Data Processing Addendum
Version 2026-11-07 · Effective November 7, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Négus Group Inc., doing business as VouchSafe ("VouchSafe", the processor or service provider) and the Customer (the controller or business). It applies to personal data VouchSafe processes on the Customer's behalf in the hosted service ("Customer Personal Data"). It's written to meet the requirements of applicable data protection law, including, to the extent they apply, the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act ("CCPA"). If this DPA conflicts with the Terms on data protection, this DPA prevails.
1. Details of the processing
| Subject matter | Providing the VouchSafe service under the Terms. |
|---|---|
| Nature and purpose | Storing the Customer's trusted directory, verification cases and audit log; scoring messages the Customer submits; placing callbacks the Customer requests; comparing and restoring supplier bank details in a connected ledger. |
| Data subjects | The Customer's staff; the Customer's suppliers, customers, executives and other contacts; senders of messages the Customer checks. |
| Categories of data | Names, work email addresses, phone numbers, roles, message content and headers, the last four digits of bank accounts in the directory, supplier bank details from a connected ledger, callback records, IP addresses in the audit log. |
| Sensitive data | Not intended. The Customer won't put special-category or sensitive personal data into the service. |
| Frequency | Continuous, while the Customer uses the service. |
| Duration | For the term of the Terms and the deletion period in section 8. |
2. Instructions
VouchSafe processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the service, unless the law requires otherwise; in that case VouchSafe will tell the Customer first unless the law forbids it. VouchSafe will tell the Customer if it believes an instruction breaks data protection law. Under the CCPA, VouchSafe won't sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the service, or combine it with personal information from other sources except as the CCPA permits.
3. Confidentiality
Only VouchSafe's founder has administrative access to the servers holding Customer Personal Data. Anyone VouchSafe authorizes to process it in the future will be bound by confidentiality obligations and given access only as needed.
4. Security
VouchSafe applies the technical and organizational measures described on its Security page, which form Annex 1 of this DPA. They include a separate database for each workspace, encryption of the data disk and its backups at rest, HTTPS for all traffic, per-workspace encryption keys for integration credentials, hashed passwords and codes, role-based access with separation of duties, and a hash-chained audit log. VouchSafe will not materially reduce the overall level of security during the term.
5. Sub-processors
The Customer gives general authorization for VouchSafe to use sub-processors, and specifically authorizes these:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render (render.com) | Hosting, storage and encrypted backups | United States (Virginia) |
| Twilio Inc. | Sending text and voice callbacks (not used when the Customer connects its own Twilio account) | United States |
QuickBooks Online and Xero are services the Customer chooses to connect and contracts with directly; they are not VouchSafe's sub-processors. VouchSafe imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. VouchSafe will email the Customer's admins at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties can't resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the period after termination.
6. Helping the Customer
Taking into account the nature of the processing, VouchSafe will help the Customer, at no extra charge for reasonable requests, to respond to data subjects exercising their rights and to meet its obligations on security, breach notification, data protection impact assessments and consultation with regulators. Most requests can be handled by the Customer's admins directly in the workspace. If VouchSafe receives a request directly from a data subject about Customer Personal Data, it will pass it to the Customer and won't respond itself unless the Customer instructs it to.
7. Personal data breaches
VouchSafe will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed, and VouchSafe will update the Customer as more becomes known. Notice is not an admission of fault.
8. Return and deletion
During the term, the Customer's admins can export the audit log as CSV, and VouchSafe will provide a full copy of the workspace on request. When the Terms end or the workspace is closed, the Customer may request a copy for 30 days; after that, VouchSafe will delete Customer Personal Data from its live systems within 30 days. Copies remaining in the hosting provider's encrypted daily snapshots expire on its rotation schedule and are not restored except for disaster recovery, after which closed workspaces are deleted again. VouchSafe may keep data the law requires it to keep, protected under this DPA.
9. Audits
VouchSafe will make available the information reasonably needed to show compliance with this DPA, including written answers to reasonable security questionnaires. VouchSafe doesn't yet hold a third-party certification or audit report. If that information isn't enough, or a regulator requires it, the Customer may audit VouchSafe's compliance once a year, on at least 30 days' notice, during business hours, at the Customer's cost, subject to confidentiality, and without access to other customers' data.
10. International transfers
VouchSafe and its sub-processors process Customer Personal Data in the United States. Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914 (Module Two, controller to processor), which are incorporated by reference, with Clause 7 included, option 2 of Clause 9 (general authorization, with the notice period in section 5), the optional language of Clause 11 omitted, Clauses 17 and 18 selecting the law and courts of Ireland, and Annexes I and II completed by section 1 and section 4 of this DPA. For UK transfers, the UK International Data Transfer Addendum issued by the Information Commissioner applies; for Swiss transfers, the clauses apply with the references adapted to Swiss law and the Swiss Federal Data Protection and Information Commissioner.
11. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where applicable data protection law or the Standard Contractual Clauses don't permit them to apply.