Data Processing Agreement (DPA)

1. Purpose and Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zeitgeist Business Solutions, operator of the Zeitgeist Confidential platform ("Processor", "we", "us") and the organization that subscribes to the platform ("Controller", "Customer", "you"). It governs our processing of personal data contained in reports and administrative records ("Customer Data") on your behalf when you use the Zeitgeist Confidential platform.

This DPA applies to all report content, reporter communications, and administrative account data processed through the platform, whether submitted anonymously or with identity.

2. Roles of the Parties

You act as the data controller for all Customer Data, including report content submitted through your reporting portal: you determine the purposes and means of processing (receiving, investigating, and resolving reports).

We act as the data processor: we process Customer Data only on your documented instructions as described in the Terms of Service and this DPA, except where otherwise required by applicable law. We do not sell Customer Data, do not use it for advertising, and do not use report content to train any machine-learning model.

Reporters who submit anonymously are not party to this DPA; the platform is designed so that their identity is never collected in the first instance.

3. Processing Details

Subject matter: receipt, encrypted storage, transmission, and management of compliance and whistleblower reports on behalf of the Customer.

Duration: for the term of the Customer subscription, plus any retention period configured by the Customer.

Nature and purpose of processing: secure intake of reports (web channel), encrypted storage, two-way messaging between reporters and authorized administrators, case management workflow, SLA tracking, audit logging, exports, and automated retention enforcement.

Categories of data subjects: anonymous or identified reporters; administrators and users designated by the Customer.

Categories of Customer Data: report category, severity, subject, description, location, incident date, involved persons (optional), reporter-provided contact details (optional), case status and workflow metadata, administrator account details.

4. Security Measures

We implement and maintain the following technical and organizational measures, each of which is implemented in the platform as described on our Security page:

Encryption: report content is encrypted at rest using AES-256-GCM with a unique encryption key derived per tenant via HKDF-SHA256 from a master key held outside the database. Data is transmitted over TLS.

Integrity: an append-only, hash-chained audit log (SHA-256) records security-relevant actions. Database triggers block UPDATE and DELETE operations on the audit log, making audit history tamper-evident.

Access control: role-based access (super_admin, manager, investigator, viewer) with least-privilege defaults; decryption is available only to authorized users of the Customer organization through the application.

Minimization and anonymity: reporter IP addresses are not logged or stored; reports are anonymous by default; rate limiting uses transient in-memory counters that create no persistent identity records.

Availability: infrastructure hosted on managed cloud providers (see Section 6). Customer Data is backed up daily (recovery point objective of no more than twenty-four (24) hours); Enterprise plans additionally include Point-in-Time Recovery (PITR) with a recovery point objective of no more than five (5) minutes. The target recovery time objective for full restoration of the production database is twenty-four (24) hours. Backup details are published on our Security page.

You are responsible for configuring the platform appropriately for your organization, including retention periods, administrator onboarding, and secure handling of the credentials you issue.

5. Confidentiality

We restrict access to Customer Data to personnel and automated systems that need it to operate the service, and we are bound by confidentiality obligations. We maintain an operational security contact and respond to security inquiries within 72 hours.

6. Subprocessors

We use the following subprocessors to operate the platform: Vercel Inc. (application hosting and CDN), Supabase, Inc. (managed PostgreSQL database on AWS infrastructure), and Resend, Inc. (transactional email delivery). The current authoritative list, including the data each subprocessor processes and links to their security documentation, is published at /security#subprocessors.

Hosting location: Customer Data is hosted by Supabase, Inc. on Amazon Web Services infrastructure located in the United States (US East region — North Virginia). Vercel, Inc. hosts the application and delivers content through its global edge network without persisting report content. Resend, Inc. delivers transactional email (such as administrator notifications and account emails).

We will notify Customers of intended additions or replacements of subprocessors by updating that page before the change takes effect, giving Customers the opportunity to object reasonably. Where a subprocessor fails to provide adequate safeguards, we will replace it.

7. Data Subject Requests

If a data subject (including a reporter) contacts you with a request concerning Customer Data, and you cannot fulfill the request through the platform’s administrative tools (case editing, deletion, export), we will assist you by processing the request on your documented instructions, taking into account the design of the platform: anonymous reports are not linked to any identity we hold, and we hold no reporter IP addresses or identity records from which a reporter could be identified.

8. Personal Data Breach Notification

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Customer Data, providing the information reasonably available to us: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. Where and to the extent it is not possible to provide all information at once, we may provide it in phases.

We will take immediate steps to contain and remediate the breach and will reasonably cooperate with your investigation and any notification obligations you have to regulators or affected individuals.

9. Retention, Return, and Deletion

We retain Customer Data only for the term of your subscription plus the retention period you configure (default: 36 months). Closed cases exceeding the configured retention period are automatically and permanently purged by scheduled retention jobs.

Upon termination of your subscription, you may export your case data (CSV/JSON) at any time during the subscription term. After termination, and subject to any backup cycles of our infrastructure providers, Customer Data is deleted or anonymized within ninety (90) days unless we are legally required to retain it.

10. Audits and Evidence of Compliance

We make available information reasonably necessary to demonstrate compliance with this DPA: this DPA, the Security page describing implemented controls, the live public status page, and the tamper-evident audit trail embedded in the platform, which you may inspect for your own organization’s records.

Additionally, upon reasonable notice and no more than once per year (except following a personal data breach), you may request further information about our security practices, and we will provide written responses or relevant documentation.

11. International Transfers

Customer Data is hosted in the United States (AWS US East — North Virginia) as described in Section 6. Where the Customer, its users, or its reporters are located in other jurisdictions — including Caribbean jurisdictions — this involves an international transfer of personal data into the United States. For such transfers, the parties will rely on the transfer mechanisms available under applicable data protection law, and we will implement supplementary measures where required, including the encryption measures described in Section 4, which persist during transfer and storage. Enterprise customers with stricter residency requirements may contact us to discuss dedicated hosting options.

12. Liability and Indemnity

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits liability that cannot be limited by law.

13. Governing Law

This DPA is governed by the laws of Trinidad and Tobago, without prejudice to mandatory data protection rules applicable to the Customer. The parties agree to attempt good-faith resolution of any dispute before pursuing other remedies. Nothing in this DPA is intended to reduce your obligations or your reporters’ protections under mandatory applicable law, including, for organizations subject to it, the requirements of EU Directive 2019/1937 or local whistleblower legislation where it applies.