Talk to us
Menu
Talk to us

For IT, security and legal

Nothing leaves your control.

You are the controller. We are the processor. We act on your instructions, and only for the cost audit.

Talk to us Read the exact account

Controller

You

  • You choose what we read
  • You give the instructions

Your instructions

The report

Processor

MonoWorks

  • Acts only on your instructions
  • Only for the cost audit

First step: a data processing agreement, signed by you and by us.

In short

Three answers before anything else.

Who is the controller

You.

We are the processor. We only touch your data on your instructions, and only for the audit.

What we read

What you choose.

Documents first: invoices, ledgers and contracts. CRM records only if you choose to share them. Supplier emails later, and only after you have told your staff.

What we delete

Your data.

We delete your data after the audit. We keep only anonymous supplier prices.

Two phases

Documents first. Emails only after your staff are told.

Invoices, ledgers and contracts have little personal data. Emails have personal data of your staff and of people outside your company. So the audit runs in two phases.

  1. Phase 1

    Documents only.

    • Invoices
    • Ledgers
    • Contracts
    Who
    Us
    Starts
    Right after the agreement is signed

  2. In between

    You tell your staff.

    • Update the email policy
    • Tell your staff
    • Sign off the data protection impact assessment (DPIA)
    Who
    You, using our templates
    Takes
    2 to 6 weeks

  3. Phase 2

    Supplier emails.

    • Shared mailboxes first
    • Only supplier emails
    • A fixed date range
    Who
    Us
    Starts
    Only after your staff have been told

The times are estimates.

The email scope

Only supplier emails. Shared mailboxes first.

A fixed date range. No HR or personal folders. And never before your staff have been told.

  • Nothing outside your instructions.You choose what we read.
  • Never about a person.Reports are about costs and suppliers.
Email scope Phase 2
  • accounts@Shared mailboxSupplier emails only
  • orders@Shared mailboxSupplier emails only
  • HR foldersNever read
  • Personal foldersNever read
Dates
A fixed range
Starts
After your staff are told

accounts@ and orders@ are examples of shared mailboxes.

The rules we keep

Four rules we keep.

We describe what we do. “EU hosting where we can” means what it says: we do not promise EU-only hosting.

01 Emails

Shared mailboxes first, such as accounts@ and orders@. Only supplier emails. A fixed date range. No HR or personal folders.

02 Reports

Reports are about costs and suppliers. Never about a person.

03 AI providers

EU hosting where we can. No training on client data.

04 Deletion

We delete client data after the audit. We keep only anonymous supplier prices.

The steps

For each client, in order.

Who does what, and how long it takes. The times are estimates.

  1. Sign the data processing agreement

    Signed by you and by us. The audit starts after that.

    • You and us
    • A few days to 2 weeks

  2. Phase 1: documents

    The audit on invoices, ledgers and contracts.

    • Us
    • Starts right after signing

  3. Tell your staff

    Update the email policy, tell your staff, sign off the data protection impact assessment (DPIA).

    • You, using our templates
    • 2 to 6 weeks

  4. Phase 2: supplier emails

    The audit on supplier emails, inside the scope above.

    • Us
    • After that

Afterwards

After the audit we delete your data. We keep one thing.

We keep only anonymous supplier prices. We say it here, plainly, so that you know it before you sign.

After the audit
Your data
Deleted
Anonymous supplier prices
Kept

See what your company can’t.

The cost audit is free. If we find nothing, you pay nothing.

Talk to us