AtlaSent
Schedule a call
☰
ProductsAction CatalogAll productsProduction Change ProtectionAI Action ProtectionAI Circuit BreakerEnterpriseStart hereHow it worksSee it refuse a deployFAQMore actionsData releaseFinanceLife sciencesDevelopersDeveloper pathGet your API keyDocsCompanyPricingTrustPartnersAboutContact sales
Legal

Data Processing Agreement

Version 1.0 · effective 2026-09-14

Status: Founder approved standard form. Version: 1.0 Effective date: September 14, 2026.

Correction — October 1, 2026. Annex II §§II.3, II.5, II.9 and II.10 described several operational controls as already operating. AtlaSent's internal control record shows they are documented but have not yet been executed: no backup restore drill has been performed, no personnel access review or security-awareness training has been recorded, point-in-time recovery has not been verified, and production changes are authored, reviewed and deployed by a single accountable person. Those bullets are restated below as what is true on the Effective Date. This is the same class of correction made to §7.5(iii), §9.1 and Annex II.4 on September 18, 2026.

Correction — October 1, 2026 (recovery targets). Annex II.2 stated "RPO 5 minutes, RTO 1 hour (operational targets per the SLA)". The SLA states no recovery targets, and no restore has ever been measured. II.2 now states the targets AtlaSent can support, and II.3 records that point-in-time recovery was enabled on the runtime production database on October 1, 2026.

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement, Order Form, or other written or electronic agreement between AtlaSent Systems, Inc. ("AtlaSent") and the customer identified in such agreement ("Customer") for the provision of the AtlaSent service (the "Agreement").

This DPA reflects the parties' agreement on the Processing of Customer Personal Data in connection with applicable Data Protection Laws. If there is a conflict between this DPA and any other terms in the Agreement on the Processing of Customer Personal Data, this DPA prevails.

2. Definitions

  • "Customer Personal Data" means Personal Data that Customer, or any End User on Customer's behalf, submits to or causes to be Processed by the AtlaSent service.
  • "Data Protection Laws" means all data protection and privacy laws applicable to the Processing of Customer Personal Data under the Agreement, including: the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR"); the UK GDPR and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and any other applicable laws of similar effect.
  • "EU SCCs" means the Standard Contractual Clauses approved by European Commission Decision 2021/914 of 4 June 2021, in the form available at https://eur-lex.europa.eu/eli/dec_impl/2021/914.
  • "UK IDTA" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
  • "Processing", "Personal Data", "Data Subject", "Controller", "Processor", "Sub-processor", and "Personal Data Breach" have the meanings given in the EU GDPR (or the equivalent terms under the UK GDPR or the CCPA where the context requires).
  • "Sub-processor" has the meaning given in Annex III.

3. Roles of the parties

With respect to Customer Personal Data:

  • Customer is the Controller (or, where Customer is acting as a Processor on behalf of a third-party Controller, the Processor).
  • AtlaSent is the Processor (or, where Customer is a Processor, AtlaSent is a Sub-processor of such third-party Controller).

Under the CCPA, Customer is the Business and AtlaSent is the Service Provider as defined in Cal. Civ. Code § 1798.140.

3.A Customer-as-Processor warranties

Where Customer acts as a Processor or Sub-processor under §3, Customer represents and warrants that:

(a) Customer has obtained all necessary authorizations and documented instructions from each relevant Controller to engage AtlaSent under this DPA, the EU SCCs Module 3, and the UK IDTA; (b) Customer's instructions to AtlaSent are consistent with each such Controller's documented instructions; (c) Customer will promptly inform AtlaSent of any change in such instructions that affects AtlaSent's Processing; and (d) Customer will defend, indemnify, and hold AtlaSent harmless from any third-party claim (including a claim by any such Controller or a Data Subject) arising from any breach of clauses (a)–(c) by Customer or by the Controller on whose behalf Customer acts.

The indemnity in clause (d) is uncapped and is not subject to any limitation of liability in the Agreement.

4. Subject matter, duration, nature, and purpose of Processing

The details of the Processing are set out in Annex I. In summary:

  • Subject matter: the provision of the AtlaSent service to Customer.
  • Duration: the term of the Agreement, plus the deletion or return period set out in §12.
  • Nature and purpose: evaluating, recording, and verifying authorization decisions for Customer's actors and actions; storing the resulting decision and audit-chain records; and providing Customer access to those records through the AtlaSent API and Console.
  • Categories of Data Subjects: those identified in Annex I.
  • Categories of Personal Data: those identified in Annex I.

5. Customer instructions

AtlaSent will Process Customer Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by applicable law to which AtlaSent is subject. Customer's documented instructions are:

(a) this DPA; (b) the Agreement and any Order Form; and (c) Customer's lawful use of the Service in accordance with the Documentation, including the parameters Customer specifies through the Console or API for the configuration of the Service.

Any instruction materially outside the scope of (a)–(c) must be agreed in writing. AtlaSent's acceptance of any individual API call is not, of itself, AtlaSent's agreement that the call constitutes a documented instruction beyond (a)–(c). Nothing in this §5 imposes on AtlaSent any duty to monitor Customer's use of the Service.

If AtlaSent reasonably believes a documented instruction infringes Data Protection Laws, AtlaSent will inform Customer promptly and may suspend performance of that instruction (without breach of the Agreement and without liability) until Customer confirms or amends it.

6. CCPA / CPRA service-provider terms

Where AtlaSent Processes Customer Personal Data on behalf of Customer as a Service Provider under the CCPA:

  1. AtlaSent will not "sell" or "share" (as those terms are defined in the CCPA) Customer Personal Data.
  2. AtlaSent will not retain, use, or disclose Customer Personal Data for any purpose other than for the specific purpose of performing the services specified in the notice in §6.7 (the "Business Purpose"), except as otherwise permitted by the CCPA.
  3. AtlaSent will not retain, use, or disclose Customer Personal Data outside of the direct business relationship between AtlaSent and Customer.
  4. AtlaSent will not combine Customer Personal Data with personal information that AtlaSent receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, except as expressly permitted under the CCPA.
  5. AtlaSent certifies that it understands the restrictions in this §6 and will comply with them.
  6. Customer has the right to take reasonable and appropriate steps to ensure that AtlaSent uses Customer Personal Data consistent with Customer's obligations under the CCPA, and to remediate unauthorized use; this right is exercised in accordance with §9 (Audits).

6.7 Notice to AtlaSent

Customer hereby provides AtlaSent with notice, in accordance with Cal. Civ. Code §1798.100(d), that the only purpose for which AtlaSent may Process Customer Personal Data is the Business Purpose, comprising the provision, support, maintenance, and security of the Service as described in the Agreement and Documentation. This DPA constitutes the notice required by Cal. Civ. Code §1798.100(d) and the corresponding regulations promulgated by the California Privacy Protection Agency.

7. AtlaSent obligations

AtlaSent will:

  1. Confidentiality. Ensure that personnel authorized to Process Customer Personal Data are under appropriate obligations of confidentiality.
  2. Security. Implement and maintain the technical and organizational measures set out in Annex II to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
  3. Data Subject requests. Without undue delay, notify Customer of any request received directly from a Data Subject concerning their Personal Data, and assist Customer in responding to such requests using appropriate technical and organizational measures, as provided in §7.6.
  4. Assistance with obligations. Provide Customer with reasonable assistance, taking into account the nature of the Processing and the information available to AtlaSent, in complying with Customer's obligations under Articles 32 to 36 of the EU GDPR (security, breach notification, data protection impact assessments, prior consultation).
  5. Information. Make available to Customer, on request, (i) the then-current list of Sub-processors (Annex III); (ii) the technical and organizational measures (Annex II); (iii) the most recent third-party independent assessment report available to AtlaSent, if any (as of the Effective Date of this DPA, AtlaSent holds no third-party independent assessment report: no independent penetration test has been performed and no SOC 2 examination of any type has been completed. From the date of completion of AtlaSent's first independent penetration test, the then-current penetration test summary; and from the date of completion of AtlaSent's first SOC 2 Type II audit, the then-current SOC 2 Type II report); and (iv) AtlaSent's responses to a Customer-specific or industry- standard security questionnaire (such as the CAIQ or SIG). All such materials are provided subject to confidentiality and may be subject to a non-disclosure agreement at AtlaSent's reasonable request.

7.6 DSAR response

AtlaSent will provide Customer with the information or assistance reasonably required to respond to a Data Subject request within seven (7) business days of Customer's properly-formed request, subject to extension by written agreement for complex requests. AtlaSent will bear its own costs of providing such assistance where the request relates to AtlaSent's own decisions or measures as Processor; otherwise, Customer will reimburse AtlaSent for reasonable costs at AtlaSent's then-current professional-services rates.

7.7 Government Access Requests

AtlaSent will:

(a) review each request from a government or law-enforcement authority for Customer Personal Data (each, a "Government Access Request") for validity under applicable law and challenge any Government Access Request that is overbroad, unlawful, or inconsistent with the EU SCCs Module 2 Clause 15 (and corresponding UK IDTA and Swiss provisions); (b) provide Customer with prompt written notice of any Government Access Request affecting Customer Personal Data, unless legally prohibited from doing so; (c) where prohibited from notifying Customer, use commercially reasonable efforts to obtain a waiver of the prohibition and to document AtlaSent's efforts so the documentation may, if and when the prohibition is lifted, be provided to Customer; and (d) publish or make available, on a periodic basis, a transparency report summarizing the volume of Government Access Requests received and AtlaSent's response, to the extent legally permitted.

8. International transfers

If Customer Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to AtlaSent or any Sub-processor in a country that has not received an adequacy decision from the European Commission (or, for UK transfers, from the UK Secretary of State):

  1. The parties incorporate by reference the EU SCCs, Module 2 (Controller to Processor) with Customer as the data exporter and AtlaSent as the data importer, with the optional Clause 7 (Docking Clause) included and the optional Clause 11(a) (Independent Dispute Resolution) excluded. Where Customer is acting as a Processor on behalf of a third-party Controller, Module 3 (Processor to Processor) applies instead.
  2. The UK IDTA applies to transfers of Personal Data subject to the UK GDPR, with the EU SCCs as the approved transfer mechanism and the UK IDTA modifying the EU SCCs as set out in the IDTA's Part 2.
  3. The annexes to the EU SCCs are populated by Annex I (description of transfer), Annex II (technical and organizational measures), and Annex III (sub-processors) of this DPA.
  4. For transfers from Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority, and references in the EU SCCs to "Member State" shall be read to include Switzerland for purposes of the Swiss FADP.

9. Audits

AtlaSent will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, subject to the following:

  1. Customer may request, no more than once per twelve (12) month period (or as required by a competent supervisory authority or as provided in §9.5), a copy of AtlaSent's then-current SOC 2 Type II report (or, until such report is available, AtlaSent's most recent independent penetration test summary, once such a test has been completed) and responses to Customer's standardized security questionnaire (CAIQ or SIG). As of the Effective Date neither an independent assessment report nor a penetration test summary exists (see §7.5(iii)), so until the first such report is issued this paragraph makes available the questionnaire responses only. This will normally satisfy Customer's audit rights under Article 28(3)(h) of the EU GDPR.
  2. If the documents in (1) do not address a specific concern, Customer may request an additional written or remote audit. Such audits will be conducted at Customer's expense, during business hours, with reasonable advance notice (not less than thirty (30) days except as provided in §9.5), and in a manner that minimizes disruption to AtlaSent's operations and other customers.
  3. On-premise audits of AtlaSent's facilities or sub-processors' facilities are limited to circumstances where the documents in (1) and a remote audit do not address the specific concern, and require AtlaSent's prior written agreement on scope, timing, conduct, and confidentiality.
  4. Customer will treat all information obtained under this §9 as AtlaSent's Confidential Information and may use it only to verify AtlaSent's compliance with this DPA.

9.5 Material Adverse Event

Notwithstanding §9.1–9.3, in the event of (a) a Personal Data Breach materially affecting Customer Personal Data, (b) a credible allegation that AtlaSent has materially breached this DPA, or (c) a directive from a competent supervisory authority specifically directed at AtlaSent's processing of Customer Personal Data (each, a "Material Adverse Event"), Customer may request, on fourteen (14) days' written notice (or such shorter period as the supervisory authority requires), an additional audit reasonably tailored to the Material Adverse Event. AtlaSent will cooperate in good faith and will bear its own costs for an audit triggered under §9.5(a) or §9.5(b) where the Material Adverse Event is determined to be attributable to AtlaSent's fault.

10. Personal Data Breach notification

AtlaSent will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Where AtlaSent has confirmed that a Personal Data Breach has caused or is reasonably likely to cause adverse impact to Customer or Data Subjects, AtlaSent will use commercially reasonable efforts to notify Customer within twenty-four (24) hours of such confirmation; the 24-hour commitment is an operational target and does not extend, replace, or toll the 72-hour contractual maximum.

The notification will include, to the extent then known and reasonable:

  • A description of the nature of the Personal Data Breach.
  • The categories and approximate number of Data Subjects and Customer Personal Data records concerned.
  • AtlaSent's then-current assessment of the likely consequences of the Personal Data Breach, which assessment AtlaSent may revise as additional information becomes available.
  • The measures taken or proposed to address the Personal Data Breach and mitigate its possible adverse effects.
  • A point of contact at AtlaSent for follow-up.

AtlaSent's notification is not an acknowledgment of fault or liability. AtlaSent will cooperate with Customer's reasonable requests for information to assist Customer with its own breach-notification obligations under Data Protection Laws.

11. Sub-processors

Customer authorizes AtlaSent to engage the Sub-processors listed in Annex III. AtlaSent will:

  1. Enter into a written agreement with each Sub-processor imposing data protection obligations no less protective of Customer Personal Data than those in this DPA.
  2. Remain fully liable to Customer for the performance of each Sub-processor's obligations.
  3. Notify Customer at least thirty (30) days before adding or replacing a Sub-processor that will Process Customer Personal Data, by updating Annex III and emailing the change-notification list (see §2 of subprocessors/list.md). For a material change in the scope or location of an existing Sub-processor's Processing (including movement of processing from the EEA to a third country or material expansion of categories of Customer Personal Data or Data Subjects), AtlaSent will give sixty (60) days' notice.

11.4 Objection procedure

Customer may object in good faith to a proposed new or materially- rescoped Sub-processor within the applicable notice window by giving written notice to subprocessors@atlasent.io specifying the basis for objection. AtlaSent will engage with Customer in good faith for not less than thirty (30) days to explore reasonable alternatives, which may include:

(a) AtlaSent's deployment of the Service in a configuration that does not engage the objected-to Sub-processor; (b) AtlaSent's adoption of supplementary technical or organizational measures; or (c) other reasonable mitigations.

If, after such engagement, AtlaSent cannot reasonably accommodate the objection, Customer may terminate the affected Order Form(s) within thirty (30) days of AtlaSent's final response, without penalty, and AtlaSent will refund pre-paid Fees for the unused portion of the Subscription Term. The Parties acknowledge that, given the architecture of the Service, certain Sub-processors (notably the database and infrastructure providers identified in Annex III) cannot be substituted without material reconfiguration of the Service.

12. Deletion or return

Upon termination or expiry of the Agreement, AtlaSent will, at Customer's choice (expressed in writing within thirty (30) days of termination), delete or return all Customer Personal Data and delete existing copies, unless retention is required by applicable law. If no choice is communicated within the thirty-day window, AtlaSent will delete.

Deletion will be completed within ninety (90) days of the choice (or of the thirty-day default window expiring), except that:

(a) Backups. Cryptographically-protected backups will be deleted in accordance with AtlaSent's standard backup-rotation schedule (not to exceed thirty-five (35) days), and access to those backups will be restricted by AtlaSent's access controls during the rotation window.

(b) Audit-chain integrity references. AtlaSent may retain (i) cryptographic hash references and (ii) merkle-tree or chain-linking artifacts that record the existence and ordering of decision records, solely for the purpose of preserving the tamper-evident integrity of the audit chain previously delivered to Customer or to Customer's auditors. Such retained artifacts will (1) be limited to the minimum cryptographic material necessary to verify the integrity of records previously delivered, (2) be stored separately from operational systems, (3) be subject to access controls that prevent further Processing for any purpose other than integrity verification, and (4) where the underlying input from which a hash is derived is, in AtlaSent's reasonable judgment, susceptible to re-identification, additionally be treated as pseudonymized Personal Data subject to the protections of this DPA.

(c) Legal hold. Where AtlaSent is subject to a legal hold, court order, or regulatory directive requiring continued retention, AtlaSent will retain the Customer Personal Data subject thereto, notify Customer of the existence of the hold to the extent legally permitted, and return to deletion as soon as the hold is lifted.

All Customer Personal Data retained under (a)–(c) remains subject to this DPA.

Within thirty (30) days after AtlaSent's completion of deletion under this §12, AtlaSent will provide Customer, on request, a written certification of deletion signed by an officer of AtlaSent, identifying any Customer Personal Data retained under (a)–(c) and the basis for retention.

13. Liability

Each Party's liability under this DPA (including in respect of any breach of the EU SCCs, where applicable) is subject to the limitations and exclusions in the Agreement, except that:

(a) no limitation in the Agreement will reduce a Data Subject's rights against either Party under Article 82 of the EU GDPR or the corresponding provision of any other Data Protection Law; and (b) no provision of this DPA will be construed as a waiver of any non-waivable rights of Data Subjects under Data Protection Laws.

For clarity, the Enhanced Cap stated in the applicable MSA or Order Form applies to a Party’s breach of this DPA when that agreement expressly provides an Enhanced Cap. Otherwise, the Agreement’s general cap applies, subject to statutory non-waivability.

14. Order of precedence

In the event of any conflict between (a) this DPA, (b) the EU SCCs as incorporated by §8, and (c) the rest of the Agreement, the order of precedence is: EU SCCs > this DPA > the rest of the Agreement.

15. Governing law and jurisdiction

This DPA is governed by the law and is subject to the jurisdiction stated in the Agreement, except where (a) Data Protection Laws or (b) the EU SCCs require otherwise.

16. Joint controllership

The Parties agree that the Processing under this DPA does not establish a joint-controllership relationship within the meaning of Article 26 of the EU GDPR or any analogous provision of other Data Protection Laws. Customer is the sole Controller (or, where applicable, Processor for a third-party Controller) and determines the purposes and essential means of Processing.

Annex I — Description of Processing

Categories of Data Subjects. End users of Customer's products and services on whose behalf agents act; Customer's employees and contractors who use the AtlaSent Console; Customer's customers, patients, study subjects, or other downstream parties whose actions are the subject of the authorization decisions Customer evaluates with the Service.

Categories of Personal Data.

  • Authentication / directory identifiers: email address, full name, Customer-assigned employee or contractor identifier, SSO identifier.
  • Decision context: actor_id, action_type, environment, and the context JSON object submitted by Customer to /v1-evaluate. The contents of context are Customer-determined; Customer must avoid submitting special categories of data (see below) without notice to AtlaSent.
  • Audit-chain entries: hashes of decision records, decision outcomes, timestamps, and audit identifiers. The contents of the chain are a function of the data Customer submits.
  • Operational metadata: IP address of the request originator, request identifier, user agent.
  • Derived behavioral analytics (only where Customer has opted in to the behavior_insights feature at the organization-administrator level): aggregated and per-actor behavioral baselines, action- frequency statistics, anomaly rates, approval-latency statistics, and risk-score distributions derived from authorization-decision records. Where derived from an identifiable actor_id, these data constitute profiling within the meaning of Article 4(4) of the EU GDPR and remain subject to the protections of this DPA. AtlaSent does not enable the behavior_insights feature for any Customer without that Customer's organization-administrator-level opt-in, which opt-in event AtlaSent records in the audit chain. Customer is the Controller of the resulting behavioral analytics in respect of Customer's own actors and is responsible for satisfying its obligations under Articles 13, 14, and 22 of the EU GDPR (and analogous provisions of other Data Protection Laws), including providing transparency to Data Subjects and, where applicable, conducting a Data Protection Impact Assessment under Article 35. AtlaSent will not use behavioral analytics derived from one Customer's actors for the benefit of any other Customer, or to train any general-purpose machine-learning or large-language model.

Special categories of data (Article 9 GDPR). Not intentionally processed by AtlaSent. Customer must not submit special categories of Personal Data (health data, biometric data, etc.) to the context field without a prior written acknowledgment from AtlaSent that the Service is configured to accommodate it (typically as part of a regulated-use engagement).

Frequency of transfer. Continuous, for the term of the Agreement.

Duration of Processing. The term of the Agreement, plus the retention period in §12.

Nature of Processing. Storage, access, evaluation, logging, backup, deletion.

Purpose of Processing. Provision of the AtlaSent service to Customer (see §4).

Retention period. For the duration of the Agreement, plus the deletion period in §12. Audit-chain integrity references may be retained longer as stated in §12(b).

Annex II — Technical and Organizational Measures

AtlaSent implements the following measures to protect Customer Personal Data. These measures are minimums; AtlaSent may exceed them. AtlaSent will not, during the term of the Agreement, materially reduce the protections set out in this Annex II below the level in effect on the Effective Date of the Agreement, except as required to comply with law, to protect the security of the Service, or with Customer's prior written consent.

II.1 Pseudonymization and encryption

  • TLS 1.3 in transit for all customer-facing endpoints.
  • AES-256-GCM at rest (Supabase-managed encryption at the storage layer).
  • API keys stored as SHA-256 hashes only; the plaintext value is returned to the Customer once at creation time and never persisted in AtlaSent's systems.
  • Ed25519 digital signatures on audit-export bundles.

II.2 Confidentiality, integrity, availability, resilience

  • Row-level security in the database enforces tenant isolation at the storage layer.
  • Daily backups retained 30 days; monthly cold-storage retained as required by applicable retention obligations (including, where the BAA applies, the 6-year HIPAA documentation retention overlay in §II.8 below).
  • Recovery targets (operational targets, not service-level commitments): runtime authorization data (decisions, permits, audit trail): recovery point objective (RPO) 1 hour, supported by database point-in-time recovery; console account data (users, organizations, settings): RPO 24 hours, from daily backups. Recovery time objective (RTO) 24 hours for both. Neither target has yet been measured by a restore drill (see II.3).
  • Multi-AZ availability within the primary region; regional failover on roadmap (see VQP).

II.3 Restore availability and access

  • Backup restore drill: a written restore-drill procedure is in place. No restore drill has been executed as of the Effective Date. The record of the first completed drill will be made available to Customer on request.
  • Database point-in-time recovery: enabled on the runtime production database since October 1, 2026, with a 7-day recovery window. It was not enabled on the Effective Date. The console database is protected by daily backups only.

II.4 Regular testing and evaluation

  • Independent third-party penetration test: planned, not yet performed. No independent penetration test has been conducted as of the Effective Date of this DPA; the first engagement is being scoped. Once completed, the summary will be available under NDA on request, and the annual cadence applies from that first completed test.
  • Continuous vulnerability scanning of dependencies and infrastructure.
  • SOC 2 Type II audit on the published compliance roadmap; see §II.11.

II.5 User identification and authorization

  • All Customer Personal Data is accessed through scoped API keys with documented <resource>:<action> scopes; least-privilege is enforced.
  • Console access requires SSO (where Customer has configured SSO) or password + MFA.
  • AtlaSent employee access to production data is limited to personnel with a current documented business need to know, on the basis of a documented authorization. Background screening is required by AtlaSent's HR Security Policy; no screening record has yet been completed as of the Effective Date. Access events are logged; the periodic personnel access review is documented, and its first execution has not yet been completed.

II.6 Protection during transmission and storage

  • See II.1.
  • Customer Personal Data is logically segregated by organization_id; cross-organization access is prevented at the database row-level security layer.

II.7 Physical security

  • AtlaSent's Service is deployed on managed cloud sub-processors (see Annex III); the database tier is operated by Supabase as described in the AtlaSent VQP, with single-region availability at V1 and multi-region on the roadmap. AtlaSent does not directly operate physical data-centre infrastructure for the Service.
  • The physical security of the facilities Processing Customer Personal Data is the responsibility of those sub-processors, whose physical controls are audited under SOC 2 / ISO 27001 (or an equivalent third-party attestation).

II.8 Events logging and retention

  • All authorization decisions and Console actions are recorded in the tamper-evident audit chain.
  • System access logs are retained for not less than 12 months.
  • HIPAA documentation overlay. Where the BAA is in effect, the retention period for documentation required by 45 C.F.R. §164.316(b) is six (6) years from creation or last effective date, whichever is later, notwithstanding the 12-month minimum above.

II.9 System configuration

  • Production changes go through pull requests with automated checks, and production deploys of the runtime are gated by AtlaSent's own authorization check. AtlaSent currently has one accountable person who authors, approves and deploys production changes; there is no independent second-person review as of the Effective Date.
  • Production secrets are stored in a managed secrets vault, never in source.

II.10 Internal IT and security governance

  • Documented information security policy. Formal adoption and the first annual review have not yet been completed as of the Effective Date.
  • Incident response plan with a customer-notification commitment aligned with §10. The first tabletop exercise has not yet been held.
  • Security training is required for all personnel on hire and annually. No training completion has yet been recorded as of the Effective Date.

II.11 Certification / accreditation

  • AtlaSent maintains a published compliance roadmap at docs.atlasent.io/compliance/claims describing AtlaSent's current attestations and targeted certifications.
  • Vendor Qualification Package published at docs.atlasent.io/biotech/vqp.

II.12 Data minimization

  • AtlaSent does not require Personal Data fields that are not necessary for the Service.
  • The context field is intentionally typed as an opaque object so Customers can submit only the attributes their policies actually need.
  • The behavior_insights feature (see Annex I) is disabled by default and may be enabled only by Customer's organization- administrator-level opt-in.

II.13 Data quality, retention, accountability

  • See §12 for deletion / return.
  • Internal audit logs and chain-of-custody for personnel actions on production data.

II.14 Sub-processor governance

  • See Annex III and subprocessors/list.md.
  • Each Sub-processor is contractually bound by data protection terms no less protective than this DPA.

Annex III — Sub-processors

The list of Sub-processors authorized at the effective date of this DPA is maintained at subprocessors/list.md and at the public URL https://trust.atlasent.io/subprocessors. A snapshot of that list as of the Effective Date of this DPA is attached as Schedule III-A to this Annex III; AtlaSent will preserve historical versions of the list sufficient to demonstrate the Sub-processors authorized at any point in time during the term.

Annex IV — UK IDTA particulars

Table 1 — Parties. As stated in the Agreement.

Table 2 — Selected SCCs, Modules, and Selected Clauses. EU SCCs (Commission Decision 2021/914), Module 2 or Module 3 (as applicable under §8), with Clause 7 included and Clause 11(a) excluded.

Table 3 — Appendix Information. Annex I, Annex II, Annex III of this DPA.

Table 4 — Ending the IDTA when the Approved Addendum changes. Either party may end the IDTA in accordance with Section 19 of the Approved Addendum. The Parties acknowledge that the trigger events in Section 19 include (a) the ICO's issuance of a revised Approved Addendum that materially changes the obligations of the data importer or exporter, (b) a Section 19 termination notice by either Party in accordance with the Approved Addendum's procedure, and (c) the occurrence of any event specified in the Approved Addendum as terminating the IDTA by operation of law.

End of DPA.

SHA-256 of this document's text: fddb6a97b036a956f8c7efe41a6ec1fbebf9f4e5fb51fb0d3a1a985eb71b70e2