Processor agreement

You are the controller: the personal data in your templates and in your render requests is yours, and you decide what is in it. furō solutions is the processor and only touches it to run Morfee for you.

• What: whatever you put in a template's sample JSON, and whatever you send with a render request. In practice that is names, addresses, contact people, amounts and descriptions in quotes, invoices and specifications.
• Whose: your customers and your own staff.
• Why: to make the document you asked for, and for nothing else.
• How long: the data in a render request is used and dropped; a sample stays with its template until you change or delete it. See Privacy for the periods.

• Only process on your instructions, which are the requests your systems send.
• Keep it inside the EU. Hetzner (server) and Cloudflare R2 (backups, handed-out documents) are the subprocessors that hold your data; Resend sends mail and Mollie handles payment, and neither sees what is inside your templates. You hear about a change of subprocessor before it happens.
• Keep it secured: TLS, one database on its own disk, keys stored as fingerprints, an audited nightly backup off the machine, and no analytics or third-party scripts anywhere in the product.
• Let only the people who run the service near it, and only when there is a reason.
• Help you answer a request from one of your customers, and hand your data back or delete it when you say so.
• Tell you about a data breach without delay, with what we know and what we are doing, so you can meet your own 72 hours.
• Return or delete everything when the agreement ends, whichever you ask for.

• You have a lawful basis for the data you send, and you tell your own customers what you do with it.
• You keep sensitive data out of it. Morfee is for business documents: a quote, an invoice, a specification. It is not built for medical records or anything else in a special category.
• You look after your own mailbox and your own API keys, because those are the keys to your library.

Ask and you get a written answer about how this is set up, with the relevant part of the code or the configuration if you want to see it. A visit on site is not something a service at this price can offer, and pretending otherwise would be the wrong promise.

Last changed on 19 August 2026.