Skip to content
Verdict

Data processing addendum

Structure required

Section titled “Structure required”

1. Definitions and scope

Section titled “1. Definitions and scope”
  • Counsel to draft.

2. Roles

Section titled “2. Roles”
  • The customer is the controller of customer-supplied data (rosters, threads, ICP text); Verdict is its processor.

3. Details of processing

Section titled “3. Details of processing”
  • Subject matter: answering named decisions for the customer’s agent.
  • Duration: for the request; redacted request logs for 30 days; decisions and outcomes (which hold feature hashes, not text) for the life of the org plus 90 days.
  • Categories of data and data subjects: counsel to draft from the API schemas.

4. Processor obligations

Section titled “4. Processor obligations”
  • Counsel to draft.

5. Subprocessors

Section titled “5. Subprocessors”
  • The list is on the subprocessors page. Counsel to draft the notice and objection mechanism.

6. Security measures

Section titled “6. Security measures”
  • Technical and organizational measures are described on the security overview page (encryption in transit, row-level tenant isolation, hashed keys, redacted logs, envelope-encrypted secrets, audit logging).

7. Personal data breach notification

Section titled “7. Personal data breach notification”
  • Customers are notified within 72 hours of a confirmed data incident.

8. Assistance with data subject requests

Section titled “8. Assistance with data subject requests”
  • Counsel to draft.

9. Deletion and return

Section titled “9. Deletion and return”
  • Org deletion completes within 30 days and is confirmed by email. Vault entries are deleted on removal and on org deletion.

10. Audits

Section titled “10. Audits”
  • Counsel to draft. SOC 2 readiness, not certification, in v1. Annual penetration test.

11. International transfers

Section titled “11. International transfers”
  • Counsel to draft. US only.