Inc. / Vercel KV (managed rate-limit store — NOT CURRENTLY ENGAGED; see PA-011)
Retention Period: Duration of account + 30 days post-deletion
International Transfers: Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA. Upstash / Vercel KV: NOT ENGAGED — no KV store is provisioned, so rate-limit keys never leave the application's own memory in the UK region. SaaS Factory platform components (SF Auth): transfer basis not asserted — see the platform note in the sub-processor register below.
Security Measures: AES-256-GCM at rest for sensitive fields; TLS 1.2+ in transit. This Service stores NO password and performs no password verification — authentication is delegated in full to the SaaS Factory central identity provider (SF Auth) over OIDC. Sign-in sessions are 8-hour JWTs with a revocation list. Rate-limit keys contain the RAW user id or RAW IP address (they are not hashed), are held in the application's own memory rather than in a managed store, and expire on a short automatic TTL.

PA-002

HMRC MTD Quarterly Income Tax Submissions

Purpose: Collect National Insurance Numbers and HMRC OAuth tokens; submit quarterly income and expense updates to HMRC under the Making Tax Digital for Income Tax Self Assessment (MTD ITSA) regime.
Legal Basis: Legal Obligation (Art. 6(1)(c)); Contract (Art. 6(1)(b))
Data Categories: National Insurance Number (NINO) — encrypted at rest in this Service, and sent in the request path of every HMRC call
HMRC OAuth access and refresh tokens — held in the SaaS Factory Tether credential vault; this Service does not store or refresh them
Financial transaction data (income & expenses)
Property portfolio data
HMRC Fraud Prevention Header data (Gov-Client-* / Gov-Vendor-*) — device, browser and connection metadata about your session, transmitted to HMRC as a statutory requirement
Data Subjects: Landlords subject to MTD ITSA
Recipients / Sub-processors: HMRC (statutory recipient — UK)
SaaS Factory connections proxy + SF Tether credential vault — every HMRC request is routed through it and it holds the HMRC OAuth credential
Neon Inc. (database)
Vercel Inc. (hosting)
Retention Period: NINO: Duration of account. Financial records & submissions: 7 years (HMRC statutory requirement).
International Transfers: HMRC: UK (no transfer). Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA. SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
Security Measures: NINO encrypted at rest with AES-256-GCM; decrypted on-demand only; never logged. The Service supports a dedicated NINO key, but where one is not provisioned it falls back to the same master key used for the other encrypted fields (src/lib/nino.ts), so a single key currently protects every classification rather than each having its own. This Service never contacts HMRC directly and never holds an HMRC token — every request (NINO in the request path, submission body, and the Gov-Client-* headers) transits the SaaS Factory connections proxy, which injects and refreshes the OAuth credential from the SF Tether vault.

PA-003

Property Portfolio Management

Purpose: Store, display, and manage landlord property addresses and portfolio details to associate financial transactions and MTD submissions with the correct property.
Legal Basis: Contract (Art. 6(1)(b))
Data Categories: Property addresses
Property descriptions
Portfolio metadata
Data Subjects: Landlords
Recipients / Sub-processors: Neon Inc. (database)
Vercel Inc. (hosting)
Retention Period: Duration of account; 7 years for records linked to HMRC submissions
International Transfers: Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA.
Security Measures: Row-level security (RLS) on database; RBAC enforced at every API endpoint; TLS 1.2+ in transit

PA-004

AgentOS Letting Agent Data Import

Purpose: Import property, tenancy, and financial transaction data from the landlord's letting or estate agent via the AgentOS API to pre-populate the MTD service.
Legal Basis: Contract (Art. 6(1)(b))
Data Categories: Tenant names and tenancy dates
Rental income and agent fee data
Property addresses
Email addresses used to look up the landlord's accounts with their agent: the landlord's sign-in address, and any additional mailbox they choose to confirm
For each confirmation request: the address the one-time code was sent to, the IP address the request came from, and whether the code was used. The address may belong to someone who is not a user of this Service — anyone signing in can ask us to send a code to any address, which is why the message states plainly that ignoring it is safe and that nothing has been linked
Data Subjects: Landlords; tenants (limited transaction/tenancy metadata); recipients of a mailbox-confirmation email, who may not be users of the Service
Recipients / Sub-processors: AgentOS Proptech Group Ltd (data source — UK)
SaaS Factory connections proxy + SF Tether credential vault — every AgentOS API request is routed through it and it holds the AgentOS API key
Neon Inc. (database)
Vercel Inc. (hosting)
Retention Period: Imported financial records: 7 years from transaction date (HMRC statutory requirement). Mailbox-confirmation codes, and the address and IP recorded with each request: 30 days from the request, deleted on an unconditional daily schedule. Confirmed addresses: until the landlord removes them, or their account is deleted.
International Transfers: AgentOS: UK (no transfer). Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA. SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
Security Measures: The AgentOS API key is held in the SaaS Factory Tether vault and injected by the connections proxy — this Service does not store it. Tenant data minimised to names and dates; RLS on database. An additional mailbox is only searched once a one-time code sent to it has been entered back into the Service, so an account can only be looked up by someone who can read that inbox; the code is stored only as a SHA-256 hash, expires in 15 minutes, is single-use, and nothing about the address is disclosed to the person who requested it.

PA-005

Open Banking Data Import via TrueLayer

Purpose: With user consent, connect to the landlord's bank account via the TrueLayer Open Banking API to import bank transaction data for reconciliation with property income and expenses.
Legal Basis: Contract (Art. 6(1)(b)); Consent (Art. 6(1)(a)) for bank account connection
Data Categories: Bank account identifiers and display name (the TrueLayer account id and account label). Account number, sort code, IBAN and balance are fetched LIVE from TrueLayer at render time and are never stored by this Service.
Bank transaction history (amounts, merchants, dates) — stored
TrueLayer OAuth access and refresh tokens — held in the SaaS Factory Tether credential vault; this Service does not store or refresh them
Data Subjects: Landlords who opt in to Open Banking
Recipients / Sub-processors: TrueLayer Ltd (Open Banking provider — UK/EEA)
SaaS Factory connections proxy + SF Tether credential vault — every TrueLayer request is routed through it and it holds the bank OAuth credential
Neon Inc. (database)
Vercel Inc. (hosting)
Retention Period: Bank credentials: held in the SF Tether vault until revoked or the account is deleted. Transaction data: 7 years from transaction date.
International Transfers: TrueLayer: UK/EEA (no restricted transfer). Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA. SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
Security Measures: Consent obtained before connection and revocable at any time; the PSD2 consent window is 90 days. Account number, sort code and IBAN are never written to our database — they are read live from TrueLayer through the connections proxy for display only. The bank OAuth credential is vaulted in SF Tether, not held by this Service.

PA-006

Transactional Email Delivery (including the Weekly Financial Digest)

Purpose: Send service notifications including HMRC submission confirmations, deadline reminders, bank consent expiry warnings, and system alerts; and send the weekly landlord financial digest summarising the current tax year's position.
Legal Basis: Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) for security alerts
Data Categories: Email address
Name (for personalisation)
Year-to-date rental income, expenses, and net profit or loss totals in GBP — rendered in the body of the weekly digest email
Active property count, uncategorised transaction count, quarters submitted, and the next HMRC deadline date — also in the digest body
Data Subjects: Landlords and organisation members
Recipients / Sub-processors: SaaS Factory platform (SF Core central email relay — every message this Service sends is dispatched through it)
Resend Inc. (email delivery — US; this Service never contacts Resend itself, the central relay does)
Retention Period: Email logs retained by Resend per their data retention policy (typically 30 days)
International Transfers: Resend: US — SCCs/IDTA applied. No region election is held with Resend, so every message is declared as a transfer to the United States. SaaS Factory platform components (SF Core email relay): transfer basis not asserted — see the platform note in the sub-processor register below.
Security Measures: TLS in transit. The weekly digest email body DOES contain financial figures — year-to-date income, expenses and net profit/loss — so anyone with access to the recipient's mailbox can read them. The digest does not contain the National Insurance Number, bank account numbers, or any OAuth credential.

PA-007

Background Job Orchestration

Purpose: Orchestrate scheduled and event-driven background tasks including bank sync, HMRC obligation polling, and quarterly deadline reminders via Temporal Cloud.
Legal Basis: Contract (Art. 6(1)(b))
Data Categories: Organisation IDs and user IDs (workflow routing metadata)
Minimal workflow inputs (e.g. submission IDs, dates)
Data Subjects: Landlords
Recipients / Sub-processors: Temporal Technologies Inc. (workflow orchestration — US)
SaaS Factory platform (Temporal gateway — this Service holds no Temporal account of its own; every workflow is brokered through the platform onto SaaS Factory's Temporal Cloud namespace)
Retention Period: Workflow execution history retained by Temporal Cloud per their data retention policy (default 30 days, configurable per namespace)
International Transfers: Temporal Technologies: US — SCCs/IDTA applied. The Temporal Cloud namespace is operated by SaaS Factory and its region is not asserted to this Service, so it is declared as a transfer to the United States rather than claiming a region we cannot evidence.
Security Measures: Workflow inputs minimised to IDs; no NINO, tokens, or financial data in payloads; Temporal Cloud uses mTLS + API-key authentication, gRPC transport encrypted with TLS 1.3

PA-008

Security Monitoring & Error Tracking

Purpose: Detect, record, and alert on application errors, security incidents, and performance anomalies to maintain the security and reliability of the service.
Legal Basis: Legitimate Interests (Art. 6(1)(f))
Data Categories: IP addresses
Browser/device metadata
Stack traces (sanitised — no PII in error messages)
Error context (e.g. route, action, non-sensitive metadata)
Data Subjects: All users
Recipients / Sub-processors: SaaS Factory platform (error ingestion — UK/US)
Retention Period: Error events: 90 days. Audit logs: 7 years.
International Transfers: SaaS Factory platform: UK (no restricted transfer where UK-hosted). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA.
Security Measures: PII scrubbing applied before transmission; NINO and tokens never included in error context; legitimate interests balancing test documented

PA-009

Audit Logging

Purpose: Record all data-modifying operations within the service (create, update, delete) for security, fraud prevention, and dispute resolution purposes.
Legal Basis: Legitimate Interests (Art. 6(1)(f))
Data Categories: User ID and name
IP address
Action performed
Resource type and ID
Timestamp
Data Subjects: Landlords and organisation members
Recipients / Sub-processors: Neon Inc. (database)
Vercel Inc. (hosting)
Upstash Inc. / Vercel KV (managed rate-limit store — NOT CURRENTLY ENGAGED; see PA-011)
Retention Period: 7 years
International Transfers: Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access). Vercel: UK — London, lhr1, no failover region (compute); file uploads are held in a Vercel Blob store in the US — SCCs/IDTA. Upstash / Vercel KV: NOT ENGAGED — no KV store is provisioned, so rate-limit keys never leave the application's own memory in the UK region.
Security Measures: Every read of the audit log is scoped to the caller's own organisation by an explicit predicate at the API layer (src/lib/routers/activity.ts); any member of an organisation can read that organisation's entries, not only the owner. The audit table is deliberately EXCLUDED from database row-level security — the platform holds it on a permanent RLS denylist as a shell auth/platform table — so tenant isolation for THIS activity is application-layer only, unlike the property, transaction and submission tables in PA-003 and PA-004, which carry enforced database policies. Entries are not edited in the ordinary course of the service: the only writes after creation are the Art. 17 erasure anonymisation (user id and IP address nulled on request) and the 7-year retention purge. Rate-limit keys contain the raw user id or raw IP address — they are not hashed — and are held in the application's own memory, not in a managed store.

PA-010

Personal Data Breach Incident Management

Purpose: Detect, classify, triage, and document personal data breaches in compliance with UK GDPR Article 33. Notify the DPO within the required timeframe to enable 72-hour ICO notification decisions. Record breach incidents as an immutable audit trail.
Legal Basis: Legal Obligation (Art. 6(1)(c)) — UK GDPR Art. 33 / DPA 2018
Data Categories: Incident metadata (severity, affected data categories, estimated user count)
Audit log entries for the detected breach
DPO notification records (email delivery timestamps)
Data Subjects: Data subjects potentially affected by the breach; DPO
Recipients / Sub-processors: DPO / Data Protection contact (internal)
ICO (if notification required under Art. 33)
Affected individuals (if high-risk breach under Art. 34)
Neon Inc. (audit log storage)
Resend Inc. (DPO email notification)
Temporal Technologies Inc. (automated triage orchestration)
Retention Period: Breach records: minimum 3 years (ICO enforcement guidance); audit log: 7 years
International Transfers: ICO: UK authority (no restricted transfer). Resend: US — SCCs/IDTA. Temporal Technologies: US — SCCs/IDTA. Neon: UK — London, AWS eu-west-2 (no restricted transfer for data at rest; SCCs/IDTA retained for US support access).
Security Measures: Breach incident records are append-only audit log entries; DPO notifications sent via encrypted TLS; no NINO or financial data included in breach triage payloads

PA-011

API Request Rate Limiting

Purpose: Enforce per-user and per-IP request rate limits across all authenticated API endpoints to prevent abuse, credential stuffing, and denial-of-service attacks. NO managed key-value store is provisioned for this Service: neither KV_REST_API_URL nor KV_REST_API_TOKEN is set, so the limiter runs on the application's own in-process memory inside the UK (London) region. Rate-limit state is therefore per-instance and is NOT shared across serverless function instances, and no rate-limit data reaches Upstash Inc.
Legal Basis: Legitimate Interests (Art. 6(1)(f))
Data Categories: User IDs — written VERBATIM into the rate-limit key (`uid:<user id>`) for authenticated requests
IP addresses — written VERBATIM into the rate-limit key (`ip:<IP address>`) for unauthenticated requests
Data Subjects: All users
Recipients / Sub-processors: None. Rate-limit keys stay inside the application's own memory in Vercel's London (lhr1) region. Upstash Inc. / Vercel KV is listed in the sub-processor register as NOT CURRENTLY ENGAGED so that the register says plainly what would change if a managed store were provisioned.
Retention Period: Rate-limit counters expire automatically after 2× the rate-limit window: about 2 minutes on the main API paths (60-second windows), and about 2 hours on the email-verification resend limiter (1-hour window). No long-term retention.
International Transfers: None — no rate-limit data leaves the UK region. If a managed KV store (Vercel KV, backed by Upstash) is provisioned, this becomes a transfer to the United States under SCCs/IDTA via Vercel's DPA with Upstash, and this record must be updated before that store is enabled.
Security Measures: The identifier stored in the key is the RAW user id or the RAW client IP address — it is not hashed, and the key can therefore be read back to the identifier it was built from. No names, emails, or financial data are stored alongside it. Keys are scoped `rl:<namespace>:<identifier>`, carry a short automatic TTL, and never leave the process that created them — there is no network hop and no managed store to breach, at the cost of the limit being per-instance rather than global.

Sub-processor Data Processing Agreement Register

All sub-processors are required to enter into a Data Processing Agreement (DPA) with AgentOS Proptech Group Ltd before any personal data is transferred to them. The table below records each sub-processor, their role, data location, and the transfer mechanism used for international transfers outside the UK.

Sub-processor	Role	Data Location	Transfer Mechanism	DPA Reference
Neon Inc.	Managed PostgreSQL database	UK — London (AWS eu-west-2)	No restricted transfer for data at rest; SCCs (Module 2) / UK IDTA retained to cover US support access (Neon Inc. is US-incorporated)	View DPA ↗
Vercel Inc.	Application hosting, serverless compute, file storage (Vercel Blob), CDN	UK — London (lhr1) for every serverless function and for the middleware, with no failover region configured. Uploaded files (avatars, organisation logos, document attachments) are held in a Vercel Blob store in the US (Washington DC, iad1). CDN points of presence are worldwide and cache static assets only.	SCCs (Module 2) / UK IDTA — for the US Blob store and for US support access	View DPA ↗
TrueLayer Ltd.	Open Banking connectivity	UK / EEA	UK/EEA — no restricted transfer	View DPA ↗
Resend Inc.	Transactional email delivery. This Service never contacts Resend itself — every message is handed to the SaaS Factory central email relay, which delivers it through Resend.	US — no region election is held with Resend and none is asserted	SCCs (Module 2) / UK IDTA	View DPA ↗
Temporal Technologies Inc.	Workflow orchestration (background jobs, scheduled tasks). This Service holds no Temporal account of its own — workflows are brokered through the SaaS Factory platform gateway onto SaaS Factory's Temporal Cloud namespace.	US — the namespace is operated by SaaS Factory and its region is not asserted to this Service, so it is declared as a US transfer rather than claiming a region we cannot evidence	SCCs (Module 2) / UK IDTA	View DPA ↗
SaaS Factory connections proxy / SF Tether	Third-party API gateway and credential vault. Every HMRC and Open Banking (TrueLayer) request this Service makes is routed through it, carrying the National Insurance Number in the request path, the quarterly income and expense figures in the request body, and the HMRC Fraud Prevention Headers. It holds the HMRC and TrueLayer OAuth access and refresh tokens — this Service never stores them.	Not asserted — see the platform note below	Not asserted — see the platform note below	Not asserted — see the platform note below
SaaS Factory central identity provider (SF Auth)	Performs all authentication for this Service over OIDC. Receives the sign-in attempt and returns the account identifier, email address, name, and profile image. This Service stores no password and verifies no password.	Not asserted — see the platform note below	Not asserted — see the platform note below	Not asserted — see the platform note below
Upstash Inc. / Vercel KV	Managed key-value store for rate limiting. NOT CURRENTLY ENGAGED — no KV store is provisioned for this Service (neither KV_REST_API_URL nor KV_REST_API_TOKEN is set), so no personal data reaches Upstash. Rate-limit counters, the sign-out revocation list and the two-factor replay cache run in the application's own memory in the UK region. Listed here so the register says plainly what would change if a managed store were provisioned.	Not engaged — no data is transferred. A provisioned KV store would be a transfer to the United States and this register must be updated before one is enabled.	Not applicable while not engaged; SCCs (Module 2) / UK IDTA (via Vercel DPA with Upstash) would apply	View DPA ↗
AgentOS Proptech Group Ltd.	Letting agent data source (property, tenancy, transactions)	UK	UK — no restricted transfer	DPA incorporated in AgentOS service agreement
HMRC	Statutory recipient of MTD quarterly updates	UK	UK — statutory authority, no restricted transfer	View DPA ↗

SCCs = Standard Contractual Clauses (UK-approved). IDTA = UK International Data Transfer Agreement. Module 2 = controller-to-processor transfer.

SaaS Factory platform components

The Service is built and hosted on the SaaS Factory platform. Three platform components receive personal data in the course of running the Service and are disclosed here as recipients:

The connections proxy and the SF Tether credential vault — every HMRC and Open Banking call leaves the Service through the proxy, so the NINO, the quarterly figures and the Fraud Prevention Header data all transit it, and the vault holds the HMRC and TrueLayer OAuth tokens on our behalf (PA-002, PA-005).
The central identity provider (SF Auth) — every sign-in is performed against it over OIDC; the Service itself holds no password (PA-001).
SF Core’s central email relay — every email the Service sends, including the weekly financial digest, is dispatched through the relay before it reaches Resend (PA-006).

Their hosting locations, restricted-transfer mechanisms and DPA references are not asserted in this document — they are not established by the Service’s own code and are being confirmed by the controller. For the current position, contact privacy@agentos.com.

Data Subject Rights & Contact

To exercise your rights under UK GDPR (access, rectification, erasure, portability, restriction, or objection), or to request a copy of any executed DPA, please contact our Data Protection lead at privacy@agentos.com. Full details of your rights are set out in our Privacy Policy.