Compliance for Corporate Programmes

The employer-employee boundary is architectural rather than a matter of policy: the personal estate data sits in a different place from the programme data, so there is no administrator screen that could show it and no setting that could turn it on.

• No access to estate data: will content, asset registers, uploaded documents and family details are never visible to HR or to a programme administrator
• Aggregate adoption only: an administrator sees seat counts, activation rates, programme engagement and billing. They never see who used what, and counts over a small cohort are suppressed so an individual cannot be identified from the aggregate
• The employee owns the data: the account, the will and the evidence pack behind it belong to the person who created them, not to the organisation paying for the seat

Both sides of a programme need an audit trail, and they need different ones. Keeping them separate is what makes the boundary above survive contact with a real audit request.

Procurement documents are available during onboarding rather than chased after signature. What follows describes the documents on offer, not what any organisation is required to hold.

• Data Processing Agreement: covering UK GDPR Article 28 obligations, with sub-processor flow-through and Standard Contractual Clauses for cross-border transfers. Joint-controller terms apply where they are relevant, and the terms are negotiable
• Named sub-processors: a short published list, each bound by written confidentiality and data-protection contracts that flow through to employees
• Named-region data residency: the regions are listed in the agreement, and data is not moved between regions without contractual notice
• Jurisdiction scoping: a programme can be scoped to the jurisdictions where will generation is supported, and an employee outside that scope sees a clear message rather than a half-supported experience

SAML 2.0 and OIDC are both supported, with just-in-time provisioning and group-based seat assignment.

Connecting an identity provider changes who authenticates the user. It does not change who can read the estate data, which lives in a separate identity space. Removing the connection later does not hand that data to the employer either: it ends the sign-in route, not the ownership.

A benefit that evaporates with the job is not much of a benefit for a document meant to last decades, so the seat and the account come apart cleanly.

• The personal account survives: the corporate seat ends and the account continues on a personal subscription or on the free tier
• The evidence pack is preserved: identity verification, the witnessing record and the audit trail stay reachable by the former employee, including through probate
• The employer cannot transfer or delete it: personal data created by the employee cannot be reassigned to the organisation or removed by it