Data Processing Addendum

This is a draft. It has not been reviewed by a lawyer and is not in force. Every fact we do not have yet is written in [square brackets]. It is meant for organisations that use Mindsenate for their business.

1. Parties and roles

This addendum forms part of the Terms of Service between [Company legal name] (“Mindsenate”, the processor) and the organisation that owns a workspace (the customer, the controller). It applies to personal data that Mindsenate processes on the customer's behalf in the workspace.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Mindsenate service: discussion threads, AI agent research, votes, a decision log and a knowledge base.
• Duration: as long as the workspace exists, plus the grace period and the time backups take to expire.
• Nature: storage, retrieval, display, transmission to AI providers on the customer's instruction (when a person mentions or assigns an agent, or opens a vote), export and deletion.
• Purpose: to provide the service to the customer and its members.

3. Categories of data and of people

• Data subjects: the customer's members, guests and invited people, and anybody named in content the customer enters.
• Data: names and work email addresses of members, the content of questions, messages, options, documents, votes and decisions, and anything personal the customer chooses to put in them. The customer decides what it enters; special categories of data should not be entered.

4. What the processor does

The processor will:

1. process the data only on the customer's documented instructions (this addendum and the customer's use of the service), unless the law requires otherwise, and say so if an instruction seems to breach the law;
2. make sure the people who handle the data are bound by confidentiality;
3. apply the security measures in the annex;
4. use only the subprocessors on the Subprocessors page, tell the customer of a new one or a replacement [notice period to be set by counsel], and give the customer the chance to object; each subprocessor is bound by obligations at least as protective as these;
5. help the customer answer requests from data subjects, in particular with the workspace export and the deletion functions;
6. help the customer with security, breach notification, impact assessments and consultations, as far as the nature of the processing allows;
7. tell the customer without undue delay after becoming aware of a personal data breach [timeline to be set by counsel];
8. at the end of the service, delete the data (a deleted workspace is purged after a grace period; backups expire within 90 days) or return it through the export, as the customer chooses;
9. make available the information needed to show compliance and allow audits [terms of audits to be set by counsel].

5. International transfers

Some subprocessors are established in the United States. Transfers rely on [mechanism to be confirmed: standard contractual clauses and/or the EU-US Data Privacy Framework].

6. Liability

[To be drafted by counsel.]

7. Duration and changes

This addendum applies as long as the processor processes data for the customer. A change is announced like a change to the Terms of Service.

Annex 1: Security measures

• Separation of workspaces by row-level security in the database, enforced for the role the application uses; membership is checked on every request.
• Encryption in transit for connections to the service; stored credentials for connections to outside systems are encrypted (AES-256-GCM) with a key that is not in the database.
• Authentication: passwords are stored as hashes; sign-in, sign-up and sensitive actions are rate limited; email addresses are verified.
• Least privilege: the web application, the identity layer, the job queue and the migrations each use their own database role with only the privileges they need.
• Operator access is limited to named people, shows numbers and settings, never content, and every change is written to an append-only audit log.
• Agents can only read: they cannot change anything in the customer's systems, and the content they handle is fenced from instructions.
• Backups: nightly database dumps and file backups to encrypted off-server storage; a restore is rehearsed before the beta opens beyond its first customer and then regularly.
• Logging contains identifiers and error codes, not the content of messages.
• Deletion and export: workspace owners can export their data and delete their workspace.

Annex 2: Subprocessors

See the Subprocessors page. The list in force on the date of signature applies.