Data Processing Addendum

This Data Processing Addendum ("DPA") is between two parties. The first is the entity named as "Customer" in the applicable Terms of Service ("Customer" or "Controller"). The second is DA592 LTD, trading as Masheev (a company registered in England and Wales, company number 17101865, registered office Flat 32, 154 Loudoun Road, London, England, NW8 0DJ) ("Company," "we," "us," or "our," also called "Processor").

This DPA supplements and forms part of the Terms of Service ("TOS") between Customer and Company. It governs how we process Personal Data on behalf of Customer in connection with the Services.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the TOS. In this DPA, "you" and "your" mean Customer, and "we," "us" and "our" mean Company. "Including" means including without limitation. These terms have the following meanings:

2. Scope and Application

2.1 Applicability

This DPA applies when we process Customer Data on your behalf, as Processor, in connection with the Services under the TOS. It is incorporated into and forms part of the TOS.

2.2 Duration

This DPA stays in effect for the duration of the TOS. It continues until all Customer Data has been deleted or returned under Section 13 of this DPA.

2.3 Precedence

If this DPA and the TOS conflict, this DPA prevails on matters relating to the processing of Personal Data. This follows the order of precedence in Section 18.8 of the TOS. If this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses prevail.

2.4 Scope of Processing

Annex I of this DPA describes the processing. It sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data processed, and the categories of Data Subjects.

3. Roles of the Parties

3.1 Customer as Controller

You are the Controller of Customer Data and decide the purposes and means of processing it. You keep all rights, title, and interest in Customer Data.

3.2 Company as Processor

We will process Customer Data only as your Processor, on your documented instructions. Those instructions are in this DPA, the TOS, and your configuration and use of the Services.

3.3 Company as Independent Controller

We act as an independent Controller for Account Data. This includes data needed for billing, account administration, usage analytics, platform improvement, compliance with legal duties, and communication with you about the Services. Our Privacy Policy governs our processing of Account Data as Controller.

4. Customer Obligations

4.1 Lawfulness of Processing

You are responsible for making sure that the processing of Customer Data follows Data Protection Laws. This includes:

• (a) having and keeping a valid legal basis for processing Personal Data, including getting any necessary consents from Data Subjects;
• (b) giving Data Subjects privacy notices that explain how their Personal Data will be processed, including by us as Processor;
• (c) ensuring the accuracy, quality, and relevance of Customer Data you give us; and
• (d) ensuring that your instructions to us comply with Data Protection Laws.

4.2 Special Category and Regulated Data

(a) General rule. You must not provide any of the following. You must also ensure that your Users and AI Agents do not request them: Special Category Data (as defined under Article 9 of the UK GDPR or equivalent provisions of Data Protection Laws); personal data relating to criminal convictions and offences; protected health information under HIPAA; payment cardholder data; or other data listed in Section 7 of the Acceptable Use Policy. The only exceptions are Section 4.2(b) and a separate written agreement signed by both parties.

(b) Limited Health Data. If you provide health, care, wellness, or aesthetic services and are not a HIPAA covered entity or business associate, you may process Limited Health Data through the Services. "Limited Health Data" means the minimum health information needed to book, change, or cancel an appointment or to pass a message to your staff. An example is the type of appointment requested. It also means health information that an End-User volunteers without being asked. You are responsible for having a condition for processing under Article 9(2) of the UK GDPR and, where relevant, Schedule 1 of the Data Protection Act 2018. You are also responsible for any consent, notice, and privacy policy that Consumer Health Data Laws require. You must configure your AI Agents not to ask for symptoms, diagnoses, medications, test results, or treatment history.

(c) Incidental information. End-Users may disclose special category data or other sensitive information in their communications without being asked. We will process that information as part of Customer Data under this DPA. You are responsible for having an appropriate lawful basis and Article 9 condition (or equivalent) for that processing, and for any extra notices.

(d) Restricted uses. You must not do any of the following without our prior written agreement: (i) use the Services to collect special category data, criminal offence data or consumer health data as a deliberate part of a workflow (for example, intake questionnaires about medical conditions), beyond Limited Health Data; (ii) process protected health information subject to HIPAA (we do not sign Business Associate Agreements, so you must not use the Services as or for a HIPAA covered entity or business associate to handle protected health information); (iii) configure the Services to identify individuals by their voice or other biometric data; or (iv) direct the Services at children or knowingly collect children's Personal Data.

(e) Consumer health data. Where we process consumer health data under the Washington My Health My Data Act or a similar law, we act as your processor. We process that data only on your documented instructions in this DPA. We will also assist you, taking into account the nature of the processing, in meeting your duties under that law.

(f) Data received in breach. If you or an End-User provide data in breach of this Section 4.2, you are responsible for meeting all legal requirements for processing it. We may suspend the affected processing and delete or redact that data.

4.3 Customer Warranties

You warrant that you have all necessary rights, permissions, and legal bases. They cover giving us Customer Data and authorizing us to process it under this DPA and the TOS.

If you connect an email inbox or forward mail to the Services, you also warrant that: (a) you act as the Controller for all message content and correspondent data ingested from that mailbox, including communications written by third-party correspondents; and (b) you have given those correspondents and other Data Subjects all notices, and have met all transparency duties, that Articles 13 and 14 of the UK GDPR (and equivalent provisions of Data Protection Laws) require. This includes telling them, where required, that an AI-powered service provider may process their communications on your behalf.

4.4 Communications

Your instructions to us include every Communication (as defined in the TOS) that you, your Users, or your AI Agents, automations, workflows, or integrations send, place, or answer through the Services. We process those Communications as your Processor, on your instructions. You remain responsible, as Controller and as the sender or caller of each Communication, for the lawful basis, consents, opt-outs, notices, and other requirements described in Section 6 of the TOS.

4.5 Customer Websites and Device Storage

When you install our chat widget or SDK on your websites or apps, you control those sites. The widget stores a random visitor identifier and session token in the End-User's browser so a conversation can continue. You are responsible for: (a) your own cookie and storage notices and any consent required under the Privacy and Electronic Communications Regulations 2003 or equivalent laws; (b) linking the widget to your own privacy notice in the widget settings; and (c) turning on the widget's consent option where your legal analysis requires consent before a chat starts. We will provide the widget settings and documentation needed to do this.

4.6 Automated Decisions

The Services generate AI outputs, including replies, summaries, classifications, sentiment and satisfaction estimates. You must not use the Services to make a decision that has a legal or similarly significant effect on an individual. Nor may you use the Services to be a substantial factor in making one. This includes a consequential decision under a US state law on automated decision-making technology. Sections 4.1 and 4.2 of the Acceptable Use Policy and Section 6.2(g) of the TOS set this rule and list examples. An instruction to use the Services in this way is not a documented instruction under Section 5.1.

5. Processing Instructions

5.1 Documented Instructions

We will process Customer Data only on your documented instructions. The following are your documented instructions to us:

• (a) processing as set out in the TOS and this DPA;
• (b) processing started by you or your Users through your configuration and use of the Services;
• (c) creating anonymised Aggregate Data under Section 5.5 of the TOS, derived only from usage and performance metadata (such as counts, durations and error rates) and never from the content of messages, calls, recordings, transcripts or emails, or from data received through Google, Microsoft, Notion or Atlassian services;
• (d) limited review of Customer Data to investigate suspected breaches of the Acceptable Use Policy, complaints, legal requests and security incidents, as set out in Section 10 of the Acceptable Use Policy; and
• (e) processing to follow any other reasonable, documented instructions from you that are consistent with the TOS and this DPA.

5.2 Additional Instructions

If you need processing beyond the instructions in Section 5.1, the parties will negotiate in good faith a separate written agreement for it. That agreement will cover any extra fees that may apply.

5.3 Notification of Unlawful Instructions

If we become aware that one of your instructions may violate Data Protection Laws, we will promptly tell you. We need not carry out an instruction that we reasonably believe violates Data Protection Laws. We may suspend the relevant processing until the matter is resolved. We are not bound to assess independently whether your instructions comply with applicable law. We will act in good faith to identify potential issues.

5.4 Processing Required by Law

We may process Customer Data other than on your instructions only where UK law or other law that applies to us requires it. In that case we will tell you about that legal requirement before processing. The exception is where that law prohibits this on important grounds of public interest. We will not transfer Customer Data to a third country or international organisation except on your documented instructions or where law requires it. Your use of the Services as described in this DPA and the Sub-Processor List is a documented instruction.

5.5 No Use for Company's Own Benefit

Other than creating Aggregate Data as described in Section 5.1(c), we do not use Customer Data for our own purposes or benefit. We do not authorise our Sub-Processors to use Customer Data for their own purposes or benefit. They may process it only to provide, secure and support the Services for you, to prevent abuse, and to comply with law. This is in addition to the commitment in Section 5.5 of the TOS not to use Customer Data to train AI models.

6. Confidentiality

6.1 Personnel Obligations

We will ensure that all personnel authorized to process Customer Data:

• (a) are bound by appropriate confidentiality duties, whether by contract, statute, or professional duty;
• (b) process Customer Data only as needed to do their duties in connection with the Services; and
• (c) are informed of the confidential nature of Customer Data and of the Data Protection Laws.

6.2 Access Limitation

We will limit access to Customer Data to personnel who need it. They need it to provide the Services and to meet our duties under this DPA and the TOS.

7. Security Measures

7.1 Technical and Organizational Measures

We will implement and maintain appropriate technical and organizational security measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Annex II of this DPA describes these measures. We will design them to give a level of security appropriate to the risk. This takes into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. It also takes into account the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

7.2 Security Updates

We may update the security measures from time to time. We may do so only if the updates do not materially decrease the overall level of protection for Customer Data. We will document material changes to our security measures and give you that documentation on reasonable request.

7.3 Customer Security Responsibilities

You acknowledge that some security features of the Services depend on your configuration and use. You are responsible for:

• (a) configuring the Services properly, including access controls and user permissions;
• (b) ensuring that your Users comply with applicable security policies;
• (c) maintaining the security of your own systems and credentials; and
• (d) reviewing and implementing our security recommendations.

8. Sub-Processors

8.1 General Authorization

You give us general written authorization to engage Sub-Processors to process Customer Data on your behalf, subject to this Section 8. We keep a current list of Sub-Processors at Sub-Processor List.

8.2 Sub-Processor Obligations

We will ensure that each Sub-Processor is bound by a written agreement that imposes the same data protection duties as this DPA. In particular, the agreement must give sufficient guarantees to implement appropriate technical and organisational measures, including duties on confidentiality, security measures, and processing restrictions.

8.3 Notification of Changes

We will give you at least 30 calendar days' advance written notice before engaging any new Sub-Processor. We will give the same notice before making material changes to the use of an existing Sub-Processor. The notice will identify the Sub-Processor, the nature of the processing it will perform, and the location of processing.

If we must replace a Sub-Processor urgently to keep the Services secure or available, we may do so on shorter notice. We will give the notice described above as soon as practicable. Your right to object under Section 8.4 still applies, counted from that notice.

8.4 Customer Objection

You may object to the appointment of a new Sub-Processor by written notice to us within 30 calendar days of receiving the notification described in Section 8.3. The objection must include reasonable grounds relating to data protection. After receiving an objection, the parties will discuss it in good faith. They will try to reach a resolution that both accept. If they cannot reach one within 30 calendar days, you may terminate the affected Services without penalty. To do so, you must give us written notice within the following 15 days. We will then refund prepaid fees for the affected Services for the unused remainder of the then-current Subscription Term.

8.5 Liability for Sub-Processors

We remain liable to you for the acts and omissions of our Sub-Processors. We are liable to the same extent as if we had performed the processing ourselves.

9. Data Subject Rights

9.1 Assistance with Data Subject Requests

We will reasonably assist you in responding to requests from Data Subjects who exercise their rights under Data Protection Laws. These rights include access, rectification, erasure, restriction of processing, data portability, and objection. We will give this assistance taking into account the nature of the processing and the information available to us.

9.2 Redirect of Direct Requests

If a Data Subject makes a request directly to us about Customer Data, we will not respond except to acknowledge receipt and redirect the Data Subject to you. The exception is where applicable law requires otherwise. We will promptly tell you about any such request.

9.3 Costs

Some Data Subject requests need significant effort or resources beyond what is reasonably expected as part of the Services. For those, we may charge a reasonable fee. We may do so only if we tell you of the fee in advance.

10. Data Breach Notification

10.1 Notification Obligation

We will notify you without undue delay and, where feasible, within 48 hours of becoming aware of a Personal Data Breach affecting Customer Data. We will send the notice to the email addresses of your account owners and administrators. Notification is not an admission of fault or liability.

10.2 Content of Notification

The notification will include, to the extent reasonably available:

• (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records affected;
• (b) the name and contact details of our point of contact for more information;
• (c) a description of the likely consequences of the Personal Data Breach; and
• (d) a description of the measures taken or proposed to address the Personal Data Breach, including, where appropriate, measures to reduce its possible adverse effects.

10.3 Ongoing Obligations

If we cannot give all the information in Section 10.2 at the time of notification, we will give it in phases. We will do so without further undue delay, as it becomes available.

10.4 Cooperation

We will cooperate with you. We will take reasonable steps to help you investigate, mitigate, and remediate the Personal Data Breach. We will reasonably assist you in meeting your duties to notify Supervisory Authorities and Data Subjects of the breach, as Data Protection Laws require.

10.5 Record-Keeping

We will keep a record of Personal Data Breaches, as Data Protection Laws require. The record will include the facts of the breach, its effects, and the remedial action taken.

11. Data Protection Impact Assessments

We will reasonably assist you with data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities, where Data Protection Laws require them. We will take into account the nature of the processing and the information available to us. Our help may include information about our processing activities and our technical and organizational measures. It may also include any other information you reasonably need to complete the DPIA.

12. International Data Transfers

12.1 Transfers to Company

(a) From the UK: we are established in the United Kingdom, so your transfer of Customer Data to us from the UK is not a restricted transfer.

(b) From the EEA or Switzerland: transfers to us rely on the European Commission's adequacy decision for the United Kingdom (and the equivalent Swiss decision). If that decision stops applying, the Standard Contractual Clauses are incorporated into this DPA. Module 2 applies where you are a controller. Module 3 applies where you are a processor. Under those clauses, you are the data exporter and we are the data importer. These options apply:

• Clause 7 (docking) applies.
• Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in Section 8.3.
• The optional wording in Clause 11 does not apply.
• Clause 13: the supervisory authority is that of your EU establishment or, if none, of your EU representative, or otherwise Ireland's Data Protection Commission.
• Clauses 17 and 18: the laws and courts of Ireland apply.

Annexes I and II of this DPA complete Annexes I and II of the Standard Contractual Clauses. The Sub-Processor List completes Annex III.

12.2 Onward Transfers by Company

We may transfer Customer Data to Sub-Processors outside the UK and EEA only where:

• (a) the recipient is covered by UK adequacy regulations (including, for certified US companies, the UK Extension to the EU-U.S. Data Privacy Framework for the data concerned) and, for EEA-origin data, an equivalent EU adequacy decision; or
• (b) we have entered into the UK International Data Transfer Addendum or International Data Transfer Agreement and, for EEA-origin data, the Standard Contractual Clauses (Module 3) with the recipient, and have carried out a transfer risk assessment.

The Sub-Processor List identifies the safeguard we rely on for each Sub-Processor. On request, we will provide a summary of our transfer risk assessments.

12.3 Supplementary Measures

Where the transfer impact assessment or Data Protection Laws require it, we will implement supplementary technical, organizational, or contractual measures to ensure an adequate level of protection for Customer Data transferred internationally. These measures may include enhanced encryption, pseudonymization, or access controls.

12.4 Changes in Law

If we become aware that any law or practice in a destination country may prevent us from meeting our duties under this DPA or the Standard Contractual Clauses, we will promptly tell you. Where necessary, we will also cooperate with you to identify and put in place more safeguards or alternative transfer mechanisms.

13. Data Return and Deletion

13.1 Return

An account owner can request an export of Customer Data in JSON format through the Services. They can do so at any time during the term, and for 30 calendar days after termination or expiry of the TOS. The export covers your organization's records held in our database. These include contacts, conversations, messages, AI agent settings, knowledge source details and the organization's audit log. During the same period, we will also provide uploaded files, knowledge documents, voice-call records and retained call recordings that we hold, on request to privacy@masheev.com. We will reasonably assist you in exporting Customer Data during this period.

13.2 Deletion

At the end of the 30 day period in Section 13.1, or earlier if you instruct us in writing to delete Customer Data, we will delete Customer Data from our own systems within a further 30 days. We will also instruct our Sub-Processors to delete it. Sub-Processors delete it in line with their own retention schedules, which are described on the Sub-Processor List. We may keep Customer Data where UK law requires it. We will protect it and use it only for that purpose. Billing records and records of your acceptance of the TOS are Account Data and are kept under our Privacy Policy.

13.3 Backup Retention

Customer Data in backups is deleted when those backups expire under our backup schedule. Routine database backups are kept for a few days. A small number of named backups made before maintenance work are kept for longer. We retire them under our documented backup retention schedule. We do not restore deleted Customer Data into active use. We keep a record of deletions and re-apply it if a backup is ever restored. We will ensure that Customer Data in backup systems is protected by the security measures described in Annex II. We will also ensure that it is not actively processed for any purpose other than backup and recovery.

13.4 Anonymization

We may anonymise usage and performance metadata as Aggregate Data under Section 5.1(c), and keep it. We do not anonymise the content of Customer Data as an alternative to deleting it.

13.5 Certification of Deletion

On your written request, we will confirm in writing that Customer Data has been deleted under this Section 13.

14. Audit Rights

14.1 Audit Reports

On your written request, we will make available to you all information necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA. We will do so subject to appropriate confidentiality duties. This includes:

• a description of our technical and organisational measures;
• written answers to reasonable security questionnaires;
• our records of processing;
• summaries of relevant policies and test results; and
• the available assurance reports of our Sub-Processors.

We do not currently hold our own independent security certification. If we obtain one, we will make the report available on the same basis.

14.2 Additional Audits

If you reasonably decide that the information given under Section 14.1 is not enough to verify our compliance with this DPA, you may request an extra audit. These conditions apply:

• (a) you must give at least 30 calendar days' advance written notice of the audit;
• (b) the audit must take place during regular business hours, in a way that minimizes disruption to our operations;
• (c) you bear all costs of the audit, including any third-party auditor fees;
• (d) the audit scope is limited to our processing activities covered by this DPA;
• (e) you may conduct no more than one audit per 12 month period, unless a Personal Data Breach or Supervisory Authority investigation requires an extra audit; and
• (f) the auditor must be bound by appropriate confidentiality duties.

14.3 Supervisory Authority Audits

We will cooperate with any audit or investigation by a Supervisory Authority to the extent Data Protection Laws require. We will promptly tell you of any such audit or investigation (to the extent the law permits).

15. Term and Termination

15.1 Term

This DPA takes effect on the date the TOS take effect and stays in force for the duration of the TOS.

15.2 Survival

This DPA survives termination or expiry of the TOS until all Customer Data has been deleted or returned under Section 13 of this DPA. Sections that by their nature should survive termination also survive, including:

• Section 6 (Confidentiality);
• Section 10 (Data Breach Notification);
• Section 13 (Data Return and Deletion);
• Section 14 (Audit Rights);
• Section 16 (Limitation of Liability);
• Section 17 (General Provisions);
• Section 18 (US State Privacy Laws); and
• Section 19 (Health Data and HIPAA).

16. Limitation of Liability

Each party's aggregate liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the TOS. These include the separate cap for data protection claims in Section 12.1A of the TOS. To be clear, our total aggregate liability under the TOS and this DPA combined will not exceed the limitations in the TOS. Nothing in this DPA limits either party's liability for matters that cannot be limited under applicable law. These include liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation. Nothing in this DPA limits your duties under Sections 6 and 13 of the TOS.

17. General Provisions

17.1 Conflict

If this DPA conflicts with any other agreement between the parties, this DPA prevails on the processing of Personal Data, subject to Section 18.8 of the TOS.

17.2 Amendments

This DPA may be amended only by a written instrument signed by both parties. We may also amend it by providing updated terms with reasonable advance notice under the amendment provisions of the TOS. We will give you at least 30 calendar days' advance notice of material changes to this DPA.

17.3 Severability

If any provision of this DPA is found to be invalid or unenforceable, the rest stays in full force and effect. The parties will negotiate in good faith to replace the invalid or unenforceable provision with a valid one. The replacement should achieve the parties' original intent as far as possible.

17.4 Governing Law

The laws specified in the TOS govern this DPA and its interpretation, without regard to conflict of laws principles. For Data Subjects located in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to the extent required.

17.5 Entire Agreement

This DPA, together with the TOS, the Standard Contractual Clauses (where applicable), and any annexes to it, is the entire agreement between the parties on the processing of Personal Data in connection with the Services. It replaces all earlier or contemporaneous agreements, understandings, or representations on that subject.

17.6 Contact

For questions or requests relating to this DPA, you may contact us at:

• Email: privacy@masheev.com
• Website: masheev.com/legal/privacy

18. US State Privacy Laws

18.1 Service Provider and Processor Terms

Where the CCPA or another US State Privacy Law or Consumer Health Data Law applies to Customer Data, we act as your "service provider" or "processor" and:

• (a) will process Customer Data only for the limited and specified business purposes of providing, securing, maintaining and supporting the Services as described in the TOS, this DPA and Annex I (the "Business Purposes");
• (b) will not sell or share Customer Data, as "sell" and "share" are defined in the CCPA;
• (c) will not retain, use or disclose Customer Data for any purpose other than the Business Purposes, including any commercial purpose, or outside the direct business relationship between you and us, except as permitted by the CCPA and its regulations;
• (d) will not combine Customer Data with personal information we receive from or on behalf of another person, or collect from our own interactions with consumers, except as permitted by the CCPA and its regulations;
• (e) will comply with the applicable duties of those laws and provide the same level of privacy protection as they require;
• (f) grant you the right to take reasonable and appropriate steps to ensure we use Customer Data consistently with your duties, and, on notice, to stop and remediate unauthorised use;
• (g) will notify you if we determine we can no longer meet our duties under those laws;
• (h) will impose a duty of confidentiality on each person processing Customer Data, flow these duties down to Sub-Processors by written contract, and give you notice of, and an opportunity to object to, new Sub-Processors under Section 8;
• (i) will delete or return Customer Data at the end of the Services under Section 13, unless retention is required by law;
• (j) will make available information necessary to demonstrate compliance and allow reasonable assessments under Section 14;
• (k) will help you respond to consumer requests and conduct data protection assessments under Sections 9 and 11; and
• (l) will act on any consumer request that you tell us about and that we must follow, and you will give us the information needed to do so.

We certify that we understand and will comply with the restrictions in this Section 18.1.

18.2 De-identified Data

If we receive de-identified data, we will take reasonable measures to ensure the data cannot be associated with an individual. We will publicly commit to maintain and use the data in de-identified form. We will not attempt to re-identify the data.

19. Health Data and HIPAA

We are not a business associate under HIPAA and do not sign Business Associate Agreements. You must not use the Services to create, receive, maintain or transmit protected health information. Where Consumer Health Data Laws apply, we will process consumer health data only under this DPA and your instructions.

Annex I: Details of Processing

This Annex forms part of the DPA and describes how we process Customer Data.

Annex II: Technical and Organizational Security Measures

This Annex forms part of the DPA and describes the technical and organizational security measures we use to protect Customer Data.

1. Encryption

• In Transit: Connections to the Services use TLS (version 1.2 or higher).
• At Rest: Databases, backups and file storage are encrypted at rest by our hosting providers (PlanetScale and Cloudflare) using their standard controls. Third-party integration credentials are also encrypted by the application with AES-256-GCM. This is not end-to-end encryption of communications.

2. Access Control

• Role-Based Access Control: Application access is role-based and checked on the server for every request. Data is separated by organization.
• Administrator Authentication: Our administrator functions in the application require multi-factor step-up authentication. Organization users can turn on multi-factor authentication for their own accounts.
• Staff Access: No application feature lets our personnel browse Customer conversations. Access to production data for support, security and legal purposes, including review under Section 10 of the Acceptable Use Policy, is limited to named personnel. It is logged where the platform supports it.

3. Security Testing

• Release Checks: We run automated dependency, secret and code checks before release. We review security-relevant changes.
• Independent Testing: We do not currently hold an independent penetration test report or security certification. We will describe the scope and date of any test we commission.
• Remediation: We fix identified vulnerabilities in order of their severity and risk.

4. Incident Response

• We keep a documented incident response and breach notification procedure. We review it at least once a year and after any significant incident.

5. Personnel

• Everyone with access to Customer Data is bound by confidentiality duties. They receive data protection and security instructions before they are given access.

6. Sub-Processors

• We review each Sub-Processor's security and privacy terms before use. We enter into a written contract with the duties required by Section 8.

7. Backup and Recovery

• Production databases are backed up automatically by the database provider. Backups are encrypted at rest. We keep documented restoration procedures. We re-apply deletion records to any restored data before it is used.

8. Platform Protection and Monitoring

• The Services run on Cloudflare's managed platform. It provides network-level protection against denial-of-service and common web attacks. We use rate limiting, signature checks on incoming provider webhooks, and error monitoring configured to exclude message content.
• We keep audit logs of significant actions within each organization for 24 months.