Data Processing Agreement

Last updated: October 20, 2026 · Version 2026-10-20

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer organization ("Customer") and Backsplice LLC ("Processor", "we") and governs our processing of personal data in the records Customer puts into Backsplice. An organization admin accepts it for Customer in the dashboard before any governance records can be created or changed, and the version accepted is recorded on the organization. Organization setup (profile, members, sign-in and integration settings) can be done first.

1. Definitions

Terms used here have the meanings given by the data protection law that applies to the processing ("Applicable Law"), including the GDPR, the UK GDPR and US state privacy laws such as the California Consumer Privacy Act and, for protected health information, HIPAA. Where Applicable Law speaks of a "controller" and a "processor", Customer is the controller (or a processor acting for its own customer) and we are its processor (or sub-processor). Where it speaks of a "business" and a "service provider", Customer is the business and we are its service provider: we do not sell or share Customer Personal Data, and we do not retain, use or disclose it outside our direct business relationship with Customer, or combine it with personal data from other sources, except as Applicable Law permits a service provider.

"Customer Personal Data" means personal data in the records and files Customer or its users put into the service.
"Processing" means any operation on personal data, including collecting, storing, retrieving, using, disclosing and deleting it.
"Sub-processor" means a third party we engage to process Customer Personal Data.
"Business associate agreement" means the business associate agreement between Customer and us: our standard agreement, executed when an organization admin signs it, or Customer's own agreement once we countersign it.

2. Scope and Instructions

We process Customer Personal Data only to provide the service under the Terms of Service and Customer's documented instructions. Customer's use and configuration of the service (for example, inviting users, connecting a webhook, SIEM or identity provider, sharing an auditor or guest link, or turning on Watney) are instructions. If the law requires us to process Customer Personal Data otherwise, we will tell Customer first unless the law forbids it.

Data subjects: Customer's users, and people named in Customer's records, such as vendor contacts, incident reporters, reviewers, staff on training records and, for a Customer that handles protected health information, the individuals that information is about
Categories of data: names, email addresses, job titles, and whatever else Customer's users type or upload, including protected health information where a business associate agreement is in place
Duration: while Customer's organization exists, except for the records section 7 says are deleted during the term, and then as section 7 describes

Customer is responsible for having a lawful basis to put Customer Personal Data into the service. Customer puts protected health information into the service only under an executed business associate agreement; for that information the business associate agreement applies as well as this DPA, and it controls where the two differ. Otherwise, Customer puts special-category or other sensitive personal data into the service only where its records need it and it has a lawful basis to do so.

3. Sub-processors

Customer authorizes us to use these sub-processors:

Hosting: DreamHost, which runs the servers and the database the service runs on
Backup storage: where the backups section 7 describes are copied, off the server the service runs on
Email delivery: sending service email
Payments: Stripe, for billing and subscriptions
AI model provider: the provider named on Watney's system card, for an organization whose admin has turned Watney on (including the web searches the provider runs, through its own search service, from queries its model writes, when Watney researches a model card), and for Backsplice's own staff assistant, which is off unless staff switch it on and, when on, can include account names, email addresses and records from any organization in what it sends

We bind each sub-processor to data protection terms that protect Customer Personal Data at least as well as this DPA, and a sub-processor that creates, receives, maintains or transmits protected health information for us does so under a business associate agreement with us. We have such agreements with DreamHost, with our backup storage provider and with our email delivery provider; section 10 says what applies to the AI model provider.

We keep this list current. We tell Customer's organization admins by email at least 30 days before a new sub-processor starts to process Customer Personal Data. Customer may object in writing within that period on reasonable data protection grounds; if we cannot address the objection, Customer may close its organization, and we refund the prepaid fees for the unused part of the billing period.

4. Security Measures

We maintain technical and organizational measures to protect Customer Personal Data, including:

HTTPS everywhere, with HTTP Strict Transport Security
Session cookies that are secure, HttpOnly and SameSite=Strict
Multi-factor authentication (TOTP and passkeys), SAML single sign-on and SCIM provisioning
A per-organization IP allowlist, and role-based access (admin, contributor, auditor)
A hash-chained audit log: a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access, so the log is tamper-evident, not immutable
TOTP secrets, and the payment-processor API keys we store, encrypted with AES-256-GCM (card numbers go to Stripe, never to us)
Daily backups of the database and files, copied off the server the service runs on

Our personnel who can access Customer Personal Data are bound by confidentiality obligations and access it only to provide, secure or support the service. For protected health information, the business associate agreement states further safeguards.

5. Data Subject Requests

We will help Customer, taking into account the nature of the processing, to respond to requests from data subjects to exercise their rights under Applicable Law. If we receive such a request about Customer Personal Data, we will pass it to Customer without undue delay, and within 7 days of receiving it, and not answer it ourselves, other than to acknowledge it and refer the person to Customer.

6. Personal Data Breach

If we become aware of a personal data breach affecting Customer Personal Data, we will notify Customer without undue delay, and in any case within 72 hours of becoming aware of it. A breach of unsecured protected health information is also reported as the business associate agreement requires. The notice will include, as far as then known:

What happened, and the categories and approximate number of people and records affected
A contact for more information
The likely consequences
What we have done or propose to do about it

We will cooperate with Customer's investigation. Customer decides whether a breach must be reported to a regulator or to the people affected.

7. Deletion and Return

Return. An organization admin can download a copy of the organization's data at any time before deletion, from its settings page. This includes the Free plan.

Deletion during the term. Before any termination, we delete: (a) Watney's Research conversations on a model card 12 months after their last request, and its public-model lookups 12 months after they were made, which Customer instructs by using those features; and (b) where an organization admin has set a retention period for closed requests from individuals, each closed request that period after it was closed, which is Customer's instruction under section 2, except that a request recorded under a law whose records must be kept longer is kept at least six years after it was closed, and a restriction the organization agreed to, which may still be in effect, is not deleted by that job. A nightly job makes these deletions, and the audit log records each with a count only. Copies remain in backups until those backups expire. The period in (a) is part of this DPA: a change to it is a change to this DPA, and we tell Customer's organization admins by email before a shorter period applies.

Deletion on termination. Customer Personal Data in an organization is permanently deleted 30 days after an organization admin requests closure, unless an admin cancels the request before then. A paid plan that ends does not terminate the service: the organization moves to the Free plan and nothing is deleted for that. An organization that stops using the service stays on the Free plan, and its data is kept until an organization admin requests closure. If we end the service for Customer under the Terms of Service, we close the organization when our notice ends, and the same closure period then applies.

Deletion removes the organization's records, its uploaded evidence files and the export files generated for it.

What we keep. After deletion we keep the security audit log (its entries stay, labeled with the organization's identifier), deactivated user accounts for people who belonged to no other organization, billing event records, and an executed business associate agreement with its signatures and any signed copy we stored, which the service's retention job deletes 6 years after the organization is deleted, as HIPAA's six-year documentation rule requires. The service's retention job keeps each audit log entry for six years from when it was written, for security and to support record-keeping obligations such as HIPAA's six-year documentation rule. Copies of deleted data remain in our database and file backups until those backups expire. We keep the most recent 30 daily backups and one backup from each month for 6 years, so a copy can remain in a backup for up to 6 years. Returning or destroying data held in a backup is not feasible before the backup expires, so we use backups only to recover the service, and if we ever restore the service from one, we delete again any organization that had been deleted before the restore. Anything we keep stays subject to this DPA, and protected health information to the business associate agreement, while we keep it.

We will confirm deletion in writing on request.

8. Audits and Information

On request, and no more than once a year unless a regulator requires it or a personal data breach has occurred, we will answer Customer's reasonable written questions about our measures and give Customer the information reasonably needed to show that we meet this DPA, under confidentiality. Where Applicable Law gives Customer a right to audit that this information does not satisfy, Customer may carry out an audit at its own cost, on reasonable notice, during business hours, under confidentiality, and in a way that does not expose other customers' data.

9. International Transfers

Customer Personal Data is hosted and stored in the United States. Where Applicable Law requires a transfer mechanism for Customer Personal Data transferred to us from outside the United States, the European Commission's Standard Contractual Clauses (and, for data from the United Kingdom, the UK Addendum to them) apply in their standard form, with Customer as data exporter and us as data importer, and we will sign them on request.

10. Watney and the Model Provider

Watney processes Customer Personal Data only after an organization admin opts in, and it is not part of the Free plan. Each task sends the model provider only what it needs: records Customer's users typed, documentation they pasted in, and the contents of uploaded evidence files (or its earlier summaries of them) when Watney reviews or drafts an answer or summarizes evidence. We have a business associate agreement with the model provider, with zero data retention: the provider does not keep what Watney sends it once it has answered, except where the law requires it. Watney proposes and never decides; it does not approve a system, set a risk tier or publish a card. The provider and models are named on Watney's system card.

11. Contact

For questions about this DPA or our processing of Customer Personal Data, contact:

Backsplice LLC
[email protected]