Data processing agreement

Draft for legal and deployment review, 2026-11-03. Do not countersign this draft. A published, countersignable version requires the actual hosting and mail providers and transfer safeguards to be confirmed.

Parties and instructions

The customer identified in the signature block is the controller. [to be confirmed: vendor legal name and street address], is the processor for account data and prompts sent through the Switchboard relay. Contact [to be confirmed: contact email].

The customer instructs the processor to provide sign-in, licensing, team administration and any relay requests the customer enables. Processing lasts for the service relationship and the applicable deletion period. Data subjects are the customer's users and people whose data those users submit in prompts.

Data and security

Account processing includes email, team membership and roles, device names, a salted hardware hash, sign-in credentials and security events. Optional relay processing includes prompts and attachments; usage accounting retains quantities and cost, not the prompt body. The customer must not submit special-category data unless separately agreed.

The trust page describes current technical measures and their limits. The processor will restrict access to authorized personnel, require confidentiality, and assist with data-subject requests and reasonable security inquiries. No SOC 2 report or independent penetration-test report is available.

Sub-processors and transfers

The customer authorizes the providers in the sub-processor list only for the described services. The processor will notify team owners by email at least 30 days before a new sub-processor takes effect and consider a substantiated objection before that date.

Before personal data is transferred where a transfer safeguard is required, the parties must execute the appropriate EU Standard Contractual Clauses, UK addendum or other lawful mechanism. This draft does not claim an executed SCC or an agreed hosting region. Ask for those documents before sending regulated data.

Customer-directed BYOK requests and iCloud sync use providers contracted by the customer; those are not Switchboard relay sub-processing.

Incidents and deletion

The processor will notify the customer without undue delay and within 72 hours after becoming aware of a personal-data breach. Notice will describe what is known, affected categories, likely consequences and mitigation; incomplete facts will be followed by updates.

On the customer's written request or termination, the processor will delete or return processor-held customer data within 30 days, except records legally required to be retained. Financial records held by Paddle follow Paddle's legal obligations. The customer controls deletion of local traces, offline licence files and its own iCloud data.

This deletion commitment needs an operator procedure and verified backup-retention policy before the agreement is offered for execution. Contact support for a deletion request rather than assuming that removing a team seat deletes all associated account records.

Review and signatures

Reasonable documentary reviews may be requested by email. A physical inspection, custom security commitment, guaranteed restoration time or custom audit is subject to a separate written agreement.

Customer legal name: ____________________

Customer address and contact: ____________________

Authorized signer, title and date: ____________________

Processor signer and date: ____________________

Send the published agreement to [to be confirmed: contact email]. The target for countersigning an agreed published version is two business days.