Data processing addendum

1. Scope and order of precedence

This addendum forms part of the terms of service between CommunicationOS BV (processor) and the customer named on the order form or workspace record (controller). It applies whenever we process personal data on your behalf under Regulation (EU) 2016/679.

Where this addendum conflicts with the terms of service, this addendum wins on anything touching personal data. A separately negotiated DPA signed by both sides wins over this one.

A signed PDF copy is available on request from [email protected]. Accepting the terms of service accepts this addendum, so you do not need to sign anything to be covered.

2. Roles

You are the controller of the personal data inside your connected accounts. You decide which channels to connect, who may read them, what the retention rule is and which AI features run. We are the processor and we act only on your documented instructions.

Your use of the product is itself an instruction. Connecting a WhatsApp number instructs us to ingest and index it. Switching on transcription instructs us to transcribe. An instruction outside the product goes to [email protected] in writing.

We are a controller in our own right for a narrow set of data: account records, billing records, security logs and product telemetry. That processing is described in the privacy policy and is not covered by this addendum.

If we ever receive an instruction we believe breaks EU or member state data protection law, we tell you and we do not carry it out until you confirm or withdraw it.

3. Subject matter, duration and purpose

4. Confidentiality and personnel

Everyone with access to your data is bound by a written confidentiality obligation that survives the end of their engagement. Access is granted on need, reviewed quarterly and removed within one hour of someone leaving. We run background checks on every person with production access, and every one of them completes security training before that access is issued.

A support engineer cannot read your threads by default. Access requires an administrator on your side to grant it, expires after 24 hours, and writes an entry to your audit log naming the engineer.

5. Security measures

We maintain the measures below for the whole term. We may change a specific measure, but not in a way that lowers the overall level of protection.

5.1 Encryption

• TLS 1.3 with a strict cipher suite on every external connection.
• AES-256-GCM for message bodies, media, metadata and search segments at rest.
• A separate data encryption key per tenant, wrapped by a KMS root key that rotates every 90 days.
• Optional customer-managed root keys on Enterprise, held in your AWS KMS or HashiCorp Vault, revocable by you at any moment.

5.2 Access control

• Mandatory two-factor authentication on every account, with no opt out.
• SAML 2.0 single sign-on and SCIM provisioning against your identity provider.
• Role, channel and thread level authorisation inside the workspace.
• Break-glass approval for any production shell, which pages a second engineer and writes an immutable record.

5.3 Isolation and integrity

• A separate logical database schema and separate search index shards per tenant.
• A tenant predicate enforced at the query construction layer, not by convention.
• No pooled model training across customers.
• An append-only audit log of reads, searches, exports, drafts and permission changes.

5.4 Resilience

• Three availability zones, snapshots every 60 minutes to a second EU region.
• Weekly automated restore verification.
• A recovery point objective of 60 minutes, matching the snapshot interval, and a recovery time objective under two hours.
• An annual penetration test by an external firm, with the summary available under NDA.

Independent assurance rests on our SOC 2 Type II audit, which is in its observation window with an outside firm, and on ISO 27001 certification we have planned after it. The security page carries the current status, and the control documentation that exists today is shared under NDA.

6. Subprocessors

You give general authorisation for us to engage the subprocessors listed below. We impose data protection obligations on each one that are no weaker than the ones in this addendum, and we remain liable to you for their performance.

We notify account owners by email at least 30 days before adding or replacing a subprocessor. You can object on reasonable data protection grounds within those 30 days. If we cannot offer you a workable alternative, you can terminate the affected part of the service and we refund the unused prepaid fees for it.

7. International transfers

In the default configuration there is no transfer of message content out of the European Union. Primary storage and backups both sit in EU regions, and inference for summaries, classification and translation runs with an EU provider.

Where a transfer does happen, it happens under the European Commission Standard Contractual Clauses of 4 June 2021, Module Two or Module Three as applicable, with a transfer impact assessment on file that we share on request. The only subprocessor in section 6 established outside the EU is switched off until you enable it, and enabling it is a decision you make and can reverse.

Enterprise customers who self-host process everything inside their own perimeter and no transfer arises at all.

8. Data subject requests

The product gives you the tools to answer a request directly: search across every channel, per-person export, and deletion that covers the message store, the search index and any PersonaLearn adapter built from it.

If a request reaches us instead of you, we do not answer it on the merits. We tell the person to contact you, and we tell you within three working days. If you need help we will assist, and we will not charge for reasonable assistance.

9. Personal data breach

We notify you without undue delay and in any case within 24 hours of becoming aware of a breach affecting your data. The first notice carries what we know at the time: what happened, when, which categories of data and roughly how many records, what we have done and what we recommend you do. Updates follow as the picture firms up, and a written post incident report follows within ten working days.

We do not notify a supervisory authority or a data subject on your behalf unless you ask us to in writing. You are the controller and that call is yours.

Reports come from [email protected] to the administrators on record, and a duplicate notice is written into your audit log.

10. Deletion and return

You can export at any time in JSON, MBOX, HTML, CSV, PDF and the original media, which satisfies any obligation we have to return data.

We confirm deletion in writing when it is complete. A legal hold you placed on a thread overrides the schedule until you lift it.

11. Audits

Once a year, and after a breach affecting your data, you can audit our compliance with this addendum. The first route is our security policy set, the penetration test summary and the SOC 2 Type II report once that audit closes, which answer most questions without anyone travelling.

If those documents leave a gap, you or an auditor you appoint can inspect on 30 days of written notice, during business hours, under NDA, without disrupting the service or touching another customer's data. We bear our own costs for one audit a year. A second audit in the same year is at your cost unless it follows a breach we caused.

12. Liability and duration

The liability provisions of the terms of service apply to this addendum, with the carve-out in section 12 of those terms for a breach caused by our own failure to apply the measures in section 5 above.

This addendum lasts as long as we process personal data for you, and the obligations that naturally outlive it, confidentiality and deletion among them, survive termination.

13. Contact

CommunicationOS BV, Hoveniersstraat 30, 2018 Antwerp, Belgium.
Data Protection Officer: [email protected]
Contracts: [email protected]