Home / Data protection
Data protection
How the Propelon platform processes customer data — the roles, the categories, and the commitments we sign.
Effective September 19, 2026 · Quest 2 Excel, Inc., dba Propelon
The model
In the platform, the customer is the data controller and Propelon is a processor acting on the customer’s documented instructions, under a data processing agreement executed with the subscription. This page describes the model in plain language; the DPA is the binding document.
What the platform processes
Propelon is a system of record for AI initiatives, so the data is mostly about work, not people: initiative records, focus areas, gate decisions and their attestations, value-state figures with their source and method, and execution signals read from the customer’s delivery and collaboration tools. Where the record touches people, it is workplace data — names, work identifiers, roles, and adoption telemetry showing whether a named initiative’s target population is using what was shipped. The platform is not designed for, and customers agree not to submit, special-category data.
Telemetry, handled with restraint
Adoption measurement exists to verify enterprise outcomes, not to surveil individuals. Telemetry is scoped to the initiatives under management, read from systems the customer connects, reported against each initiative’s target population, and governed by the customer’s own policies toward its workforce. The customer controls which systems are connected and who sees what the platform reports.
Commitments in the DPA
The DPA carries the commitments regulated customers expect: processing only on instructions; confidentiality; the security measures summarized in the Security policy; assistance with data-subject requests and impact assessments; breach notification without undue delay; subprocessor disclosure with advance notice of changes and the right to object; standard contractual clauses for international transfers; and, at termination, export of customer content followed by deletion within the contractual window. Customer content is not used to train models for other customers.
Where data lives
Production runs in United States cloud regions; deployment-specific residency is documented per customer in the order form and security documentation.
Documentation
The DPA, the subprocessor list, and completed security questionnaires are provided during procurement through the Security portal (compliance@propelon.ai); privacy questions go to privacy@propelon.ai.