Data Processing Agreement

Last updated: [date] · Effective: [date]

Draft for legal review. This page is a starting draft, not legal advice. Have counsel check it and fill in the bracketed details before it is relied on.

This Data Processing Agreement ("DPA") forms part of the Terms of Service or Master Subscription Agreement dated [date] (the "Agreement") between:

• [Client legal name], [address] (the "Controller" or "Client"); and
• Steerline [legal entity type], [address] (the "Processor" or "Steerline").

It applies when Steerline processes personal data on behalf of the Client in providing Steerline (the "Service").

1. Definitions

1.1 "Data Protection Laws" means all laws on the processing of personal data that apply to the processing under this DPA, including, where applicable, Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the Personal Information Protection Law of the People's Republic of China ("PIPL"). [Add others, e.g. US state laws, as needed.]

1.2 "Personal Data", "Data Subject", "Processing", "Controller", "Processor" and "Supervisory Authority" have the meanings given in the GDPR. Where PIPL applies, "Controller" includes "personal information handler" and "Processor" includes an "entrusted party".

1.3 "Client Personal Data" means Personal Data that Steerline processes on behalf of the Client under the Agreement.

1.4 "Sub-processor" means a third party engaged by Steerline that processes Client Personal Data.

1.5 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.

1.6 "Cell" means a regional deployment of the Service with its own application, database and file storage.

2. Subject matter, duration, nature and purpose

2.1 Subject matter. Provision of the Service, a multi-tenant program management office application with registers for milestones, risks and issues, change requests, deliverables, status reports, resources, vendors and budgets.

2.2 Duration. The term of the Agreement, plus the post-termination retention period in Section 11, plus any period DOD Associates must keep data by law.

2.3 Nature. Hosting, storage, retrieval, display, organization, transmission (including email notifications), backup, export and deletion.

2.4 Purpose. To provide, support and secure the Service under the Agreement and the Client's documented instructions.

2.5 Further details are in Annex I.

3. Roles and instructions

3.1 The Client is the Controller and Steerline is the Processor of Client Personal Data. [If the Client is itself a processor for its own customers, Steerline acts as its sub-processor, and Module 3 of the SCCs applies; see Section 9.]

3.2 Steerline processes Client Personal Data only on the Client's documented instructions. The Agreement, this DPA, and the Client's use and configuration of the Service (including settings made by its administrators) are the Client's complete instructions at the date of signing. Further instructions must be in writing and agreed.

3.3 Steerline will tell the Client at once if, in its opinion, an instruction breaks Data Protection Laws.

3.4 The Client is responsible for the lawfulness of the processing, the accuracy of Client Personal Data, and for giving any notices and obtaining any consents required from Data Subjects.

3.5 Steerline processes data outside the Client's instructions only where the law requires it. In that case it tells the Client first, unless the law forbids it.

4. Processor obligations

4.1 Confidentiality. Steerline ensures that people authorized to process Client Personal Data are bound by confidentiality obligations and receive security training.

4.2 Access by staff. Steerline staff do not access Client Personal Data in the Service unless the Client's administrator grants time-limited support consent, or as needed to keep the Service secure and running, or as required by law. Support access is read-only and recorded in the Client's audit log.

4.3 Security. Steerline implements the technical and organizational measures in Annex II. DOD Associates may update them, provided the overall level of protection does not decrease.

4.4 Records. Steerline keeps a record of processing activities as required by Article 30(2) GDPR.

4.5 Data protection impact assessments. DOD Associates gives reasonable help to the Client with impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of processing and the information available to DOD Associates.

5. Sub-processors

5.1 The Client gives general authorization for Steerline to use Sub-processors. The current list is in Annex III and at [subprocessors page link] (see subprocessors.md).

5.2 Steerline will notify the Client at least 30 days before adding or replacing a Sub-processor, by email to the Client's administrators and by updating the list.

5.3 The Client may object to the change on reasonable data protection grounds by written notice within the 30-day period. The parties will discuss the objection in good faith. If they cannot resolve it, the Client may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the remaining term. [Counsel to confirm remedy.]

5.4 Steerline imposes data protection obligations on each Sub-processor that are no less protective than this DPA, and remains liable for each Sub-processor's performance.

5.5 Services the Client chooses to connect through integrations (for example, Atlassian Jira, Microsoft 365, Google Workspace Chat or Calendar) are the Client's own processors and are not Sub-processors of Steerline.

5.6 AI model providers the Client chooses for the in-app assistant (for example Anthropic, OpenAI, Microsoft Azure OpenAI, Google or DeepSeek), and AI assistants the Client connects through the MCP connector, are the Client's own processors under the Client's agreements with them and are not Sub-processors of Steerline. Only where the Client uses the platform's own AI key is that provider a Sub-processor, listed in Annex III. Data is sent only when a user asks a question or requests a draft, or when the Client's connected assistant calls a tool.

6. Assistance with Data Subject requests

6.1 The Service lets Client administrators find, correct, export and disable user accounts and edit or delete records, so the Client can answer most Data Subject requests itself.

6.2 If Steerline receives a request directly from a Data Subject about Client Personal Data, it will pass it to the Client without undue delay and will not respond except to direct the Data Subject to the Client, unless the law requires otherwise.

6.3 Steerline gives reasonable further help where the Client cannot answer a request using the Service. [Optional: at the Client's cost where the help goes beyond the standard features.]

7. Personal Data Breach

7.1 Steerline notifies the Client without undue delay, and in any case within 72 hours of becoming aware, of a Personal Data Breach affecting Client Personal Data.

7.2 The notice is sent to the Client's named security contact and administrators and includes, as far as known: the nature of the breach; the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Information not available at first may be provided in phases.

7.3 Steerline takes reasonable steps to contain and remedy the breach and helps the Client meet its own notification duties.

7.4 Notice of a breach is not an admission of fault or liability.

7.5 Steerline does not notify Supervisory Authorities or Data Subjects about a breach of Client Personal Data on the Client's behalf without the Client's agreement, unless the law requires it.

8. Audits

8.1 Steerline makes available the information reasonably needed to show compliance with this DPA and Article 28 GDPR.

8.2 Steerline meets this first by providing, on request and under confidentiality: its current independent audit reports or certificates, if any [e.g. SOC 2 Type II report, ISO/IEC 27001 certificate, once obtained]; its security documentation; answers to a reasonable security questionnaire once a year; and, for the Client's own data, the Client's audit log export.

8.3 If that information is not enough to show compliance, or a Supervisory Authority requires it, the Client may carry out an audit (itself or through an independent auditor bound by confidentiality) no more than once in any 12 months, on at least 30 days' written notice, during business hours, without access to other clients' data, and at the Client's cost. [Counsel to confirm.]

9. International transfers

9.1 Cells and residency. Steerline stores Client Personal Data in the Cell selected for the Client at onboarding: [region]. A directory on the primary Cell ([region]) holds only the Client's address in the Service and its Cell id. Sub-processors listed in Annex III may process data in other locations as stated there.

9.2 EU / EEA. Where Client Personal Data is transferred from the EEA to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), incorporated by reference:

• Module 2 (controller to processor) where the Client is a controller;
• Module 3 (processor to processor) where the Client is a processor;
• Clause 7 (docking clause): [included / not included];
• Clause 9: Option 2 (general written authorization), with the notice period in Section 5.2;
• Clause 11: optional language [not included];
• Clause 13: supervisory authority as determined by the Client's establishment [specify];
• Clauses 17 and 18: law and courts of [EU Member State, e.g. Ireland];
• Annexes I, II and III of this DPA complete the SCCs Annexes.

9.3 United Kingdom. For transfers from the UK, the parties agree to the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), with Table 1–3 information taken from this DPA and Table 4 [either party may end].

9.4 Switzerland. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss FADP, and the FDPIC as the competent supervisory authority. [Counsel to confirm.]

9.5 Mainland China. For Clients served from the mainland China Cell, Client Personal Data is stored and processed in the China Cell on Alibaba Cloud in mainland China, with payments through Alipay. Steerline does not transfer that data out of mainland China, except as instructed by the Client and permitted by PIPL. Where a cross-border transfer is needed, the parties will use the appropriate mechanism under PIPL (security assessment, certification, or the standard contract for outbound transfer of personal information), and the Client will carry out any required personal information protection impact assessment and obtain any separate consent. [Counsel to confirm local entity and contract structure.]

9.6 If a transfer mechanism is found invalid or is replaced, the parties will work together to adopt a valid alternative.

10. Security measures

The measures in Annex II apply. The Client is responsible for the security settings it controls in the Service, including user access, roles, SSO configuration, requiring MFA, access reviews, integrations it enables, and how it stores data it exports.

11. Return and deletion

11.1 During the term, Client administrators can export all Client data at any time as a zip file containing all records, people, the audit log and files.

11.2 When the Client closes its organization or the Agreement ends, the Client's organization becomes read-only for a retention period of [30] days (or as agreed), during which the Client can export its data.

11.3 After that period, Steerline permanently deletes all of the Client's records and files from the Service and emails the Client's administrators a deletion certificate with a certificate id and a SHA-256 digest.

11.4 Deleted data remains in encrypted backups until they expire within [n] days. It is not restored except to recover the whole Service, after which deletion is applied again.

11.5 Steerline may keep data it must keep by law (for example, payment and invoice records for tax purposes), protected under this DPA, for the period the law requires.

12. Liability

12.1 [Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. / Placeholder — counsel to draft.]

13. Term, order of precedence and changes

13.1 This DPA lasts as long as Steerline processes Client Personal Data.

13.2 If this DPA conflicts with the Agreement, this DPA prevails on data protection matters. If it conflicts with the SCCs, the SCCs prevail.

13.3 Steerline may update this DPA where Data Protection Laws require, with notice to the Client. Other changes need written agreement.

14. Governing law and jurisdiction

14.1 This DPA is governed by [the law governing the Agreement / law of jurisdiction], except where the SCCs or Data Protection Laws require another law. Courts: [jurisdiction].

Signatures

Annex I: Details of processing

A. List of parties

B. Description of processing

C. Competent supervisory authority

[As determined under Clause 13 of the SCCs.]

Annex II: Technical and organizational measures

The measures below describe the Service as provided by DOD Associates. They are designed to support ISO/IEC 27001 and SOC 2 controls. [Do not list a certification unless you hold it.]

Tenant isolation

• Every client-owned table carries a tenant_id with PostgreSQL row-level security enabled and forced.
• The application connects as a database role without SUPERUSER or BYPASSRLS and refuses to start otherwise.
• Each client is served on its own host. Session cookies are host-only.
• Automated tests prove cross-client isolation on every code change.

Access control for client users

• Single sign-on per client using OIDC with PKCE (Microsoft Entra ID, Okta, Google); email and password (scrypt); emailed one-time sign-in links.
• TOTP multi-factor authentication, which the Client can require for all users.
• Lockout for 15 minutes after 5 failed sign-ins; rate limiting per user, IP and client.
• Roles (viewer, contributor, finance, admin) with workstream and program scope, enforced on the server.
• Encrypted session cookies with an 8-hour maximum and 60-minute idle timeout.
• SCIM 2.0 provisioning and deprovisioning (Enterprise plan); invitations.
• Access reviews every 90 days with reminders, recorded decisions, automatic disabling of removed people and CSV evidence.

Access control for Steerline staff

• Operator console with password and mandatory TOTP; roles owner, support, readonly; optional IP allowlist.
• Every operator action recorded in an append-only log and mirrored into the Client's audit log when it touches the Client.
• Access to Client data only after time-limited consent from the Client's administrator; read-only; logged.
• Operator access reviewed and recorded at least quarterly.
• Staff confidentiality agreements, security training and offboarding procedures.

Encryption

• TLS at the load balancer with HSTS.
• Database and file storage encrypted at rest by the cloud provider.
• AES-256-GCM application-level encryption of OIDC client secrets, TOTP secrets, webhook secrets and integration credentials, with the key held in a cloud secret manager or KMS.
• Passwords hashed with scrypt; one-time tokens and API keys stored as SHA-256 hashes.

Audit logging

• Append-only audit log per client; a database trigger blocks changes and deletions.
• Client administrators can export the audit log as CSV.

Application and network security

• Web application firewall (Google Cloud Armor with OWASP rules, or Alibaba Cloud WAF).
• CSRF protection; strict Content Security Policy with no inline scripts; input validation.
• Outbound connections to webhooks and integrations limited to https, public addresses and no redirects.
• Dependency vulnerability checks (npm audit) on every change; regular dependency updates.

Change management

• Version control with peer review; automated typecheck and integration tests against real PostgreSQL on every change.
• Infrastructure as code (Terraform).
• Every release recorded with its database migrations.
• Feature flags with staged rollout and a global kill switch.

Availability and resilience

• Multi-zone high-availability PostgreSQL with automated backups and point-in-time recovery.
• Monthly restore tests that verify row counts and checksums per table, with recorded results.
• Regional cells that limit the impact of a failure to one region.
• Uptime checks, alerting, and a public status page with 90-day availability and incident history.
• Targets: RPO ≤ [5 minutes], RTO ≤ [4 hours]. [Confirm before publishing.]

Data residency and lifecycle

• Client data kept in the Client's Cell; mainland China clients in the China Cell.
• Full export at any time; deletion after closure with a deletion certificate.

Sub-processor management

• Security review and DPA before use; yearly review; 30 days' notice of changes.

Annex III: Sub-processors

The Client authorizes the Sub-processors listed below as at the date of this DPA, reproduced here:

[Delete rows that do not apply to the Client's Cell and plan.]