Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into by and between the entity identified as "Customer" in the applicable Terms of Service ("Customer" or "Controller") and DA592 LTD, trading as Masheev ("Company," "we," "us," or "our," also referred to as "Processor").

This DPA supplements and forms part of the Terms of Service ("TOS") between Customer and Company, and governs the processing of Personal Data by Company on behalf of Customer in connection with the Services.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given to them in the TOS. The following terms have the meanings set forth below:

2. Scope and Application

2.1 Applicability

This DPA applies to the processing of Customer Data by Company on behalf of Customer as Processor in connection with the provision of the Services under the TOS. This DPA is incorporated into and forms part of the TOS.

2.2 Duration

This DPA shall remain in effect for the duration of the TOS and shall continue until all Customer Data has been deleted or returned in accordance with Section 13 of this DPA.

2.3 Precedence

In the event of any conflict or inconsistency between this DPA and the TOS, this DPA shall prevail with respect to matters relating to the processing of Personal Data, in line with the order of precedence in Section 18.8 of the TOS. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

2.4 Scope of Processing

The subject matter, duration, nature and purpose of the processing, the types of Personal Data processed, and the categories of Data Subjects are described in Annex I of this DPA.

3. Roles of the Parties

3.1 Customer as Controller

Customer is the Controller of Customer Data and determines the purposes and means of processing Customer Data. Customer retains all rights, title, and interest in Customer Data.

3.2 Company as Processor

Company shall process Customer Data only as a Processor acting on behalf of and under the documented instructions of Customer, as set forth in this DPA, the TOS, and Customer's configuration and use of the Services.

3.3 Company as Independent Controller

Company acts as an independent Controller with respect to Account Data, including data necessary for billing, account administration, usage analytics, platform improvement, compliance with legal obligations, and communication with Customer regarding the Services. Company's processing of Account Data as Controller is governed by the Company's Privacy Policy.

4. Customer Obligations

4.1 Lawfulness of Processing

Customer is responsible for ensuring that the processing of Customer Data is carried out in accordance with applicable Data Protection Laws. This includes, but is not limited to:

• (a) establishing and maintaining a valid legal basis for the processing of Personal Data, including obtaining any necessary consents from Data Subjects;
• (b) providing appropriate privacy notices to Data Subjects informing them of how their Personal Data will be processed, including by Company as a Processor;
• (c) ensuring the accuracy, quality, and relevance of Customer Data provided to Company; and
• (d) ensuring that Customer's instructions to Company comply with applicable Data Protection Laws.

4.2 Special Category and Regulated Data

(a) General rule. Customer shall not provide, and shall ensure that its Users and AI Agents do not request, Special Category Data (as defined under Article 9 of the UK GDPR or equivalent provisions of applicable Data Protection Laws), personal data relating to criminal convictions and offences, protected health information under HIPAA, payment cardholder data, or other data listed in Section 7 of the Acceptable Use Policy, except as permitted by Section 4.2(b) or a separate written agreement signed by both parties.

(b) Limited Health Data. A Customer that provides health, care, wellness, or aesthetic services and is not a HIPAA covered entity or business associate may process Limited Health Data through the Services. "Limited Health Data" means the minimum health information needed to book, change, or cancel an appointment or to pass a message to Customer's staff, such as the type of appointment requested, and health information that an End-User volunteers without being asked. Customer is responsible for having a condition for processing under Article 9(2) of the UK GDPR and, where relevant, Schedule 1 of the Data Protection Act 2018, and for any consent, notice, and privacy policy required by Consumer Health Data Laws. Customer shall configure its AI Agents not to ask for symptoms, diagnoses, medications, test results, or treatment history.

(c) Incidental information. End-Users may disclose special category data or other sensitive information in their communications without being asked. Company will process that information as part of Customer Data under this DPA. Customer is responsible for having an appropriate lawful basis and Article 9 condition (or equivalent) for that processing and for any additional notices.

(d) Restricted uses. Customer must not, without Company's prior written agreement: (i) use the Services to collect special category data, criminal offence data or consumer health data as a deliberate part of a workflow (for example, intake questionnaires about medical conditions), beyond Limited Health Data; (ii) process protected health information subject to HIPAA (Company does not sign Business Associate Agreements, so Customer must not use the Services as or for a HIPAA covered entity or business associate to handle protected health information); (iii) configure the Services to identify individuals by their voice or other biometric data; or (iv) direct the Services at children or knowingly collect children's Personal Data.

(e) Consumer health data. Where Company processes consumer health data under the Washington My Health My Data Act or a similar law, Company acts as Customer's processor, processes it only on Customer's documented instructions in this DPA, and will assist Customer, taking into account the nature of the processing, in meeting Customer's obligations under that law.

(f) Data received in breach. If Customer or an End-User provides data in breach of this Section 4.2, Customer is responsible for meeting all legal requirements for its processing, and Company may suspend the affected processing and delete or redact that data.

4.3 Customer Warranties

Customer warrants that it has all necessary rights, permissions, and legal bases to provide Customer Data to Company and to authorize Company to process Customer Data in accordance with this DPA and the TOS.

Where Customer connects an email inbox or forwards mail to the Services, Customer further warrants that: (a) Customer acts as the Controller in respect of all message content and correspondent data ingested from that mailbox, including communications authored by third-party correspondents; and (b) Customer has provided all notices and satisfied all transparency obligations owed to such correspondents and other Data Subjects under Articles 13 and 14 of the UK GDPR (and equivalent provisions of applicable Data Protection Laws), including informing them, where required, that their communications may be processed by an AI-powered service provider on Customer's behalf.

4.4 Communications

Customer's instructions to Company include every Communication (as defined in the TOS) that Customer, its Users, or its AI Agents, automations, workflows, or integrations send, place, or answer through the Services. Company processes those Communications as a Processor acting on Customer's instructions. Customer remains responsible, as Controller and as the sender or caller of each Communication, for the lawful basis, consents, opt-outs, notices, and other requirements described in Section 6 of the TOS.

4.5 Customer Websites and Device Storage

When Customer installs Company's chat widget or SDK on its websites or apps, Customer controls those sites. The widget stores a random visitor identifier and session token in the End-User's browser so a conversation can continue. Customer is responsible for: (a) its own cookie and storage notices and any consent required under the Privacy and Electronic Communications Regulations 2003 or equivalent laws; (b) linking the widget to Customer's own privacy notice in the widget settings; and (c) turning on the widget's consent option where Customer's legal analysis requires consent before a chat starts. Company will provide the widget settings and documentation needed to do this.

4.6 Automated Decisions

The Services generate AI outputs, including replies, summaries, classifications, sentiment and satisfaction estimates. Customer must not use the Services to make decisions that have a legal or similarly significant effect on an individual based solely on automated processing, unless Customer has put in place the safeguards required by Data Protection Laws, including meaningful human review on request. Section 4.2 of the Acceptable Use Policy lists uses of this kind that are not permitted at all.

5. Processing Instructions

5.1 Documented Instructions

Company shall process Customer Data only in accordance with Customer's documented instructions. The parties agree that the following constitute Customer's documented instructions to Company:

• (a) processing as set forth in the TOS and this DPA;
• (b) processing initiated by Customer or its Users through their configuration and use of the Services; and
• (c) processing to comply with any other reasonable, documented instructions provided by Customer that are consistent with the terms of the TOS and this DPA.

5.2 Additional Instructions

If Customer requires processing beyond the scope of the instructions described in Section 5.1, the parties shall negotiate in good faith a separate written agreement governing such processing, including any additional fees that may apply.

5.3 Notification of Unlawful Instructions

If Company becomes aware that a Customer instruction may violate applicable Data Protection Laws, Company shall promptly notify Customer. Company shall not be required to carry out an instruction that it reasonably believes violates applicable Data Protection Laws, and may suspend the relevant processing until the matter is resolved. Company is not obligated to independently assess whether Customer's instructions comply with applicable law, but will act in good faith to identify potential issues.

5.4 Processing Required by Law

Company may process Customer Data other than on Customer's instructions only where required to do so by UK law or other law to which Company is subject. In that case Company will inform Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest. Company will not transfer Customer Data to a third country or international organisation except on Customer's documented instructions (which include Customer's use of the Services as described in this DPA and the Sub-Processor List) or where so required by law.

6. Confidentiality

6.1 Personnel Obligations

Company shall ensure that all personnel authorized to process Customer Data:

• (a) are bound by appropriate confidentiality obligations, whether by contract, statute, or professional obligation;
• (b) process Customer Data only as necessary to perform their duties in connection with the Services; and
• (c) are informed of the confidential nature of Customer Data and the applicable Data Protection Laws.

6.2 Access Limitation

Company shall limit access to Customer Data to those personnel who require access in order to perform the Services and fulfill Company's obligations under this DPA and the TOS.

7. Security Measures

7.1 Technical and Organizational Measures

Company shall implement and maintain appropriate technical and organizational security measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, as described in Annex II of this DPA. These measures shall be designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

7.2 Security Updates

Company may update the security measures from time to time, provided that such updates do not materially decrease the overall level of protection afforded to Customer Data. Company shall document material changes to its security measures and make such documentation available to Customer upon reasonable request.

7.3 Customer Security Responsibilities

Customer acknowledges that certain security features of the Services depend on Customer's configuration and use. Customer is responsible for:

• (a) properly configuring the Services, including access controls and user permissions;
• (b) ensuring that its Users comply with applicable security policies;
• (c) maintaining the security of its own systems and credentials; and
• (d) reviewing and implementing security recommendations provided by Company.

8. Sub-Processors

8.1 General Authorization

Customer provides a general written authorization to Company to engage Sub-Processors to process Customer Data on behalf of Customer, subject to the requirements of this Section 8. A current list of Sub-Processors is maintained at Sub-Processor List.

8.2 Sub-Processor Obligations

Company shall ensure that each Sub-Processor is bound by a written agreement that imposes the same data protection obligations as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, including obligations regarding confidentiality, security measures, and processing restrictions.

8.3 Notification of Changes

Company shall provide Customer with at least thirty (30) calendar days' advance written notice before engaging any new Sub-Processor or making material changes to the use of an existing Sub-Processor. Such notice shall identify the Sub-Processor, the nature of the processing to be performed, and the location of processing.

8.4 Customer Objection

Customer may object to the appointment of a new Sub-Processor by providing written notice to Company within thirty (30) calendar days of receiving the notification described in Section 8.3. The objection must include reasonable grounds relating to data protection. Upon receiving an objection, the parties shall discuss the objection in good faith and attempt to reach a mutually acceptable resolution. If no resolution can be reached within thirty (30) calendar days, Customer may terminate the affected Services without penalty by providing written notice to Company within the following fifteen (15) days, and Company will refund prepaid fees for the affected Services for the unused remainder of the then-current Subscription Term.

8.5 Liability for Sub-Processors

Company shall remain liable to Customer for the acts and omissions of its Sub-Processors to the same extent as if Company had performed the processing itself.

9. Data Subject Rights

9.1 Assistance with Data Subject Requests

Company shall provide reasonable assistance to Customer in responding to requests from Data Subjects exercising their rights under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction of processing, data portability, and objection. Such assistance shall be provided taking into account the nature of the processing and the information available to Company.

9.2 Redirect of Direct Requests

If Company receives a request from a Data Subject directly in relation to Customer Data, Company shall not respond to the request except to acknowledge receipt and redirect the Data Subject to Customer, unless otherwise required by applicable law. Company shall promptly notify Customer of any such request received.

9.3 Costs

Where assistance with Data Subject requests requires significant effort or resources beyond what is reasonably expected as part of the Services, Company may charge a reasonable fee for such assistance, provided that Company informs Customer of the fee in advance.

10. Data Breach Notification

10.1 Notification Obligation

Company shall notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Data. Notice will be sent to the email addresses of Customer's account owners and administrators. Notification is not an admission of fault or liability.

10.2 Content of Notification

The notification shall include, to the extent reasonably available:

• (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records affected;
• (b) the name and contact details of Company's point of contact for further information;
• (c) a description of the likely consequences of the Personal Data Breach; and
• (d) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

10.3 Ongoing Obligations

If it is not possible to provide all of the information described in Section 10.2 at the time of notification, Company shall provide the information in phases without further undue delay as it becomes available.

10.4 Cooperation

Company shall cooperate with Customer and take reasonable steps to assist Customer in investigating, mitigating, and remediating the Personal Data Breach. Company shall provide reasonable assistance to Customer in fulfilling Customer's obligations to notify Supervisory Authorities and Data Subjects of the breach, as required by applicable Data Protection Laws.

10.5 Record-Keeping

Company shall maintain a record of Personal Data Breaches, including the facts surrounding the breach, its effects, and the remedial action taken, in accordance with applicable Data Protection Laws.

11. Data Protection Impact Assessments

Company shall provide reasonable assistance to Customer in conducting data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities, where required under applicable Data Protection Laws, taking into account the nature of the processing and the information available to Company. Such assistance may include providing information about Company's processing activities, technical and organizational measures, and any other information reasonably necessary for Customer to complete the DPIA.

12. International Data Transfers

12.1 Transfers to Company

(a) From the UK: Company is established in the United Kingdom, so Customer's transfer of Customer Data to Company from the UK is not a restricted transfer.

(b) From the EEA or Switzerland: transfers to Company rely on the European Commission's adequacy decision for the United Kingdom (and the equivalent Swiss decision). If that decision ceases to apply, the Standard Contractual Clauses (Module 2 where Customer is a controller, Module 3 where Customer is a processor) are incorporated into this DPA with these options: Clause 7 (docking) applies; Clause 9(a) Option 2 (general written authorisation) with the notice period in Section 8.3; the optional wording in Clause 11 does not apply; Clause 13: the supervisory authority of Customer's EU establishment or, if none, of its EU representative, or otherwise Ireland's Data Protection Commission; Clauses 17 and 18: the laws and courts of Ireland. Annexes I and II of this DPA complete Annexes I and II of the Standard Contractual Clauses and the Sub-Processor List completes Annex III.

12.2 Onward Transfers by Company

Company may transfer Customer Data to Sub-Processors outside the UK and EEA only where: (a) the recipient is covered by UK adequacy regulations (including, for certified US companies, the UK Extension to the EU-U.S. Data Privacy Framework for the data concerned) and, for EEA-origin data, an equivalent EU adequacy decision; or (b) Company has entered into the UK International Data Transfer Addendum or International Data Transfer Agreement and, for EEA-origin data, the Standard Contractual Clauses (Module 3) with the recipient, and has carried out a transfer risk assessment. The Sub-Processor List identifies the safeguard Company relies on for each Sub-Processor. On request, Company will provide a summary of its transfer risk assessments.

12.3 Supplementary Measures

Where required by the transfer impact assessment or applicable Data Protection Laws, Company shall implement supplementary technical, organizational, or contractual measures to ensure an adequate level of protection for Customer Data transferred internationally. Such measures may include enhanced encryption, pseudonymization, or access controls.

12.4 Changes in Law

If Company becomes aware that any law or practice in a destination country may prevent Company from fulfilling its obligations under this DPA or the Standard Contractual Clauses, Company shall promptly notify Customer and, where necessary, cooperate with Customer to identify and implement additional safeguards or alternative transfer mechanisms.

13. Data Return and Deletion

13.1 Return

At any time during the term, and for thirty (30) calendar days after termination or expiry of the TOS, an account owner can request an export of Customer Data in JSON format through the Services. The export covers the organization's records held in Company's database, including contacts, conversations, messages, AI agent settings, knowledge source details and the organization's audit log. On request to privacy@masheev.com during the same period, Company will also provide uploaded files, knowledge documents, voice-call records and retained call recordings that Company holds. Company shall provide reasonable assistance to Customer in exporting Customer Data during this period.

13.2 Deletion

At the end of the thirty (30) day period in Section 13.1, or earlier if Customer instructs Company in writing to delete Customer Data, Company will delete Customer Data from its active systems and instruct its Sub-Processors to delete it, within a further thirty (30) days. Company may keep Customer Data where UK law requires it to, and will protect it and use it only for that purpose. Billing records and records of Customer's acceptance of the TOS are Account Data and are kept under Company's Privacy Policy.

13.3 Backup Retention

Customer Data in backups is deleted when those backups expire under Company's backup schedule. Routine database backups are kept for a few days. A small number of named backups made before maintenance work are kept for longer, and are retired under Company's documented backup retention schedule. Company does not restore deleted Customer Data into active use: it keeps a record of deletions and re-applies it if a backup is ever restored. Company shall ensure that Customer Data in backup systems is protected by the security measures described in Annex II and is not actively processed for any purpose other than backup and recovery.

13.4 Anonymization

Where appropriate and consistent with applicable Data Protection Laws, Company may anonymize Customer Data as an alternative to deletion. Anonymized data shall not be considered Personal Data and may be retained by Company for analytical and operational purposes.

13.5 Certification of Deletion

Upon Customer's written request, Company shall provide written confirmation that Customer Data has been deleted in accordance with this Section 13.

14. Audit Rights

14.1 Audit Reports

Company shall make available to Customer, upon written request and subject to appropriate confidentiality obligations, all information necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA, including a description of its technical and organisational measures, written answers to reasonable security questionnaires, its records of processing, summaries of relevant policies and test results, and the available assurance reports of its Sub-Processors. Company does not currently hold its own independent security certification. If it obtains one, it will make the report available on the same basis.

14.2 Additional Audits

If Customer reasonably determines that the information provided under Section 14.1 is insufficient to verify Company's compliance with this DPA, Customer may request an additional audit, subject to the following conditions:

• (a) Customer shall provide at least thirty (30) calendar days' advance written notice of the audit;
• (b) audits shall be conducted during regular business hours, in a manner that minimizes disruption to Company's operations;
• (c) Customer shall bear all costs of the audit, including any third-party auditor fees;
• (d) the audit scope shall be limited to Company's processing activities covered by this DPA;
• (e) Customer may conduct no more than one (1) audit per twelve (12) month period, unless a Personal Data Breach or Supervisory Authority investigation requires an additional audit; and
• (f) the auditor shall be bound by appropriate confidentiality obligations.

14.3 Supervisory Authority Audits

Company shall cooperate with any audit or investigation by a Supervisory Authority to the extent required by applicable Data Protection Laws, provided that Company shall promptly notify Customer of any such audit or investigation (to the extent permitted by law).

15. Term and Termination

15.1 Term

This DPA shall become effective on the date the TOS become effective and shall remain in force for the duration of the TOS.

15.2 Survival

This DPA shall survive termination or expiration of the TOS until all Customer Data has been deleted or returned in accordance with Section 13 of this DPA. Sections that by their nature should survive termination shall survive, including but not limited to Sections 6 (Confidentiality), 10 (Data Breach Notification), 13 (Data Return and Deletion), 14 (Audit Rights), 16 (Limitation of Liability), 17 (General Provisions), 18 (US State Privacy Laws), and 19 (Health Data and HIPAA).

16. Limitation of Liability

Each party's aggregate liability under or in connection with this DPA shall be subject to the limitations and exclusions of liability set forth in the TOS, including the separate cap for data protection claims in Section 12.1A of the TOS. For the avoidance of doubt, Company's total aggregate liability under both the TOS and this DPA combined shall not exceed the limitations set forth in the TOS. Nothing in this DPA shall limit either party's liability for matters that cannot be limited under applicable law, including liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation, or limit Customer's obligations under Sections 6 and 13 of the TOS.

17. General Provisions

17.1 Conflict

In the event of any conflict or inconsistency between this DPA and any other agreement between the parties, this DPA shall prevail with respect to the processing of Personal Data.

17.2 Amendments

This DPA may be amended only by a written instrument executed by both parties, or by Company providing updated terms with reasonable advance notice in accordance with the amendment provisions of the TOS. Material changes to this DPA shall be communicated to Customer with at least thirty (30) calendar days' advance notice.

17.3 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. The parties shall negotiate in good faith to replace the invalid or unenforceable provision with a valid provision that achieves the original intent of the parties to the greatest extent possible.

17.4 Governing Law

This DPA shall be governed by and construed in accordance with the laws specified in the TOS, without regard to conflict of laws principles. For Data Subjects located in the United Kingdom, the UK GDPR and the Data Protection Act 2018 shall apply to the extent required.

17.5 Entire Agreement

This DPA, together with the TOS, the Standard Contractual Clauses (where applicable), and any annexes hereto, constitutes the entire agreement between the parties with respect to the processing of Personal Data in connection with the Services and supersedes all prior or contemporaneous agreements, understandings, or representations on that subject.

17.6 Contact

For questions or requests relating to this DPA, Customer may contact Company at:

• Email: privacy@masheev.com
• Website: masheev.com/legal/privacy

18. US State Privacy Laws

18.1 Service Provider and Processor Terms

Where the CCPA or another US State Privacy Law or Consumer Health Data Law applies to Customer Data, Company acts as Customer's "service provider" or "processor" and:

• (a) will process Customer Data only for the limited and specified business purposes of providing, securing, maintaining and supporting the Services as described in the TOS, this DPA and Annex I (the "Business Purposes");
• (b) will not sell or share Customer Data, as "sell" and "share" are defined in the CCPA;
• (c) will not retain, use or disclose Customer Data for any purpose other than the Business Purposes, including any commercial purpose, or outside the direct business relationship between Customer and Company, except as permitted by the CCPA and its regulations;
• (d) will not combine Customer Data with personal information Company receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA and its regulations;
• (e) will comply with the applicable obligations of those laws and provide the same level of privacy protection as they require;
• (f) grants Customer the right to take reasonable and appropriate steps to ensure Company uses Customer Data consistently with Customer's obligations, and, on notice, to stop and remediate unauthorised use;
• (g) will notify Customer if Company determines it can no longer meet its obligations under those laws;
• (h) will impose a duty of confidentiality on each person processing Customer Data, flow these obligations down to Sub-Processors by written contract, and give Customer notice of and an opportunity to object to new Sub-Processors under Section 8;
• (i) will delete or return Customer Data at the end of the Services under Section 13, unless retention is required by law;
• (j) will make available information necessary to demonstrate compliance and allow reasonable assessments under Section 14; and
• (k) will help Customer respond to consumer requests and conduct data protection assessments under Sections 9 and 11.

Company certifies that it understands and will comply with the restrictions in this Section 18.1.

18.2 De-identified Data

If Company receives de-identified data, it will take reasonable measures to ensure it cannot be associated with an individual, publicly commit to maintain and use it in de-identified form, and not attempt to re-identify it.

19. Health Data and HIPAA

Company is not a business associate under HIPAA and does not sign Business Associate Agreements. Customer must not use the Services to create, receive, maintain or transmit protected health information. Where Consumer Health Data Laws apply, Company will process consumer health data only under this DPA and Customer's instructions.

Annex I: Details of Processing

This Annex forms part of the DPA and describes the processing of Customer Data by Company.

Annex II: Technical and Organizational Security Measures

This Annex forms part of the DPA and describes the technical and organizational security measures implemented by Company to protect Customer Data.

1. Encryption

• In Transit: Connections to the Services use TLS (version 1.2 or higher).
• At Rest: Databases, backups and file storage are encrypted at rest by Company's hosting providers (PlanetScale and Cloudflare) using their standard controls. Third-party integration credentials are additionally encrypted by the application with AES-256-GCM. This is not end-to-end encryption of communications.

2. Access Control

• Role-Based Access Control: Application access is role-based and checked on the server for every request, and data is separated by organization.
• Administrator Authentication: Company administrator functions in the application require multi-factor step-up authentication. Organization users can turn on multi-factor authentication for their own accounts.
• Staff Access: Company personnel do not have an application feature to read Customer conversations. Access to production data is limited to named personnel for support, security and legal purposes, and is logged where the platform supports it.

3. Security Testing

• Release Checks: Company runs automated dependency, secret and code checks before release and reviews security-relevant changes.
• Independent Testing: Company does not currently hold an independent penetration test report or security certification. It will describe the scope and date of any test it commissions.
• Remediation: Identified vulnerabilities are prioritized and remediated in accordance with their severity and risk.

4. Incident Response

• Company keeps a documented incident response and breach notification procedure, and reviews it at least once a year and after any significant incident.

5. Personnel

• Everyone with access to Customer Data is bound by confidentiality obligations and receives data protection and security instructions before being given access.

6. Sub-Processors

• Company reviews each Sub-Processor's security and privacy terms before use and enters into a written contract with the obligations required by Section 8.

7. Backup and Recovery

• Production databases are backed up automatically by the database provider, and backups are encrypted at rest. Company keeps documented restoration procedures and re-applies deletion records to any restored data before it is used.

8. Platform Protection and Monitoring

• The Services run on Cloudflare's managed platform, which provides network-level protection against denial-of-service and common web attacks. Company uses rate limiting, signature checks on incoming provider webhooks, and error monitoring configured to exclude message content.
• Company keeps audit logs of significant actions within each organization for 24 months.