Create

Create in the admin sidebar makes three documents from what you have already entered. It is on both plans. Pick a document, fill in its short form, choose Preview, and then Download PDF.

Document	What it is
Data processing agreement	A GDPR Article 28 template with you as the processor, prefilled from your legal details, subprocessors and security controls
Security overview	A clean PDF of your trust center: what you publish there, ready to attach to an email
Security questionnaire	Questions to send to your own vendors, grouped like the controls on your trust center

All three forms stay on the page while you switch between them, so nothing you typed is lost.

Preview and download

Preview builds the document from your records and shows it beside the form. Choose it again after any change.
Download PDF makes a PDF of exactly the preview you are looking at. If nothing has changed since your last PDF, Notice Labs reuses it and says so.
If the PDF service isn’t available on the deployment, the page says so and the preview still works.

Every field is optional. A field you leave empty prints as a blank line you can fill in by hand. The documents are rebuilt from your records each time you preview, so they always use what is there now.

Data processing agreement

A template for you to send to customers, with you as the processor. It is not legal advice, and the document itself says so: it has not been checked against your circumstances, your contracts or the law that applies to you. Complete the blanks, check every prefilled detail and every security measure is true of your business, and have qualified counsel review it before you send or sign it.

It is prefilled from:

Your legal entity, from Settings: legal and trading name, registered address, company number, country and data protection contact. If you haven’t added a legal name, the page says so and links to Settings. Those details print as blank lines.
Your subprocessors, from Subprocessors.
Your security controls, from Security controls.

The controller’s details are always blank, for the customer to complete.

Field	Notes
Agreement this DPA forms part of	For example, a master services agreement and its date
Subject matter and purpose
Duration of the processing
Categories of data subjects
Categories of personal data
Special categories of personal data	And the safeguards applied
Deletion or return at the end	For example, the period after which data is deleted
Transfer mechanism	Only if personal data leaves the EEA or the UK
Governing law	Empty follows the agreement’s governing law
Days’ notice of a new subprocessor	Starts at 30. A common starting point, open to negotiation
Hours to report a breach	Starts at 48. A common starting point, open to negotiation

Security overview

A PDF of your trust center. It needs nothing from you beyond an optional Prepared for, a company or person printed on the cover.

It holds only what your public trust center shows. A section you have switched off on the Dashboard, and a document that is Private, never appear in it. It can include:

Your introduction, and your legal entity line when you have given a legal name.
Your compliance frameworks, with status and notes.
Your security controls, grouped by category.
Your subprocessors, with purpose, regions and data categories.
The titles of your documents, with a note when some are shared on request.
A contact list: your support address, and pointers to the report and request forms on your trust center.

The cover shows who it is prepared for, when you last reviewed the trust center, the date it was generated and its address.

Security questionnaire

Questions for your vendors, for when you are the one assessing someone. It holds no facts about your company beyond who is asking. It is a document to send and read, not a service: Notice Labs doesn’t send it, track it or collect the answers.

Field	Notes
Vendor	Who you are sending it to. Empty leaves a blank
Service or engagement
Response requested by	A date
Questions to	Where the vendor can ask you about it. Starts as your general support address
Include questions about AI	On by default

The sections are company information, assurance and certifications, data handling and subprocessors, then one section for each control category on your trust center, then incident history, and a declaration for the vendor to complete. The AI section is left out when the switch is off.