Data Processing Addendum

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. For purposes of this DPA:

• “Customer Personal Data” means Personal Data contained within Customer Content that Redacta Processes on Customer's behalf in connection with the Service.
• “Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA”), and, where applicable to a Customer's use of the Service, the EU General Data Protection Regulation 2016/679 (“GDPR”) and the United Kingdom GDPR.
• “Personal Data”, “Processing”, “Controller”, “Processor”, and “Data Subject” have the meanings given in the GDPR. The CCPA terms “Personal Information”, “Business”, and “Service Provider” have the meanings given in Cal. Civ. Code § 1798.140 and are deemed equivalent to Personal Data, Controller, and Processor respectively for purposes of this DPA.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Redacta.
• “Sub-processor” means any third party engaged by Redacta to Process Customer Personal Data on Customer's behalf in connection with the Service.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, set out in Commission Implementing Decision (EU) 2021/914.

2. Roles and Scope

Customer is the Controller. For Customer Personal Data Processed through the API proxy and document scanner, Customer is the Controller (under GDPR) and the Business (under CCPA). Customer determines the purposes and means of Processing.

Redacta is the Processor. For the same Customer Personal Data, Redacta acts as the Processor (under GDPR) and Service Provider (under CCPA) on Customer's behalf. Redacta will Process Customer Personal Data only for the limited and specified purposes of providing the Service in accordance with the Agreement, this DPA, and Customer's documented instructions.

Redacta's own data. Separately, Redacta acts as Controller for the limited account and operational data described in Sections 2.1, 2.2, 2.5, 2.6, and 2.7 of the Privacy Policy (account credentials, billing data, audit logs, usage metadata). This DPA does not apply to that data; the Privacy Policy governs it.

3. Customer Instructions

The Agreement (including the Privacy Policy and this DPA), the Service's configuration options, and any written instructions Customer provides through the dashboard or by email constitute Customer's complete and final documented instructions to Redacta for the Processing of Customer Personal Data. Redacta will not Process Customer Personal Data outside or inconsistent with these instructions, except as required by applicable law (in which case Redacta will, where legally permitted, notify Customer of the legal requirement before Processing).

Redacta will notify Customer if, in Redacta's opinion, an instruction from Customer infringes Data Protection Laws.

4. Confidentiality of Personnel

Redacta will ensure that personnel authorized to Process Customer Personal Data are bound by written confidentiality obligations or are subject to an appropriate statutory duty of confidence, and that access to Customer Personal Data is limited to those personnel who require it to perform the Service.

5. Security Measures

Redacta will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures currently in place are described in Annex 2 (Technical and Organizational Measures) below. Redacta may update these measures from time to time provided that the updates do not materially decrease the overall level of protection.

6. Sub-processors

General authorization. Customer grants Redacta general authorization to engage Sub-processors for the Processing of Customer Personal Data, subject to the conditions in this Section 6 and to the list of currently authorized Sub-processors in Annex 3 below.

Notice of new Sub-processors. Redacta will notify Customer at least thirty (30) days before adding a new Sub-processor that will Process Customer Personal Data, by updating Annex 3 and posting the change to the Sub-processor list at getredacta.com/dpa. Customer may object in writing to the addition of a new Sub-processor on reasonable data-protection grounds within the notice period; if the parties cannot resolve the objection in good faith, Customer may terminate the affected portion of the Service without penalty by notifying Redacta in writing.

Sub-processor obligations. Redacta will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and will remain liable for the acts and omissions of its Sub-processors to the same extent as if they were Redacta's own.

7. Data Subject Rights

Taking into account the nature of the Processing, Redacta will, to the extent legally permitted, promptly notify Customer of any request received directly from a Data Subject relating to Customer Personal Data, and will not respond to such requests except on documented instructions from Customer or as required by applicable law.

Redacta will provide reasonable assistance to Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling Customer's obligations to respond to Data Subject requests under applicable Data Protection Laws (including rights of access, rectification, erasure, restriction, portability, and objection).

8. Security Incident Notification

Redacta will notify Customer without undue delay, and in any event within seventy-two (72) hours of confirmation, of any Security Incident affecting Customer Personal Data. The notification will include, to the extent then known:

• the nature of the Security Incident, including the categories and approximate number of Data Subjects and records affected;
• the likely consequences of the Security Incident;
• the measures taken or proposed to address the Security Incident, including measures to mitigate its possible adverse effects; and
• the name and contact details of a Redacta point of contact from whom further information can be obtained.

Redacta will cooperate with Customer's reasonable requests for additional information about the Security Incident as it becomes available. Redacta's notification of or response to a Security Incident is not an acknowledgment by Redacta of any fault or liability with respect to the Security Incident.

9. Data Protection Impact Assessments

Where Customer is required under Data Protection Laws to perform a data protection impact assessment or prior consultation with a supervisory authority in connection with the Service, Redacta will provide reasonable assistance to Customer, taking into account the nature of the Processing and the information available to Redacta.

10. Audit Rights

Redacta will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. At Customer's written request, no more than once per twelve-month period and subject to reasonable confidentiality controls, Redacta will:

• respond to a reasonable security questionnaire (such as CAIQ-Lite or a Customer-supplied equivalent);
• provide a copy of any then-current third-party audit report (such as a SOC 2 Type II report) covering the Service, when available; and
• where the above are insufficient to satisfy a Customer's mandatory regulatory obligations, cooperate in good faith on a mutually agreed audit by Customer or a qualified third-party auditor (excluding Redacta's competitors) at Customer's expense, conducted during normal business hours and subject to reasonable security and confidentiality controls.

Redacta is a pre-launch organization that does not currently hold a SOC 2 Type II report. Customers requiring one as a condition of contracting should discuss this with Redacta before relying on the Service for regulated workloads.

11. International Data Transfers

US-only scope. The Service is offered to customers located in the United States only (see Section 3 of the Terms of Service). Redacta does not solicit or knowingly accept Customer Personal Data of Data Subjects in the European Economic Area, the United Kingdom, or Switzerland through the Service. Customer represents that its use of the Service complies with this scope restriction.

Standard Contractual Clauses (fallback). To the extent that Customer's use of the Service nevertheless involves the transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to Redacta in the United States, the parties agree that the Standard Contractual Clauses (Module 3, processor-to-processor) are incorporated into this DPA by reference and apply to such transfers, with the United Kingdom International Data Transfer Addendum issued by the UK Information Commissioner applying as appropriate. The optional clauses of the SCCs are deemed deselected unless the parties expressly agree otherwise in writing. The choice of law for the SCCs is the law of the Republic of Ireland; the forum is the courts of Ireland; the docking clause (Clause 7) is included.

CCPA. For Personal Information of California residents, Redacta acts as a Service Provider as defined in Cal. Civ. Code § 1798.140(ag). Redacta will not Sell or Share (as those terms are defined in the CCPA) Personal Information received from Customer, will not retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the Agreement, and will not retain, use, or disclose Personal Information outside of the direct business relationship between Redacta and Customer. Redacta certifies that it understands these restrictions and will comply with them.

12. Return or Deletion of Customer Personal Data

Upon termination of the Agreement, and at Customer's written choice, Redacta will return all Customer Personal Data to Customer or delete it within thirty (30) days, except to the extent retention is required by applicable law or by automated backup systems from which prompt deletion is impractical. Token mappings (which contain encrypted Customer Personal Data) are subject to the configurable per-user retention schedule described in Section 2.3 of the Privacy Policy and are cryptographically purged on that schedule independent of account termination.

Customer may export scan metadata at any time during the term via the Reports CSV export feature in the dashboard.

13. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability in Section 12 of the Terms of Service. Any reference in this DPA to liability of a party means aggregate liability of that party under and in connection with the Agreement.

14. Term and Order of Precedence

This DPA is effective as of the date Customer accepts the Terms of Service or first uses the Service, whichever is earlier, and continues for as long as Redacta Processes Customer Personal Data on Customer's behalf. In the event of any conflict between this DPA and the Terms of Service, this DPA controls with respect to the matters it addresses (data protection and Processing of Customer Personal Data).

15. Governing Law

This DPA is governed by the same law and subject to the same dispute-resolution provisions as the Terms of Service, except that the Standard Contractual Clauses referenced in Section 11 are governed by their own choice of law as set out there.

Annex 1 — Description of Processing

Annex 2 — Technical and Organizational Measures

Redacta implements the following measures to protect Customer Personal Data. These measures are subject to continuous improvement and may be updated provided the overall level of protection is not materially decreased.

Encryption

• All data in transit between Customer applications and the Service is encrypted using TLS 1.2 or higher with modern cipher suites.
• Token mappings (the encrypted link between detected PII values and their replacement tokens) are encrypted at rest with AES-256-GCM.
• Provider API keys supplied by Customer are encrypted with AES-256-GCM and stored in encrypted form only. Plaintext keys exist in server memory only briefly during request forwarding.
• Database storage is encrypted at rest by the cloud provider (AWS RDS encryption with the default KMS key).

Access controls

• Database access is restricted to the application server only, with no public network endpoint.
• Application server access is gated by per-request API key authentication or OAuth-backed user sessions.
• Cloud infrastructure access is restricted to authorized personnel via short-lived credentials issued through AWS IAM Identity Center, with MFA enforced.
• Production secrets are stored in AWS Systems Manager Parameter Store as SecureString values, decrypted in-memory at task start under a least-privilege IAM role.

Network and infrastructure isolation

• Application and database tiers run in a private VPC with no direct public ingress except through the application load balancer.
• Security groups enforce least-privilege ingress referencing other security groups by ID, not CIDR blocks.
• The PII detection NER service runs on Redacta's own infrastructure inside the same private network; Customer Content is not sent to any third-party PII detection service.

Logging and monitoring

• Administrative and billing events are written to an immutable audit log retained for thirteen (13) months.
• Application logs are centralized and access-controlled.
• Per-account scan history is available to Customer in the dashboard for export and review.

Data retention and deletion

• Token mappings are automatically purged on a per-user retention schedule (24 hours by default; 1 hour to 90 days configurable on the Business plan).
• Audit logs are automatically purged after thirteen (13) months.
• False-positive reports submitted by users are retained for up to 365 days then automatically purged.
• Document uploads are processed in memory only and are not persisted to disk.

Incident response

• Security incident notification within 72 hours of confirmation per Section 8 of this DPA and Section 4 of the Terms of Service.
• Bounce and complaint handling for outbound transactional email via a dedicated SNS topic with a designated human contact.

Personnel

• All personnel with access to Customer Personal Data are bound by written confidentiality obligations.
• Access to production systems is granted on a least-privilege, need-to-know basis.

Annex 3 — Authorized Sub-processors

The following Sub-processors are authorized to Process Customer Personal Data as of the “last updated” date at the top of this DPA. Each Sub-processor is engaged under a written contract that imposes data protection obligations no less protective than those in this DPA.

Customers may request notice of changes to this list automatically by emailing legal@getredacta.com with the subject line “Subscribe: Sub-processor changes.”

Contact

For questions about this DPA, to request a counter-signed copy, or to submit data protection inquiries, contact legal@getredacta.com.

Sandia Development Group, LLC
New Mexico, United States