Legal

Data processing addendum

The processor terms for customers who need one on file, including transfer mechanisms.

1. 01

   Roles of the parties

   For everything in your workspace you are the controller and we are the processor: we act on your instructions and do not decide what goes in. For your own account and billing details we are the controller.

2. 02

   Scope and duration

   We process your data for as long as we run your workspace, and only to run it. On termination we export what you ask for and delete the rest.

3. 03

   Sub-processors

   Supabase, Vercel, and the model providers listed on the Security page. We will give you notice before adding one, and you may object.

4. 04

   International transfers

   Our sub-processors operate in the EU, the UK and the US. Where data leaves the UK or EEA it does so under those providers’ standard contractual clauses.

5. 05

   Security measures

   As set out on the Security page: database-level access control, encryption in transit and at rest, and scoped credentials for third-party accounts.

6. 06

   Audit and assistance

   We will answer a security questionnaire and help you respond to a data subject request. We do not currently hold SOC 2 or ISO 27001, and we would rather say so than imply otherwise.

7. 07

   Getting a signed copy

   Write to legal@samplesignal.com. A countersigned DPA is drawn up per customer rather than published as a click-through, because the sub-processor list depends on which modules your workspace runs.