Data Processing Addendum

1. Parties, incorporation and scope

This Data Processing Addendum (“DPA”) is between SourceWarden LLC (“Provider”) and the Customer identified in the acceptance record or accepted Order for the EvidenceGuard Terms of Service (the “Agreement”). It takes effect with that Agreement, or on a later date when the parties expressly incorporate this DPA. The parties’ identities, business addresses and authorized acceptance contacts are those in the Agreement record. No separate handwritten signature is required where the Agreement is validly accepted electronically.

“Customer Personal Data” means personal information in Customer Content that Provider processes on Customer’s behalf to deliver the agreed Service, including content-bearing derivatives and related records processed on Customer’s instructions. “Applicable Data Protection Law” means a privacy, data-security or personal-data law that actually applies to that processing or party. “Personal Data Breach” means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Unsuccessful probing that does not compromise that data is not by itself a Personal Data Breach.

Customer acts as controller or business, or as a processor with authority from its own controller. Provider acts as processor, subprocessor or service provider for that scope. Each party’s independent-controller processing, such as its own necessary account, accounting and legal records, follows its applicable duties and notice. A record’s classification follows the actual purpose and control; Provider may not reclassify customer document content to evade this DPA.

This DPA controls conflicts concerning Customer Personal Data. Mandatory law and valid binding transfer instruments control where applicable. Liability follows Terms Section 16 to the extent lawful; nothing limits an individual’s nonwaivable rights, regulatory powers or a controlling transfer clause.

2. Documented instructions and permitted purposes

Customer instructs Provider to perform only the operations described in Annex A, the accepted Order, Customer’s permitted settings and authorized instructions through the Service. These are documented instructions, not permission for every technically possible feature. Additional instructions may be recorded in an agreed electronic communication.

Provider will process Customer Personal Data only for those instructions and the limited, specified purposes in Annex A, unless law applicable to Provider requires otherwise. Where legally permitted, Provider will notify Customer before processing outside the instructions because of such a requirement. If Provider reasonably believes an instruction violates Applicable Data Protection Law, it will promptly explain the concern and may pause the affected processing while the parties resolve it.

Provider will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to advertise to or profile individuals independently, train or fine-tune a general-purpose model on it, or add it to a separate research corpus. Provider will not retain, use or disclose it outside the direct service relationship except as the Agreement and applicable law specifically permit. Calling an activity product improvement does not enlarge these purposes.

3. Customer’s responsibilities

Customer will provide necessary notices, establish lawful bases and permissions, and ensure it may appoint Provider and the authorized subprocessors. Where Customer is itself a processor, it must obtain the corresponding controller’s authorization and provide instructions consistent with that authority.

Customer will limit input to the permitted categories in Annex A, manage its users and retention settings, provide accurate contact details, and communicate a binding legal hold or special requirement before requesting incompatible processing. Specially regulated data and restricted international transfers require an expressly approved arrangement before submission.

These duties do not excuse Provider’s independent legal obligations or a breach of this DPA. Customer is not required to consent to an unrelated use to receive the agreed Service.

4. Confidentiality and access

Provider will permit access to Customer Personal Data only by authorized people whose access is necessary for the relevant task and who are bound by suitable confidentiality duties. Provider will give those people instructions appropriate to their role, maintain a process for removing access when authorization ends and investigate credible misuse.

Support access must be limited to the verified request. Staffed Human Verification, if separately ordered, requires the defined content scope and access authorization. Ordinary customer organization permissions do not grant Provider internal operator access, and a support ticket is not permission to copy confidential documents into an unrelated tool or dataset.

5. Security

Provider will implement and maintain risk-appropriate technical and organizational measures to protect Customer Personal Data, including the minimum commitments in Annex B. Those commitments apply to the actual contracted deployment, not merely to a demonstration environment. Provider may improve or replace measures without materially reducing protection, subject to separate controls for a changed recipient, purpose or location.

No certification, absolute-security guarantee, fixed recovery objective or uptime SLA is created by this DPA. Provider will not represent an internal test, source-code feature or successful single smoke test as independent certification or proof that every operational control has been verified.

6. Subprocessors and changes

Customer gives general written authorization for the core subprocessors identified in Annex C, solely for their stated functions, data and locations, subject to Provider establishing the required contractual and technical safeguards before use. A conditional provider receives no Customer Personal Data until the associated function is agreed and its conditions are satisfied. No external AI provider is authorized by the baseline list.

Provider will bind each subprocessor to written data-protection obligations that provide, in substance, the protection this DPA and Applicable Data Protection Law require for its task. Provider remains responsible for the subprocessor’s performance of those obligations as required by law and this Agreement. A public supplier policy is not a substitute for confirming the actual contractual relationship and selected configuration.

Provider will notify Customer’s designated account or DPA contact at least 30 days before a material addition, replacement or expansion of a subprocessor’s content-processing role. Customer may object within that period on reasonable data-protection grounds. Provider and Customer will seek a suitable alternative, limitation or other resolution before the affected new processing begins. If no reasonable resolution is possible, Customer may end the affected service and receive the paid value of unused credits or prepaid undelivered work.

Urgent replacement needed to protect existing data or maintain lawful essential processing may use a shorter notice period only to the extent legally permitted and reasonably necessary, with prompt notice, equivalent protection and an opportunity to object and end the affected service. An urgent exception is not a way to enable a new external-AI or marketing purpose. An expressly required specific authorization cannot be replaced by silence.

7. Assistance with requests and compliance

Taking account of the processing and information available, Provider will assist Customer with applicable access, correction, deletion, portability, restriction and objection requests and with relevant security, breach reporting, impact assessments and regulator consultation. Provider will provide information reasonably necessary to understand the processing and safeguards.

Provider will promptly forward or notify Customer of a request about Customer Personal Data, ordinarily within five business days, unless law prohibits it. Provider will not decide Customer’s substantive response without instructions except where law requires Provider to act directly. Its own controller obligations remain its own responsibility.

Verification must be proportionate. Routine assistance included in the Service and action needed to remedy Provider’s breach are not separately charged. Extraordinary additional assistance may be subject to a reasonable price agreed in advance, but Provider will not use an unagreed fee or billing dispute to disregard a mandatory deadline or make a statutory right ineffective.

8. Personal Data Breaches

Provider will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Initial notice will include the facts then reasonably available about the incident, affected categories and approximate scope, likely consequences, containment or mitigation, and a contact for further information. Provider will give relevant updates and cooperate with lawful investigation and mitigation.

Provider will not postpone required initial notice until every detail is established. It will distinguish confirmed facts, estimates and unresolved questions and preserve appropriate evidence. A notice is not an admission of liability, but that statement does not reduce the duty to provide accurate and timely information.

Customer controls its required notices to its individuals or regulators, with Provider’s reasonable assistance, except where Provider has an independent legal notification duty. Neither party may make misleading statements on behalf of the other. Faster notice required by law or an accepted Order prevails; no universal numeric notification SLA is promised here.

9. Return, deletion and preservation

Customer can retrieve available data during the agreement and request a reasonably usable electronic return of data still held within 30 days after termination. Supported native files and existing exports will be used, with reasonable assistance when needed. The request window does not extend a shorter source-retention setting automatically or recreate properly deleted data. Provider will not deliberately destroy data subject to a timely, valid return request while arranging that return, except where law requires otherwise.

At Customer’s choice on termination, and following a verified complete-deletion instruction, Provider will return and then delete, or directly delete, Customer Personal Data and existing copies except where law requires a limited retention. In the absence of another lawful instruction, deletion begins at the end of the applicable return period. Active-system deletion must be completed without undue delay, with a specific explanation and prompt remediation of a technical impediment and compliance with any mandatory deadline.

Deletion includes content-bearing extracts, page representations and report material within scope, not just the original uploaded object. Source access revocation, primary deletion and physical purge are distinct states. The baseline includes asynchronous and support-assisted steps; Provider will not confirm physical erasure while relevant purge work remains unresolved.

Restricted backups and recovery copies are handled separately from active-system deletion. They must remain protected and outside ordinary use, must not be used for independent analysis, and must not reintroduce deleted data through restoration. Provider will maintain the deletion state needed to prevent restored copies from returning deleted Customer Personal Data to ordinary service and will not represent backup erasure as complete until the applicable cleanup or expiration has actually been verified. Provider will make appropriate status information available on request.

A legal hold or separately authorized retention exception must identify its basis, content scope and review point. Provider will isolate access, retain no more than needed and resume deletion when the basis ends. Minimal legally justified account, billing, consent and audit records are separate from a right to keep source passages indefinitely. Confidentiality and purpose restrictions continue while any data is retained.

10. Information, audits and remediation

Provider will make available information reasonably necessary to demonstrate compliance with this DPA and will allow and contribute to audits or inspections by Customer or an independent auditor appointed by it where required by Applicable Data Protection Law or reasonably necessary to investigate a material compliance concern.

Ordinary reviews should begin with relevant current documentation and available independent evidence. An ordinary inspection may require 15 business days’ notice, reasonable business hours, confidentiality, scope coordination and safeguards for other customers and system availability. Ordinarily one routine inspection per year is sufficient. Those procedural limits do not restrict a legally required, regulator-directed, incident-related or reasonably necessary follow-up inspection.

Customer normally bears the cost of its auditor. Provider bears reasonable internal costs of routine cooperation and remediation of its own noncompliance; extraordinary optional work can be priced by agreement. Neither security-sensitive details nor another customer’s confidential information need be disclosed unnecessarily, but confidentiality may not be used to make a legally required audit meaningless. An audit does not authorize uncoordinated penetration testing.

Provider will promptly notify Customer if it determines that it cannot meet a material obligation of this DPA, take reasonable corrective steps and permit appropriate measures to stop and remediate unauthorized use. If compliant processing cannot be maintained, the affected processing must stop and the return, deletion and refund rules apply.

11. International transfers

The standard deployment and initial processing roles are described in Annex C. Provider will not initiate a restricted transfer of Customer Personal Data merely because the recipient has a public privacy policy, offers a United States region or appears in a directory. Necessary legal safeguards must be established before the transfer, including any required transfer assessment and supplementary measures.

This DPA supplies processing obligations; it is not the European Commission’s Standard Contractual Clauses, a United Kingdom International Data Transfer Agreement, a Data Privacy Framework certification or an assertion that those instruments have already been executed. Where required, the appropriate official instrument, module, completed party and processing information, and legally necessary supplementary terms must be put in place separately before the affected Service is accepted. The baseline therefore does not authorize a customer to initiate such a restricted transfer until Provider confirms that arrangement in writing.

Provider will assess legally binding access requests, seek clarification or challenge where appropriate and legally available, give notice where permitted and disclose only what is legally required. A location promise applies to the scope actually agreed and must account for support, authentication, backups and onward recipients, not just the primary storage region.

12. United States service-provider and contractor requirements

To the extent applicable United States state privacy law requires these terms, Provider processes the covered personal information only for the limited purposes specifically listed in Annex A, and provides the level of protection that law requires. Provider will not sell or share it, retain, use or disclose it for an unrelated commercial purpose or outside the direct business relationship, or combine it with information from other businesses or its own interactions except as that law specifically permits.

Customer may take reasonable and appropriate steps to verify consistent use and, upon notice, stop and remediate unauthorized processing. Provider will notify Customer if it determines it can no longer meet an applicable obligation. Provider will cooperate in handling applicable individual requests and bind an engaged subprocessor to the required restrictions.

Provider certifies, through its acceptance of the Agreement incorporating this DPA, that it understands and will comply with those applicable restrictions. Provider will not attempt to reidentify data that has properly been deidentified, except to the limited extent law permits for testing the deidentification process under controlled conditions. Pseudonymous contributions, hashes or small-group summaries are not automatically deidentified data. Any permitted recipient of genuinely deidentified information must be bound to preserve that status.

13. Duration and contacts

This DPA continues for the period in which Provider processes or retains Customer Personal Data, including restricted return, backup or lawful-preservation periods. Its confidentiality, purpose and cooperation duties survive termination for retained data. Amendments follow the Agreement and cannot reduce mandatory protection or retroactively authorize a new purpose.

Provider contact: kun11451454188@gmail.com, subject “EvidenceGuard DPA” or “EvidenceGuard security.” Provider postal address: SourceWarden LLC, 7155 Kindred Street, Philadelphia, PA 19149-1132, United States. Customer’s contact is its designated account administrator or the more specific DPA contact in its Order. Each party must keep that contact usable and current.

Annex A. Description and limits of processing

Subject matter and purpose. Authorized PDF procurement and bid-document processing; organization-scoped storage and source access; creation and presentation of source-linked document and review artifacts; recording Customer’s review instructions and human decisions; specifically enabled requirement and Final Preflight functions; and proportionate security, support, return and deletion necessary for those activities. State analysis or review is performed only when actually enabled and authorized, not merely because code exists.

Nature of operations. Receiving, validating, scanning, storing, accessing, extracting text, producing selected page representations, organizing source/version references, generating authorized observations and outputs, transmitting to authorized users or subprocessors, restricting access, returning and deleting. Processing is ongoing during authorized use and occurs as Customer submits material or requests an operation. External AI is excluded in the baseline.

Data subjects. Customer’s authorized business users and individuals in authorized documents, including business contacts, bidder and supplier representatives, consultants, employees, signatories, and officials acting in a professional capacity. No employee-monitoring or individual-eligibility decision service is provided.

Data categories. Business names and professional contact information; ordinary professional qualifications and roles; document text and images within the approved scope; signatures present in ordinary business documents, without biometric identification; comments and review decisions; organization/actor identifiers, source references, timestamps and permission or processing records needed for the workflow. Sensitive categories excluded by the Terms are not authorized merely because a customer uploads them.

Duration. For the agreed Service term and Customer’s retention instruction, followed by return, deletion and limited backup/preservation handling under Section 9. Raw-source settings are 7, 30, 90 days or indefinite where supported; new organizations default to 30 days. Content-equivalent derivatives do not receive an automatic longer period. Complete-deletion instructions are applied to active systems without undue delay, while restricted recovery copies remain subject to the separate backup handling, preservation and restore controls in Section 9.

Customer’s role and instructions. Customer is controller unless it has identified in the Order or account arrangement that it acts for another controller, in which case it instructs Provider as authorized subprocessor. Its instructions are the accepted scope, lawful organization settings and specific authorized requests. Customer must identify additional data categories, special requirements or transfer restrictions before processing; they require written acceptance where outside this Annex.

Return format and contacts. Original authorized files and existing report/export formats, or a reasonably usable electronic copy arranged through the DPA contact. No custom interoperability format is promised absent an Order. Party identities and contacts are incorporated from Section 1 and Section 13, so a customer’s actual acceptance record, not a fictional sample customer, completes the party information.

Annex B. Minimum technical and organizational commitments

Access and identity. Enforce authenticated, organization-scoped authorization for private content and administrative actions; separate customer permissions from operator privileges; grant personnel access only for a necessary role and remove it when authorization ends. Protect privileged credentials and use multifactor authentication for administrative services that support it. Do not place secrets in ordinary support or development records.

Transport and storage. Use secure transport for supported public and service connections; use private object storage and appropriate storage/database encryption for the deployment; restrict download grants and private object access. Do not represent processing as end-to-end encrypted against Provider when Provider must read it to deliver the service.

File and processing controls. Check supported type, size and structural eligibility; verify transfer identities; apply malware scanning and bounded processing; separate document processing from unrelated administration. Failure or unknown verification must not become approval. A scan is a safeguard, not a guarantee.

Integrity and source context. Preserve relevant source and version references, distinguish pending from effective records, record significant human authorizations separately from machine observations, and prevent unauthorized cross-tenant reads or stale writes. Retain only the metadata needed for accountability under the applicable schedule.

Minimization and diagnostics. Keep confidential content and credentials out of ordinary telemetry, limit diagnostic fields and retention, control access to infrastructure logs, and review supplier paths separately. Optional product statistics and external processing must obey their own permissions and purpose limits.

Deletion and restoration. Revoke access before reporting source removal complete, perform and verify the appropriate purge, handle content-bearing derivatives, restrict recovery copies and reapply deletion instructions after restoration. Keep an exception record for valid holds and retry failed cleanup rather than reporting it complete.

Operational governance. Maintain written access, retention, incident and supplier-handling procedures; review significant changes and vulnerabilities; test relevant controls on a risk-appropriate basis; keep deployment and rollback evidence without copying customer documents into public builds; and maintain a recovery procedure appropriate to the agreed service. No unsupported recovery-time promise is created.

Personnel and incident handling. Bind authorized personnel to confidentiality, give role-appropriate data-handling instructions, provide an escalation contact and investigate incidents. Notifications must reflect actual evidence and the applicable legal or contractual timetable. Customer Content is not used for independent training or research.

Annex C. Initial recipient scope

This Annex incorporates the version 1.0 Service Provider and Subprocessor Directory supplied with the Agreement, limited to the roles below. Core authorization is for DigitalOcean, LLC for United States application/document processing and managed database infrastructure, Amazon Web Services, Inc. for private United States S3 object storage, and Supabase Pte. Ltd. for authentication and associated account data in the selected United States project region, subject to its disclosed administrative/support processing. Customer document bodies are not intentionally assigned to Supabase as the business-document database in this architecture.

Cloudflare, Inc. is identified for domain and DNS services, not as an external document-analysis service. Plus Five Five, Inc. (Resend) is conditional for transactional email when configured, limited to recipient, safe message and delivery data. Neither listing authorizes sending document bodies through an undisclosed proxy, email attachment or model.

The Directory distinguishes controller-service recipients such as a live payment processor or ordinary support-email service. Such a role does not expand the right to process Customer Personal Data. If the actual contracting or receiving entity, purpose or region differs materially from this Annex, Provider must resolve and disclose that difference under Section 6 before the affected processing. No unnamed external AI provider or blanket provider-affiliate group is authorized.