Data Processing Addendum
1. Definitions
Terms defined in the Terms of Service at /terms carry the same meaning here. "Data Protection Law" means the laws applicable to the processing, including the EU General Data Protection Regulation, the UK GDPR, the Swiss FADP, and the US state comprehensive privacy laws. "Personal Data", "Controller", "Processor", "Sub-processor", "Data Subject", and "Processing" carry their meaning under Data Protection Law. "Customer Personal Data" means personal data contained in Customer Data and processed by us on the Customer's behalf.
2. Roles
The Customer is the Controller of Customer Personal Data and we are its Processor. Where the Customer is itself a processor for a third-party controller, we act as sub-processor and the Customer warrants it has the authority to instruct us.
We are an independent controller for the account identity and security records of the Customer's users — name, email, role, authentication and audit records — because we determine how those are kept in order to operate and secure the platform. That processing is described in our Privacy Policy at /privacy and is outside the scope of this DPA's processor obligations.
3. Instructions
We process Customer Personal Data only on the Customer's documented instructions, which comprise this DPA, the Terms of Service, the Customer's configuration of the Services, and its use of them. We will tell the Customer if we believe an instruction breaches Data Protection Law, unless legally prohibited from doing so. If we are required by law to process beyond those instructions, we will inform the Customer first unless the law forbids it.
4. Nature, purpose, duration, and categories
Subject matter and nature. Hosting, storage, retrieval, organization, analysis, and AI-assisted generation, in order to provide the Services.
Purpose. To provide, secure, support, and maintain the Services for the Customer.
Duration. The term of the agreement, plus the retention period in section 10.
Categories of Data Subject. The Customer's personnel who use the Services; and individuals whose personal data appears in Customer Data — typically business contacts, executives, advisers, and principals of the companies the Customer researches.
Categories of Personal Data. Business contact and role information; free text authored by the Customer's users; documents the Customer uploads and information extracted from them; and derived representations of the foregoing.
Special categories. None. The Services are not designed for special-category or sensitive personal data, and the Acceptable Use Policy at /aup prohibits loading it.
5. Confidentiality
We ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and are granted access on a least-privilege basis, with access reviewed periodically.
6. Security
We implement the technical and organizational measures set out in Annex A, and we do not materially decrease their overall protection during the term.
7. Sub-processors
The Customer gives general authorization for us to engage sub-processors. Our current sub-processors are listed at /subprocessors, which forms Annex B to this DPA.
We will give the Customer at least 30 days' notice before a new sub-processor begins processing Customer Personal Data. The Customer may object on reasonable grounds relating to data protection within that period; if we cannot accommodate the objection, the Customer may terminate the affected Services without penalty for the unused prepaid term.
We impose data protection obligations on each sub-processor no less protective than those in this DPA, and we remain liable for their performance.
8. AI processing
Because AI processing is the substance of the Services rather than an incident of them, it is stated explicitly:
– Customer Personal Data contained in prompts is transmitted to the model, embeddings, and — where voice features are enabled — voice sub-processors identified in Annex B, solely to return a result to the Customer.
– We do not use Customer Personal Data to train, fine-tune, or improve any model, and we do not permit our sub-processors to do so where their terms give us that control. Our model provider's agreement contractually excludes training on our API content and deletes inputs and outputs within 30 days.
– We do not have a zero-retention arrangement with our model provider, and we do not represent that we do.
– Where a sub-processor's terms do not state a training or retention position, we do not assert one on its behalf. The register behind Annex B records what has been verified and what has not.
– Output is generated and may be inaccurate; the Customer remains responsible for decisions taken on it, as set out in the Terms of Service.
– Automated processing does not produce decisions with legal or similarly significant effects on Data Subjects. The platform is built so that a person, not an agent, advances an item between stages.
9. Data subject requests and assistance
Taking into account the nature of the processing, we assist the Customer with:
– responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection, including through the Services' own administration functions and, where necessary, an operator-run export;
– data protection impact assessments and prior consultation, by providing the information reasonably available to us.
If we receive a request directly from a Data Subject relating to Customer Personal Data, we will not respond substantively and will refer them to the Customer, notifying the Customer promptly.
10. Deletion and return
On termination, at the Customer's election within 30 days, we provide an export of Customer Data. We then archive the workspace and permanently delete Customer Data through a controlled deletion procedure after a grace period of at least 30 days, retaining a record that the deletion occurred. Deleted data ages out of backups within 35 days. We may retain data where law requires, for as long as the law requires, and the obligations in this DPA continue to apply to it.
11. Personal data breach
We notify the Customer without undue delay and within 72 hours of confirming a personal data breach affecting Customer Personal Data, with the information reasonably available to us at the time and updates as the investigation proceeds, and we assist the Customer with its own notification obligations.
12. International transfers
Where the processing involves a transfer of Customer Personal Data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, the transfer is made under the European Commission's standard contractual clauses, incorporated by reference, with Module Two applying where the Customer is a controller and Module Three where the Customer is itself a processor, and with the UK Addendum and the Swiss adaptations applying to those respective transfers. Where a sub-processor participates in an applicable adequacy framework, that framework may apply instead, as recorded in Annex B.
13. Audit
We make available the information reasonably necessary to demonstrate compliance with this DPA, including our current third-party audit reports and security documentation where available under confidentiality. Where that information is insufficient, the Customer may audit no more than once annually, on reasonable notice, during business hours, without disrupting the Services, and subject to confidentiality — or more often where a supervisory authority requires it or following a breach.
14. Liability and general
Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA takes effect on the effective date of the agreement it forms part of, and remains in force for as long as we process Customer Personal Data. If a provision is unenforceable, it is modified to the minimum extent necessary or severed.
---
This annex is the authoritative statement of our security measures. The Privacy Policy points here rather than describing them, so that what is published always matches what is operating.
Current as of 2026-08-17. Measures marked planned are not yet in operation and are identified as such deliberately — see the note at the end of this annex.
A.1 Tenant isolation
Every customer's data carries its workspace identity and is filtered by PostgreSQL row-level security, enforced by the database rather than by application code. Application queries run as an unprivileged role that cannot bypass those policies. Cross-workspace isolation is covered by automated integration tests that run on every change.
A.2 Access control and authentication
Passwords are stored only as per-user salted bcrypt hashes. Two-factor authentication is available to all users and required for our own privileged personnel; recovery codes are stored as hashes and are single-use. Failed sign-in attempts are throttled and locked out. Web sessions have a 12-hour absolute lifetime and a 60-minute inactivity timeout. Mobile access tokens are stored only as hashes, expire, and are revocable server-side. Access is least-privilege and reviewed quarterly.
A.3 Encryption
Data is encrypted in transit using TLS. Planned: encryption at rest is provided by our cloud platform's defaults for database, object storage, and key management; attestation is collected at production cutover.
A.4 Logging, monitoring, and audit
An append-only audit log records access and modification events; its purge path is superuser-gated. Application logs are structured and are documented never to carry prompts, model responses, or request bodies. Error reports are scrubbed of credentials, request contents, email addresses, and network addresses before transmission.
A.5 Secure development
Changes are peer-reviewed and merged only after automated checks pass: static application security testing, secret scanning, dependency vulnerability scanning, container image scanning, type checking, and unit, integration, and cross-layer journey tests. Secrets are held in a managed secret store and never in source.
A.6 Resilience
Backups run nightly with periodic restore verification. Planned: a 35-day rolling backup window on managed database infrastructure at production cutover.
A.7 Personnel
Personnel are subject to confidentiality obligations, security onboarding, and offboarding procedures that revoke access.
A.8 Sub-processor management
Sub-processors are registered, reviewed at least annually, and bound by data protection terms. The current set is Annex B.
Note on planned measures
Two measures above are marked planned because the platform's production hosting cutover has not yet occurred. We identify them rather than describing the target architecture as though it were operating — which is the reason this annex exists and the Privacy Policy defers to it. This note is removed, and the measures restated, when cutover completes and attestation is collected.
---
The current list is published at /subprocessors and is incorporated here by reference. It is derived from our internal vendor register and kept in step with it by an automated check.