Data Processing Addendum

1. Scope and roles

The Customer is the controller (or, where it acts for another controller, a processor) of Customer Personal Data, and Altairian is its processor (or sub-processor). Altairian is a service provider and processor under US state privacy laws.

Annex 1 describes the processing. The Customer is responsible for the lawfulness of the processing it instructs, including having a valid basis and giving any notices required to contact its clients' staff.

2. Instructions

Altairian will process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's configuration and use of the Service (including the rules, approvals and standing authority it sets), unless law requires otherwise; in that case Altairian will tell the Customer first unless the law prohibits it. Altairian will tell the Customer if it believes an instruction infringes Data Protection Law.

Altairian will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service (including any commercial purpose other than the business purposes in the Terms) or outside the direct relationship with the Customer; or combine it with personal data from other sources except as permitted by law. Altairian does not use Customer Personal Data to train general-purpose AI models. Altairian certifies it understands and will comply with these restrictions.

3. Personnel

Altairian will ensure that people authorised to process Customer Personal Data are bound by confidentiality, receive appropriate training, and have access only as needed for their role.

4. Security

Altairian will implement and maintain the technical and organisational measures in Annex 2, which are designed to ensure a level of security appropriate to the risk. Altairian may update them, provided the overall level of protection is not reduced.

5. Sub-processors

The Customer gives general authorisation for Altairian to engage sub-processors. The current list is in the Privacy Policy and includes Supabase, Vercel, Railway, Inngest, Anthropic, Postmark, Sent, Upstash and Sentry.

Altairian will give at least 30 days' notice of a new sub-processor (by updating the list and emailing the account owner on request to subscribe, or in the Service). The Customer may object on reasonable data-protection grounds within that period; the parties will discuss in good faith, and if they cannot resolve it the Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

Altairian will impose data-protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for their performance.

Integrations the Customer connects (such as Xero or QuickBooks) are not Altairian's sub-processors; data flows to and from them on the Customer's instruction.

6. Data subject requests and assistance

Taking into account the nature of the processing, Altairian will assist the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. If Altairian receives such a request directly, it will forward it to the Customer without undue delay and will not respond except to direct the person to the Customer, unless authorised. Opt-out replies to messages (such as STOP) are applied automatically in the Service.

Altairian will provide reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities relating to the Service.

7. Personal data breaches

Altairian will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed, and will be updated as more becomes known. Altairian will take reasonable steps to contain and remedy the breach. Notice is not an admission of fault.

8. Deletion and return

On termination, the Customer may export Customer Personal Data for 30 days. Altairian will then delete it within a further 60 days, unless law requires retention, in which case Altairian will keep it confidential and process it only for that purpose. Backups are deleted on their normal cycle.

9. Information and audits

Altairian will make available information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires and summaries of its sub-processors' independent audit reports (such as SOC 2) where available. If that is not sufficient, or a supervisory authority requires it, the Customer may conduct an audit (no more than once a year, on 30 days' notice, during business hours, at its cost, under confidentiality, and without access to other customers' data).

10. International transfers

Altairian is established in Jamaica and processes Customer Personal Data primarily in the United States. Where Data Protection Law restricts the transfer of Customer Personal Data to Altairian or its sub-processors:

• EEA: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 where the Customer is a controller; Module 3 where it is a processor) are incorporated by reference, with: clause 7 (docking) applying; clause 9 option 2 (general authorisation, with the notice in section 5); the optional language in clause 11 not applying; clause 17 option 1 with Irish law; clause 18 the courts of Ireland; and Annexes I and II completed by Annexes 1 and 2 of this DPA.
• UK: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) is incorporated, with Table 4 allowing either party to end it as permitted.
• Switzerland: the EU SCCs apply with references to the GDPR read as the FADP and the competent authority being the Swiss FDPIC.
• Other jurisdictions (including Canada, Australia and Jamaica): the parties rely on this DPA as the contractual safeguard providing comparable protection.

If these mechanisms are replaced or invalidated, the parties will cooperate to adopt a lawful alternative.

11. General

This DPA lasts as long as Altairian processes Customer Personal Data. Liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the SCCs do not allow it. In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms for personal data.

Annex 1: Description of processing

Annex 2: Security measures

• Encryption: TLS for data in transit; encryption at rest by our hosting providers; accounting-integration tokens additionally encrypted with application-level keys.
• Isolation: each customer's data is separated by organisation and enforced by database row-level security on every query.
• Access control: role-based permissions inside each account; least-privilege access for Altairian personnel; secrets held in managed environment stores, never in code.
• Outbound safeguards: approval queues, quiet hours, contact-frequency caps, recorded SMS consent, automatic opt-out handling and suppression lists.
• Logging and monitoring: audit logs of actions and messages; error monitoring; rate limiting and abuse detection on public endpoints; signed and verified webhooks.
• Resilience: managed databases with automated backups; infrastructure from providers with independent security certifications.
• Development: code review, automated tests (including data-isolation tests), dependency updates, and separation of test and production data.
• Incident response: a documented process for assessing, containing and notifying breaches as described in section 7.