Data Processing Addendum

Status

PoC draft — counsel review pending. The executed DPA, based on the Common Paper DPA template with a Singapore-law cover page, will be published here.

Roles

You are the controller of the documents and data you upload; we process them as a processor, only to provide the service.

Sub-processors

We use the sub-processors below. Each holds only what is listed:

• Vercel — application hosting, deploys, operational logs.

• Neon — PostgreSQL database. Access to each customer organisation's records is enforced per organisation by the database itself.

• WorkOS — sign-in, organisation and invitation records, authentication emails.

• Google Cloud — analysis compute jobs, per-organisation file storage buckets, job scheduling, secrets.

• Stripe — payment processing. Card details are handled by Stripe and never stored by us.

• Resend — transactional email delivery (for example, report-ready notifications).

• AI inference services — your documents and data extracted from them are processed by AI models to produce the analysis. The provider is not named.

We will give notice before adding or replacing a sub-processor.

Deletion

On request, your uploaded files are deleted immediately, database records within 7 days, and billing records are retained only as long as tax and accounting law requires.

Security incidents

We assess any suspected personal-data breach within 48 hours of detection and notify affected customers without undue delay.

Governing law

Singapore law; Singapore courts.