Procurement pack
Everything vendor onboarding asks for
The documents your procurement, legal and security teams need to approve Glossy Data Enterprise. Each one shows whether it is ready today.
Documents
The kit
- Current
Order form
Printable page · Save as PDF
Generated from your quote: line items, credits, term, totals, payment terms, PO number and the document versions you accept.
- Current
Master Subscription Agreement (MSA)
Web page · SHA-256 recorded on acceptance
Read the subscription terms before signing in: fees, renewal, service availability, data handling and liability.
- Current
Data processing agreement (DPA)
Web page
UK GDPR Article 28 terms, security measures, breach notice, deletion and audits. The same for every customer.
- Current
Terms of service
Web page
Plans, credits, refunds, cancellation and liability. Our paper only: no redlines, which keeps prices public.
- Live
Sub-processors
Table on this page
Every provider that handles data for us, what it receives and where. 30 days' notice of changes.
- Live
Security pack
ZIP / PDF
Architecture, data flows, encryption, access controls, incident response and our honest certification status.
- Live
Standard questionnaire answers
CSV · Markdown
Pre-filled answers in the style of SIG Lite / CAIQ, drawn from the trust page and our sub-processor list. "Not yet" where something isn't in place.
- Coming soon
Company and banking details letter
PDF
Legal name, company number, registered address and bank details. Always check bank details against the invoice, never an email.
- Coming soon
W-8BEN-E
PDF
For US buyers paying a UK company.
Ordering
From quote to live workspace
01
LiveBuild your quote
Configure scope and payment. The quote is priced from published plans and valid for 30 days.
02
LiveAccept the order form
An authorized signer ticks two boxes and types their name and title. The order form, terms and DPA versions are recorded with a timestamp.
03
LivePay
Card through Stripe Checkout, or a Stripe invoice due in 30 days with your PO number.
04
LiveStart
Workspaces, SSO settings and the setup checklist are ready straight away. Invite your team; seats are unlimited.
Paying by invoice: access starts when the order form is accepted, with part of your monthly credits; the full allowance unlocks when the invoice is paid. An unpaid invoice gets a reminder on day 30, scheduled runs pause on day 37, and the order is cancelled on day 60. Your data is kept.
From our DPA
Sub-processors
| Provider | What they do for us | What they receive | Where | When we use them |
|---|---|---|---|---|
| Cloudflare | Hosting, database, background jobs, bot protection (Turnstile), text analysis (Workers AI), routing of AI API calls (AI Gateway) and email sending | All service data, as our host | Global network; US company | Always |
| Stripe | Payments, invoices and subscriptions | Name, email, billing address, payment details. We never see your full card number | UK, EU and US | When you buy a plan |
| DataForSEO | Collects answers from ChatGPT, Gemini, Google AI Overviews and Google AI Mode, as the public sees them | The questions we track and the locations they're asked from. Not your personal data | Location: see DataForSEO's privacy policy | Always (every plan and the free check) |
| Anthropic | Claude API: Claude answers (with web search), and quality checks on a small sample of answer analysis | The questions we track, the location they're asked from and the text of AI answers | US | Always on paid plans |
| Perplexity | Sonar API: Perplexity answers (with web search) | The questions we track and the location they're asked from | US | Always |
| xAI | Grok API (with web search): Grok answers | The questions we track and the location they're asked from. Not your personal data | US | When Grok is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks Grok |
| DeepSeek | DeepSeek API: DeepSeek answers from model knowledge (no web search) | The questions we track and the country they're asked from. Not your personal data | People's Republic of China | When DeepSeek is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks DeepSeek |
| OpenAI | Optional ChatGPT developer-API lane, for comparison with consumer ChatGPT answers | The questions we track and the location they're asked from | US | Not in use: no OpenAI connection is switched on today. Consumer ChatGPT answers come through DataForSEO |
| Google sign-in, and the Search Console and Analytics APIs when you connect them | For sign-in, your Google account name and email. For connected properties, access tokens and the search and analytics data you choose to connect | US company; global infrastructure | Only when you sign in with Google or connect a Google property | |
| Resend | Transactional email, only as a backup to Cloudflare email sending | Your email address and the email content | US | Off today. Switched on only if Cloudflare email sending fails |
Integrations you connect yourself (such as your identity provider for SSO) receive data on your instructions; they are your providers, not our sub-processors.
We give at least 30 days' notice of any new sub-processor. Read the DPA
Standard ordering terms
- No custom terms or redlines. Our paper is the same for everyone.
- No supplier-portal registrations. This page and the security pack replace them.
- No calls. It's how we keep Enterprise at a published price.
Procurement questions
We don't fill in custom questionnaires by hand. Download our pre-filled questionnaire (SIG Lite / CAIQ style, CSV or Markdown) and the security pack: together they cover the standard questions, and say "Not yet" where something isn't in place.
No. Our terms, DPA and order form are the same for every customer, which is how we keep prices public and fair. They're written to be buyer-friendly.
Yes. Add your PO number when you build the quote, or later. It's printed on the order form and on the Stripe invoice.
Card, or a Stripe invoice payable within 30 days by bank transfer or card. Invoice billing is available on Business, Enterprise, Agency Scale, Agency Enterprise, Enterprise Plus when billed annually.
30 days. The price is frozen when the quote is issued, and fixed for the 12-month term.
Start on a self-serve monthly plan, then upgrade to Enterprise. Any credit for unused time is shown when you change plans. You can cancel renewal at any time in Billing; once cancelled, the subscription will not renew.
No. Everything a vendor-onboarding team usually needs is on this page or in the security pack, so no portal or call is needed.
Only ever against the Stripe invoice itself. We will never send changed bank details by email.