Data processing addendum

Roles

The customer is the controller of its data; Main is the processor.

Processing

Only on the customer’s documented instructions, to provide the service. Categories: project financial records and business contact details of the customer’s personnel.

Security

Per-organization isolation enforced in the application and database; per-organization encryption keys for files; mandatory two-factor authentication; logged staff access sessions; append-only activity log.

Subprocessors

As listed on the Security page, with notice before changes.

Deletion

On request or at the end of the service, with a deletion certificate. Raw uploaded files are scheduled for deletion after the engagement; full retention details are being finalized.

Breach notification, the customer’s inspection and auditor rights, international transfers

[To be completed by counsel.]