Data Processing Agreement

1. Roles and scope

In this DPA, "Auxilator" means a service product of Mustard Seed Credo Limited Company, a Wyoming limited liability company. For Customer Data, the Customer is the data controller and Auxilator is the data processor. Auxilator processes Customer Data only to provide the Service and only on the Customer's documented instructions, including as set out in the Terms of Service.

"Affiliate" means, in respect of a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party, where "control" means ownership of more than 50% of the voting securities or the power to direct the management of that entity. The Customer may grant its Affiliates access to the Service under its account, provided the Customer ensures they comply with the Terms and this DPA.

2. Scope and purpose

• Subject matter: provision of the Auxilator Service, including Alfred on third party applications.
• Nature and purpose: hosting, processing and analysis of documents, and of the messages and files Alfred is allowed to see, to deliver the Service's features.
• Data subjects: the Customer's clients, personnel and third parties referenced in uploaded documents or in data.
• Data types: as determined by the Customer. The Customer must not upload special-category data it is not permitted to share.

3. Confidentiality and personnel

Auxilator ensures persons authorized to process Customer Data are bound by confidentiality obligations and access data only on a least-privilege, need-to-know basis.

Auxilator recognizes Customer Data may be subject to legal professional privilege and client confidentiality, and will handle it accordingly. This includes messages and files Alfred sees in Slack.

4. Security measures

• Encryption of Customer Data in transit and at rest.
• Role-based access control and multi-factor authentication for systems holding Customer Data.
• Regular backups and business-continuity procedures.

Auxilator's security programme is aligned to the SOC 2 Trust Services Criteria for security, availability and confidentiality, and to ISO/IEC 27001. Auxilator operates a dedicated, resource-per-client infrastructure model that keeps each firm's data isolated. We describe the Service as certified only when we provide a current report or certificate.

The Service is not Payment Card Industry (PCI) compliant. The Customer must not use the Service to process or store cardholder data. Processing of Protected Health Information requires an executed Business Associate Addendum.

5. Sub-processors

The Customer authorizes Auxilator to engage vetted sub-processors (for example cloud hosting and model providers) under written terms no less protective than these. A current list is available on request, and we will give notice of new sub-processors with a reasonable opportunity to object.

Sub-processors, except for cloud storage providers, will not retain or log Customer Data or Customer Content for human review.

The Sub-processor names, functions and locations are provided to Customers on written request at legal@auxilator.com.

6. No training on Customer Data

Auxilator does not use Customer Data or Customer Content, including Slack data, to train, fine-tune or improve any general or third-party AI model. Our sub-processors will not train any AI models using your Customer Data or Customer Content. Sub-processors, except for cloud storage providers, will not retain or log your Content or Customer Data for human review.

Nothing in this clause prevents Auxilator from processing Customer Data and Customer Content as reasonably necessary to provide, secure, troubleshoot and support the Service, to detect, investigate and prevent suspected abuse, fraud or security incidents, or where required by law. Auxilator may use aggregated or de-identified data that does not identify you, your users or your clients for service analytics, capacity planning and improvement. Such processing does not involve training, fine-tuning or improving any general or third-party AI model.

7. Assistance and breach notification

• Auxilator will reasonably assist the Customer in responding to data-subject requests it receives.
• Auxilator will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with information reasonably needed to meet the Customer's legal obligations.

For claims relating to data breaches of Customer Data caused by Auxilator's breach of its security or data processing obligations, and for either party's breach of confidentiality obligations, total liability will not exceed the higher of the fees paid by the Customer in the preceding 12 months. See the limitation of liability section of the Terms of Service for full details.

8. International transfers

Where Customer Data, including Slack data, is transferred across borders, Auxilator applies appropriate safeguards consistent with the PDPA and applicable law.

9. Return and deletion

On termination or expiry, Auxilator will, on request within 30 days, make Customer Data available for export, then securely delete it from active systems (backups purged on their normal cycle), except where retention is required by law. Slack data is included.

10. Audit

On reasonable written request and subject to confidentiality, Auxilator will make available information necessary to demonstrate compliance, and allow audits (including via a third-party report) no more than once per year absent a specific concern.

11. Governing law and disputes

This DPA is governed by the laws of the State of Wyoming, USA, without regard to conflicts of laws. Disputes will be resolved in accordance with the dispute resolution and arbitration provisions of the Terms of Service.

12. Term and termination

This DPA applies while the Customer uses the Service or holds an active subscription. On termination of the Terms of Service, the data return and deletion obligations in clause 9 apply.