Legal
Data Processing Addendum
Last updated
The terms under which Sianipar Consults LLC processes personal data on behalf of Ayebridge customers. It applies automatically as part of the Terms of Service.
1. Scope and how this addendum applies
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer who holds a Ayebridge workspace (“Customer”) and Sianipar Consults LLC, a Missouri limited liability company (Missouri charter number LC014758768), trading as Ayebridge, with its business address at c/o United States Corporation Agents, Inc., 1028 N Kingshighway St, Cape Girardeau, MO 63701-3503, United States (“Ayebridge”, “we”). It applies whenever we process Customer Personal Data that is subject to Data Protection Laws. It takes effect automatically when the Customer accepts the Terms; no signature is needed.
If the Customer needs a signed copy for its records, email legal@ayebridge.com and we will countersign this DPA without changes. If this DPA and the Terms conflict on the processing of personal data, this DPA applies. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses apply.
2. Definitions
- Data Protection Laws: the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws, in each case to the extent they apply to the processing.
- Customer Personal Data: personal data that the Customer, its team members or its client contacts put into the Customer’s workspace, and that we process on the Customer’s behalf to provide the Service.
- Subprocessor: a third party we engage that processes Customer Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Standard Contractual Clauses (“SCCs”): the clauses approved by European Commission Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum and the Swiss amendments where relevant.
- Terms such as controller, processor, data subject, processing and personal data have the meaning given in the GDPR.
3. Roles of the parties
For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Ayebridge is a processor (or subprocessor). Under the CCPA, Ayebridge is the Customer’s service provider.
The Customer is responsible for having a lawful basis for the processing, for giving the notices its own data subjects need, including its client contacts, and for the lawfulness of its instructions. Ayebridge is a controller only for its own account, billing and security data, as described in the Privacy Policy.
4. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the Ayebridge client portal and project approval service under the Terms. |
| Duration | For the term of the Customer's subscription or trial, and afterwards until deletion as set out in this DPA. |
| Nature and purpose | Hosting, storing, organizing, displaying, transmitting and backing up Customer Personal Data; sending notification emails; generating previews, PDFs and data exports; securing the Service; providing support at the Customer's request. |
| Data subjects | The Customer's team members; the Customer's clients and client contacts; any other people whose personal data the Customer chooses to include in its content. |
| Categories of personal data | Names, email addresses, job titles where entered; content of files, updates, comments, requests and documents; approval records (name, email, decision, time, IP address and browser); sign-in and activity records. |
| Special categories | None intended. The Customer should not upload special categories of data unless its project requires it, and is then responsible for the additional safeguards. |
| Frequency | Continuous, for as long as the Service is used. |
5. Our obligations as processor
Ayebridge will:
- process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the Service, unless the law requires otherwise (in which case we will tell the Customer first, unless the law forbids it);
- tell the Customer if, in our opinion, an instruction breaks Data Protection Laws;
- not sell or share Customer Personal Data, not retain, use or disclose it for any purpose other than providing the Service, and not combine it with personal data from other sources except as Data Protection Laws allow for service providers;
- ensure that everyone authorized to process Customer Personal Data is bound by confidentiality;
- implement the security measures in Security measures;
- assist the Customer as described in Assistance to the Customer.
6. Subprocessors
The Customer gives general authorization for Ayebridge to engage subprocessors. Our current subprocessors are:
| Subprocessor | Purpose | Location | Their terms |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing and sales tax calculation | United States | |
| Vercel Inc. | Application hosting, content delivery and website analytics | United States | |
| Neon Inc. (Databricks) | Managed PostgreSQL database | United States | |
| Cloudflare, Inc. | File storage (R2), DNS, email routing and network security | United States / global network | |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States |
We will (a) impose data protection obligations on each subprocessor that are no less protective than this DPA, (b) remain responsible for their performance, and (c) give at least 30 days’ notice before adding or replacing a subprocessor, by updating the Subprocessors page and emailing workspace Owners. The Customer may object on reasonable data protection grounds within that period by emailing privacy@ayebridge.com. We will then try to find a reasonable solution; if we cannot, the Customer may terminate the affected subscription and receive a refund of fees prepaid for the period after termination.
7. Security measures
Ayebridge implements and maintains appropriate technical and organizational measures (Annex II), taking into account the state of the art, the costs, and the nature and risks of the processing. As of the date of this DPA they include:
| Area | Measures |
|---|---|
| Encryption | TLS for all traffic with HSTS; encryption at rest provided by our database (Neon) and file storage (Cloudflare R2) providers. |
| Access to files | Files are stored in a private bucket. Uploads and downloads use signed, single-purpose links that expire within minutes. No public file URLs exist. |
| Tenant isolation | Every query is scoped to the workspace in the data layer; client contacts can reach only their own client's portal; unknown or foreign identifiers return not found. Automated tests cover cross-tenant access. |
| Authentication | Salted password hashing; optional TOTP two-factor authentication; email verification before invitations; passwordless, expiring sign-in links for client contacts; session management. |
| Application security | Content security policy and security headers; CSRF protections; rate limiting on sign-in and public forms; executable and script file types blocked on upload. |
| Access control | Role-based permissions within workspaces; production and admin access limited to authorized personnel; administrative actions recorded in an audit log. |
| Availability | Managed hosting and database with provider-level backups and point-in-time restore; a documented restore procedure. |
| Incident handling | A security contact (security@) and published security.txt; incident response and notification as described below. |
We may update these measures as long as the overall level of protection does not decrease. The Customer is responsible for its own security choices, such as protecting its accounts, enabling two-factor authentication and managing who it invites.
8. Security incidents
Ayebridge will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice goes to the workspace Owner’s email and includes what we know about the nature of the incident, the data and data subjects concerned, likely consequences and the measures taken or proposed. We will update it as more information becomes available and take reasonable steps to contain the incident. Notifying is not an admission of fault.
9. Assistance to the Customer
- Data subject requests. The Service lets the Customer access, correct, export and delete Customer Personal Data itself. If we receive a request from one of the Customer’s data subjects, we will pass it on to the Customer and not answer it ourselves, unless the Customer asks us to.
- Impact assessments and consultations. We will provide reasonable information the Customer needs for data protection impact assessments and consultations with supervisory authorities, to the extent it relates to our processing.
- Authority requests. If an authority asks us for Customer Personal Data, we will redirect it to the Customer where possible, tell the Customer unless the law forbids it, and challenge requests that are not legally valid.
10. Return and deletion of data
The Customer can export its workspace at any time, including while it is read-only. After a trial or subscription ends, the workspace is kept read-only for at least 30 days, and we email the Owner at least 14 days before deleting it.
When the Customer deletes its workspace, or when we delete a read-only workspace after that notice, we delete Customer Personal Data from live systems within 30 days. Copies in rolling backups are overwritten within a further 30 days. We may keep data longer only where the law requires it, and then only for that purpose.
11. Information and audits
On request, we will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including written answers to security questionnaires. If that is not enough, or a supervisory authority requires it, the Customer may carry out an audit, at its own cost, no more than once a year, with at least 30 days’ notice, during business hours, in a way that does not disrupt the Service or compromise other customers’ data, and under a duty of confidentiality. Audits of our subprocessors are carried out by relying on the reports and certifications they publish.
12. International transfers
Ayebridge and its subprocessors process Customer Personal Data mainly in the United States. Where Customer Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the parties agree that:
- the SCCs are incorporated into this DPA by reference, with Module Two (controller to processor) or Module Three (processor to processor) as applicable; the Customer is the data exporter and Ayebridge the data importer; the optional docking clause (Clause 7) applies; Clause 9 option 2 (general authorization) applies with the notice period in this DPA; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; Annexes I and II are completed by the sections above;
- for UK transfers, the UK International Data Transfer Addendum applies, with the information above completing its tables;
- for Swiss transfers, the SCCs apply with the references to the GDPR read as references to Swiss law and the FDPIC as the competent authority.
Where Ayebridge or a subprocessor is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), transfers to it may rely on that certification instead.
13. Liability
Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Laws or the SCCs do not allow those limitations.
14. Term and changes
This DPA lasts as long as we process Customer Personal Data. We may update it to reflect changes in law or in the Service. Material changes are announced at least 30 days in advance by email to workspace Owners, and will not reduce the overall protection of Customer Personal Data. Questions about this DPA: privacy@ayebridge.com or legal@ayebridge.com.