Legal
Data Processing Addendum
The terms that govern our processing of customer data — built around the same boundary as the product: source code never leaves your machine, and the Hub holds only metrics-only receipts.
Draft for review — not yet legal advice. Prepared for owner and counsel review before public launch. Effective date: [PLACEHOLDER: effective date] · Last updated: [PLACEHOLDER: last-updated date]. For a countersigned copy, contact [email protected].
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller") and [PLACEHOLDER: legal entity name] ("TrueVectors", "Processor") for use of the TrueVectors Hub and related services. The Controller determines the purposes and means of processing; the Processor processes Customer Data solely to provide the Service and on the Controller's documented instructions (this DPA and the Terms of Service).
2. Nature and purpose of processing
By design, source code never leaves the customer's machine (the G-6 boundary). The Hub stores only metrics-only receipts: aggregate counts, verification tiers, verdicts, severities, cost in USD, and hashed run/repository identifiers. The Processor does not store source code, file contents, file paths, finding prose, or prompts, and the stored metrics describe artifacts, not natural persons (G-2).
| Categories of data subjects | The Controller's authorized users (account holders) |
| Categories of personal data | Account identity (email) and authentication metadata; usage/billing metadata; standard web/server logs; error diagnostics |
| Special categories | None intended or required |
| Nature of processing | Hosting, authentication, storage of metrics-only receipts, account/usage management, error monitoring, and (at general availability) billing |
| Purpose | Providing the TrueVectors Service to the Controller |
| Duration | For the term of the agreement, subject to the retention and deletion terms below |
3. Sub-processors
The Processor engages vetted sub-processors to deliver the Service and remains responsible for their compliance:
| Sub-processor | Purpose |
|---|---|
| Supabase | Authentication and Postgres database |
| Fly.io | Hub application hosting |
| Amazon Web Services (incl. Bedrock) | Platform infrastructure and, for the optional LLM tier, in-VPC model inference |
| Cloudflare | Zero-Trust Access, CDN, Pages hosting, and private artifact delivery when an evaluation is authorized |
| Stripe | Payment processing (activated at general availability) |
| Resend | Transactional email delivery |
| Sentry | Error and crash monitoring |
[PLACEHOLDER: confirm this is the complete and current sub-processor list with counsel — internal operational docs also reference a rate-limiting provider; reconcile before publication.]** The Processor will give the Controller a means to be informed of changes to this list and to object to a new sub-processor.
4. International transfers
Where personal data is transferred across borders, the Processor relies on appropriate safeguards. [PLACEHOLDER: international-transfer mechanism — e.g., EU Standard Contractual Clauses / UK IDTA — and the contracting entities.]
5. Security
The Processor maintains technical and organizational measures appropriate to the risk, including: encryption in transit (TLS); tenant isolation via row-level security; least-privilege secret handling; high-entropy bearer credentials stored only as SHA-256 hashes (plaintext shown once at issuance, G-3); and rate limiting on ingestion endpoints, which fail closed against the metrics-only schema.
6. Retention and deletion
Run metrics are retained for a bounded window (currently a default of 365 days) and then automatically purged. The Controller may delete its account and all associated data at any time (Hub → Settings → Delete account), which cascades to all owned records and revokes issued tokens. On termination of the agreement, Customer Data is deleted within 30 days, subject to any retention required by law.
7. Data subject requests and personal data breaches
The Processor will assist the Controller, taking into account the nature of processing, in responding to data subject requests, and will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available.
8. Audit and cooperation
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will reasonably cooperate with the Controller's audits, subject to confidentiality and the Service's security and tenancy constraints. [PLACEHOLDER: define audit cadence/scope with counsel.]
9. Liability and precedence
In case of conflict between this DPA and the Terms of Service, this DPA controls with respect to the processing of personal data. Liability under this DPA is subject to the limitations in the Terms. Governing law and venue: [PLACEHOLDER: governing law and venue].
10. Contact
Data-protection matters: [PLACEHOLDER: dedicated privacy/DPO contact] or, in the interim, [email protected]. See also the Privacy Policy and Terms of Service.
This is an unreviewed draft and is not legal advice. It must be reviewed by qualified legal counsel before TrueVectors goes public.