Data Processing Addendum summary

Roles

You are the business that controls your data. We are your service provider and process it only to deliver the reporting services you have engaged us for, on your documented instructions.

Data we process

Business records from the systems you connect, limited to the fields your metrics need: transactions, jobs, orders, leads, time entries and similar, identified by record ID. We do not need contact details of your customers, students, donors or tenants for totals, and we exclude them by default.

What we will never do

• Sell or share your data
• Use it for any purpose other than your services
• Combine it with other clients' data
• Use it to train AI models
• Write to or change your source systems

Security measures

Read-only access, a separate database per client, encryption in transit and at rest, multi-factor sign-in, least-privilege access for our staff and audit logging. Details are on our security page.

Sub-processors

We use a short list of infrastructure providers for hosting and storage, listed in the DPA. We give you 30 days' notice before adding a new sub-processor, and you may object.

Incidents

We notify you without undue delay, and within 72 hours, after becoming aware of a security incident affecting your data, and cooperate with your response.

Retention and deletion

At the end of the engagement, or on request, we delete your data and revoke our access within 30 days, and confirm deletion in writing. You can export your data at any time before then.

Privacy laws

The DPA includes service-provider terms for the California Consumer Privacy Act and similar US state laws, and FERPA terms for education clients.

Getting a copy

Email [email protected] for the full DPA, or ask for it on your scoping call.