Data Processing Agreement
Effective date: May 20, 2026
This template Data Processing Agreement describes how DPAS, as a processor, handles personal data on behalf of a customer organization. A signed DPA is available to B2B customers on request.
This is a good-faith template document and not finalized legal advice. It will be reviewed by qualified counsel before public launch.
1. Scope and roles
This DPA applies to personal data DPAS processes on behalf of the customer in the course of providing the service. The customer is the controller; DPAS is the processor and processes personal data only on the customer's documented instructions.
2. Confidentiality and security
DPAS keeps personal data confidential and applies the technical and organizational measures described on the Security page, including tenant isolation, hardened access rules, encrypted transport, and audit logging.
3. Subprocessors
DPAS uses the subprocessors listed below to deliver the service. We will inform customers of changes to this list so they can object where their agreement allows.
4. Data subject requests
DPAS assists the customer in responding to data-subject requests, including access and erasure, through the data-export and data-erasure capabilities of the service.
5. Personal data breach
If DPAS becomes aware of a personal data breach affecting customer data, it will notify the affected customer without undue delay and provide the information the customer needs to meet its own notification duties.
6. Return and deletion
On termination of the service the customer may export its data, after which DPAS will delete or return customer personal data in accordance with the agreement and applicable law.
Current subprocessors
| Provider | Purpose |
|---|---|
| Google Firebase (Google Cloud) | Application database, authentication, and file storage. |
| Vercel | Application hosting and content delivery. |
| Resend | Transactional email delivery (approval notifications, invitations). |
| Sentry | Application error monitoring and diagnostics. |