Data Processing Addendum

1. Who is who

For the data in your workspace you are the controller and Sealinn is the processor. You decide which subcontractors to track, which documents to require and what the rules are; we act on your instructions and do not decide those things for you.

Using the product as documented is a documented instruction. Where we would need to process your data for anything outside that, we will ask.

2. Subject matter, duration, nature and purpose

• Subject matter: operating the customer’s subcontractor-compliance workspace, including its documents, response workspaces, requirements, source checks, manually imported reference data, reconciliation and decision records, evidence packets and selected evidence rooms, and value assumptions and receipts.
• Nature and purpose: collecting, storing, reading and comparing documents and customer-supplied records; extracting candidate fields and contract requirements for customer review; supporting customer-directed communications and scoped external responses; recording source-check results, workflow decisions and history; and producing customer-requested reports, evidence packets, selected sharing views and value receipts.
• Duration: for as long as your workspace exists, plus the deletion windows in section 8.
• Categories of data subject: your team members; subcontractors, suppliers, producers and brokers and their business contacts; individuals named on uploaded documents; and, to the extent contact or security data is recorded, people invited to a response workspace. Evidence-room activity is intentionally anonymous and does not identify or authenticate its viewer.
• Categories of personal data: names, business email addresses, phone numbers, roles and invitation scope; whatever appears on an uploaded document; supplier identity, tax-classification, license, safety, questionnaire, comment, submission, revision and consent records; and, to the extent they contain personal data, contract citations and requirement candidates, source-check queries and results, manually imported vendor or spend rows and review dispositions, work or payment decisions and handoffs, evidence-packet and selected-sharing records, value assumptions and receipts, and related security activity. The document category is broad because documents are supplied by third parties — a W-9, for instance, carries a taxpayer identification number. Sealinn never extracts that number, but the image containing it is stored.

3. Confidentiality

Everyone with access to your data is bound to keep it confidential. Access is limited to what is needed to run and support the service. Selected security, administrative, upload, review and messaging actions are written to an audit log that the application role has no permission to alter or delete; the audit log is not a recording of every screen view or action inside a workspace.

4. Security measures

The measures are described concretely, with the mechanism named, on the security page rather than summarized into adjectives here. In outline: each workspace is isolated at the database row level and enforced by the database itself rather than by application code; the application connects as a role that cannot bypass that isolation; documents are stored privately and served through authenticated, workspace-scoped proxies or short-lived signed links; uploads are scanned for malware before they are read; and customer-directed response and evidence-room bearer links are stored only as hashes, limited by scope, expiry and revocation, and do not verify the recipient’s identity.

5. Subprocessors

We use 10 active subprocessors, each named on the subprocessors page together with what it does and which category of data it receives. A test compares provider-specific credentials in the committed production environment template with that list. This detects new credentialed integrations; services configured through deployment dashboards or source-control integrations still require manual review. Where your data sits at rest is a separate question, and it is answered in section 10 below.

You give general authorization for those active subprocessors. The same page currently retains 2 inactive entries for historical processing disclosure and any future reviewed activation; an inactive provider receives no new production data. It may also disclose a provider in advance; it currently has 1 planned entry. A provider marked planned receives no data. Before a planned provider starts receiving data, we will write to your workspace owner at least 30 days beforehand — naming the provider, what it will do and what data reaches it. Subprocessor notice is separate from any visitor consent the technology itself requires.

If a new provider is a problem for your business, reply to that notice or write to privacy@sealinn.com before the effective date and we will talk it through. We will not pretend an objection is always resolvable — some providers are load-bearing — but you will hear about it in time to raise it rather than afterwards.

Notice sent to an inbox is not a record, so every change is also dated on the subprocessors page. That log is checked against the list itself, so a provider cannot appear on one and be missing from the other.

One deserves calling out on its own: automated AI field extraction is currently unavailable, so new certificate images are not sent to OpenAI for reading. Historical processing and any future reviewed activation are subject to their published API default, which says data is not used to train models and abuse-monitoring logs may be retained for up to 30 days. Sealinn has not recorded a project-specific zero-data-retention readback, so this addendum does not promise zero-data-retention processing.

6. Helping you answer data-subject requests

Where an individual exercises a right against you — access, correction, deletion, portability — product tools support access and correction for the records they expose. Self-serve exports cover the subcontractor roster and contact details, uploaded documents, compliance ledger and audit log; they do not claim to export every response-workspace, requirement, source, reference, reconciliation, value-receipt or evidence-room record listed above. Removing a subcontractor from the active roster is a soft delete: it keeps their documents, history and audit evidence. A workspace owner can instead initiate deletion of the whole workspace, subject to the grace period, purge limitations and backup retention described in the Privacy Policy. Requests that are not covered by those tools can be sent as documented instructions under clause 11.

If a request reaches us directly rather than you, we will not answer it on your behalf; we will pass it to you, except where we are the party being asked to stop contacting somebody. A subcontractor can always opt out of our messages themselves, through the unsubscribe link in any email or by replying STOP to a text — both arrive on the message itself, so neither depends on finding us first — and that takes effect without either of us doing anything.

7. Personal data breaches

If we become aware of a breach affecting your data we will tell you without undue delay, with what we know at the time: what happened, which categories of data and roughly how many records are involved, the likely consequences, and what we are doing. We will keep you updated as we learn more rather than waiting until the picture is complete.

There is a reason that says “without undue delay” and not a number of hours. Under the GDPR the 72-hour clock belongs to the controller — you — and it starts when you become aware. Our job is to inform you promptly enough that you can meet it, and to tell you when we became aware so your clock is measured from the right moment. A processor publishing its own shorter deadline sounds reassuring and answers the wrong question.

What is behind that commitment is a written procedure rather than an intention: how an incident is contained, what evidence is preserved before anything is fixed, how the affected records are counted rather than estimated, and who gets written to in what order. It also names what we do not have — no on-call rotation, no 24/7 response, no incident retainer — because those are the details that decide how fast this actually goes, and you should be able to price them in.

Report anything you think is an incident to security@sealinn.com. If it is a vulnerability rather than a live breach, the same address and the practice on the security page apply.

8. Return and deletion

The product provides workspace exports at any time, including after you cancel: the subcontractor roster with its contact details, uploaded documents, the compliance ledger and the audit log. Export is gated on permission and never on plan.

When you ask us to delete a workspace it enters a 30-day grace window during which it keeps working and you can change your mind. After that a scheduled job removes the workspace and its workspace-scoped database records, and requests deletion of every stored object key it can enumerate. Storage deletion failures are logged, but failed keys are not yet retained in a durable retry queue. Provider backups roll off on their own schedules. A separate suppression record may remain when somebody has asked us to stop contacting them: the email address or phone number, and the date of the request — so the opt-out keeps working after the contractor who first messaged you leaves. Its lawful basis and retention period depend on applicable law and remain subject to review. The full list of operational windows is on the privacy page.

A producer or supplier response-workspace link is active for a customer-selected period between 1 and 30 days and can be revoked sooner. A generated evidence-packet ZIP is available for 24 hours, after which its expiry job requests deletion of the transient object and retains a failed deletion for another sweep. A selected evidence-room link cannot outlive that availability window. The response history, immutable packet manifest and digest, selected room scope, revocation and anonymous activity records remain with the workspace after those links expire and are removed through workspace deletion rather than their link-expiry jobs.

9. Information and audits

We will make available information reasonably necessary to demonstrate compliance with the processor obligations in this addendum. We use a documentation- and remote-first process so that an audit does not expose another customer’s data or create avoidable security and service disruption.

• Documentation first. We may begin with Annex B, the current subprocessor list, the security description, written answers and other relevant records.
• Proportionate scope. Unless a security incident, material non-compliance, regulator or applicable law requires otherwise, audits should ordinarily occur no more than once in a 12-month period. We will agree reasonable scope, timing, duration, confidentiality and security procedures in advance.
• Audit or inspection when needed. If remote evidence is insufficient, or an audit or inspection is required by applicable law or a competent regulator, we will allow and contribute to an audit or inspection by you or a qualified independent auditor acting under appropriate confidentiality and security obligations.

Send questionnaires and audit requests to privacy@sealinn.com. Nothing in this section limits a data protection authority’s lawful powers or an audit right that applicable data-protection law requires.

10. International transfers

Production data at rest sits in two places, both read back from the running system rather than taken from a diagram:

• The database: AWS us-east-1 (Northern Virginia, United States)
• Uploaded documents: Cloudflare R2, Eastern North America (the ENAM location hint — a placement preference, not a guarantee)

We do not publish a region for each individual subprocessor, and the subprocessors page says so in as many words. The rest of that list processes data in transit or holds operational records rather than your documents, and we cannot verify where each of them runs from here. A column filled in by assumption would be worth less to you than no column. The transfer mechanism, where one is required, depends on the contracting parties, the deployed processing location and the provider terms actually in force. Those facts require owner and counsel confirmation; we do not state that standard contractual clauses are in place by assumption.

11. Liability and indemnity

Liability under this addendum is governed by the limits in section 17 of the terms, and those limits apply to the two of us together rather than once each — an addendum that quietly reset the cap would make the number in the terms meaningless.

Each of us is responsible for our own side of the arrangement. You decide which subcontractors to track, what to require and who on your team can see it; we are responsible for handling that data as this addendum describes. Where a regulator or an individual comes after one of us for something the other did, the one who did it carries it.

12. How this fits with the rest

This addendum forms part of the terms of service. Where it and the terms could be read differently about the processing of personal data, this addendum wins; on everything else — payment, plan limits, cancellation — the terms do. Nothing here creates a second agreement, and there is nothing separate to sign.

The published pages this addendum points at are part of it in substance: privacy for what is held and for how long, subprocessors for who receives it, and security for how it is protected. They are separate pages because a reader looking for one of them should not have to read a contract to find it, not because they are less binding.

13. Changes to this addendum

We may update this addendum — to reflect a change in the law, a change in how the product works, or because something here turned out to be wrong. The date at the top of the page changes with it.

If a change materially reduces your rights or our obligations, we will write to your workspace owner before it takes effect rather than relying on you noticing the date. New subprocessors have their own notice period and their own dated log, set out in section 5.

14. Annex B — technical and organizational measures

These are the Article 32 measures, grouped by the sub-paragraph each answers. They are written as mechanisms rather than adjectives on purpose: “enterprise-grade” cannot be checked by anybody, and naming the database role that cannot bypass row-level security can be.

Two numbers that belong here and are enforced in code rather than described: direct download links are signed and short-lived, and an upload link sent to a subcontractor expires after 7 days. The audit log is kept for the life of the workspace — deliberately absent from every purge, because for a compliance product the record of who approved what is the thing you need years later.

15. Execution

This addendum applies as part of the terms from the moment you start using the service; nothing needs to be signed for it to be in force.