Data Processing Addendum
Last updated: 20 March 2026
1. Roles
The customer is the controller of personal data contained in its workspace. TerraSecure is the processor and processes such data only on documented instructions from the customer, which include use of the platform's features and support requests.
2. Subject matter and duration
Processing covers the provision of third-party risk management services for the duration of the subscription plus the 30-day post-termination export window.
3. Categories of data and data subjects
Data subjects: customer personnel with platform accounts, and vendor points of contact who receive or complete assessments. Data categories: name, business email, job role, authentication metadata, questionnaire responses and uploaded evidence.
4. Security measures
Encryption in transit and at rest, row-level tenant isolation, least-privilege role-based access, optional TOTP multi-factor authentication, private evidence storage with signed URLs, immutable audit logging, and periodic access reviews.
5. Sub-processors
The customer authorises the use of sub-processors for hosting, database, storage, authentication, transactional email, payments and public web research. TerraSecure imposes equivalent data-protection obligations on each sub-processor and remains liable for their performance. Material changes are notified with a reasonable objection period.
6. Assistance and breach notification
TerraSecure assists the customer with data-subject requests, impact assessments and regulator engagement. Personal data breaches affecting customer data are reported without undue delay and no later than 72 hours after confirmation, with the known facts, impact and remediation status.
7. International transfers
Where personal data is transferred outside its region of origin, the transfer relies on Standard Contractual Clauses or another lawful transfer mechanism.
8. Return and deletion
On termination the customer may export its data for 30 days. Thereafter TerraSecure deletes workspace data except where retention is required by law.
9. Audit
TerraSecure makes available the information necessary to demonstrate compliance and will support one audit or questionnaire per year, subject to reasonable confidentiality and scheduling terms.
10. Execution
To sign a countersigned copy of this DPA, contact legal@terrasecure.co with your organization details.