Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Zrico Terms of Service (/legal/terms) (the "Agreement") between [company legal name] ("Provider") and the firm or business that accepts the Agreement ("Customer"). Customer accepts this DPA when it accepts the Agreement. The Cover Page below fills in the details of the processing. The DPA Standard Terms follow it.

Cover Page

Parties (Annex I(A))

Item	Detail
Provider (data importer)	[company legal name], [company address]. Role: Processor (or Subprocessor where Customer is a Processor).
Provider contact	support@zrico.com
Provider Security Contact	security@zrico.com
Customer (data exporter)	The firm or business named on the account that accepts the Agreement. Role: Controller (or Processor on behalf of its own clients).
Customer contact	The workspace owner's email address on the account
Activities relevant to the transfer	Customer's use of the Service under the Agreement
Agreement	The Zrico Terms of Service at /legal/terms

Processing Details (Annex I(B))

Item	Detail
Subject matter	Provision of the Service under the Agreement
Nature of Processing	Hosting, storing, indexing, transmitting, backing up, and deleting data in a private AI workspace. Sending prompts and files to AI model providers to generate responses, and creating search indexes (embeddings) of uploaded documents. Processing account and billing records.
Purpose of Processing	To provide, secure, and support the Service: running Customer's workspace, generating AI responses, document search, billing, account administration, user invitations and notices, and customer support
Categories of Data Subjects	(a) Customer's personnel and other Users invited to the workspace; (b) individuals whose data appears in Customer Content, such as Customer's clients, their employees and family members, counterparties, opposing parties, witnesses, insureds, claimants, and other third parties
Categories of Personal Data	(a) Account data: names, email addresses, roles, sign-in and two-factor authentication records; (b) Customer Content: prompts, AI responses, and uploaded files, which may contain any Personal Data Customer chooses to upload; (c) Usage metadata: user email, model used, token counts, cost, timestamps, and technical logs that do not contain prompts, responses, or file contents; (d) Billing contact data for the account owner. Payment card data is collected and held by Square, not by Provider.
Special Category Data	Not intended. Protected health information regulated by HIPAA is prohibited (no business associate agreement). Customer Content may incidentally contain other Special Category Data or other sensitive data (such as government ID numbers or financial account numbers). Customer is responsible for limiting it to what its work requires and for any legal basis, consent, or disclosure it needs.
Special Category Data Restrictions or Safeguards	The safeguards in Annex II apply to all Customer Content. No additional safeguards are offered for Special Category Data.
Frequency of Transfer	Continuous, for as long as Customer uses the Service
Duration of Processing	The term of the Agreement, plus 30 days after the workspace is suspended at cancellation or termination (during which an export is offered), after which data is deleted from live systems. Deleted data may remain in encrypted backups until they age out, up to about 12 months. Customer can shorten chat retention in its workspace (keep, 30, 90, or 365 days). AI model providers keep data for limited periods as described under Approved Subprocessors.
Retention by AI model providers	No AI model provider used by the Service trains on Customer Content. Anthropic API: inputs and outputs kept up to 30 days; content flagged for usage policy violations kept up to 2 years. OpenAI API: up to 30 days for abuse monitoring. AWS Bedrock: does not store prompts or completions for the models used. Legal holds or law can extend any provider's retention. Zero data retention agreements are not in place.
Location of Processing	United States

Approved Subprocessors (Annex III)

The current list of Approved Subprocessors, with each one's location and processing task, is at /legal/subprocessors. Customer approves that list by accepting this DPA. It includes, by category: workspace hosting ([server host]); network edge, security, and encrypted backup storage (Cloudflare); AI model providers (Anthropic, Amazon Web Services Bedrock, OpenAI); transactional email (Resend); and payment processing (Square).

Notice of changes: Provider will give at least 15 days' notice before adding or replacing a Subprocessor, by email to the workspace owner and by updating the list. Customer may object within 30 days after notice, as described in Section 2.6.

Transfer Settings

Item	Detail
EEA SCCs	Module Two (Controller to Processor) and Module Three (Processor to Processor), completed as in Section 3.2
Governing Member State (SCC Clauses 17 and 18)	Ireland
Competent supervisory authority (Annex I(C))	The supervisory authority of the EEA member state where Customer is established, or if none, of the Governing Member State
UK Addendum	The UK International Data Transfer Addendum (version B1.0), completed as in Section 3.3
Note	The Service is designed for US firms and processes data only in the United States. These transfer terms apply only if Customer transfers Personal Data protected by EEA, UK, or Swiss law.

Other Terms

Item	Detail
Security Policy	Annex II of this DPA, and the summary at /legal/security
Security Incident notice	Without undue delay, and no later than 72 hours after Provider becomes aware of a Security Incident. See Section 4.
Governing law of this DPA	The laws of [governing law], except where the EEA SCCs or UK Addendum require otherwise
US state privacy laws	Section 10 (Service Provider Terms) applies

DPA Standard Terms

1. Processor and Subprocessor Relationships

1.1 Provider as Processor. In situations where Customer is a Controller of the Customer Personal Data, Provider will be deemed a Processor that is Processing Personal Data on behalf of Customer.

1.2 Provider as Subprocessor. In situations where Customer is a Processor of the Customer Personal Data, Provider will be deemed a Subprocessor of the Customer Personal Data.

2. Processing

2.1 Processing Details. The Processing Details on the Cover Page (Annex I(B)) describe the subject matter, nature, purpose, and duration of this Processing, as well as the Categories of Personal Data collected and Categories of Data Subjects.

2.2 Processing Instructions. Customer instructs Provider to Process Customer Personal Data: (a) to provide and maintain the Service, including by sending Customer Content to AI model providers to generate responses; (b) as may be further specified through Customer's use of the Service, including its workspace settings; (c) as documented in the Agreement; and (d) as documented in any other written instructions given by Customer and acknowledged by Provider about Processing Customer Personal Data under this DPA. Provider will abide by these instructions unless prohibited from doing so by Applicable Laws. Provider will promptly inform Customer if it is unable to follow the Processing instructions. Customer has given and will only give instructions that comply with Applicable Laws.

2.3 Processing by Provider. Provider will only Process Customer Personal Data in accordance with this DPA, including the details in the Cover Page. If Provider updates the Service to update existing or include new products, features, or functionality, Provider may change the Categories of Data Subjects, Categories of Personal Data, Special Category Data, Special Category Data Restrictions or Safeguards, Frequency of Transfer, Nature and Purpose of Processing, and Duration of Processing as needed to reflect the updates by notifying Customer of the updates and changes.

2.4 Customer Processing. Where Customer is a Processor and Provider is a Subprocessor, Customer will comply with all Applicable Laws that apply to Customer's Processing of Customer Personal Data. Customer's agreement with its Controller will similarly require Customer to comply with all Applicable Laws that apply to Customer as a Processor. In addition, Customer will comply with the Subprocessor requirements in Customer's agreement with its Controller.

2.5 Consent to Processing. Customer has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Customer Personal Data to Provider and the Service, including making all disclosures, obtaining all consents, providing adequate choice, and implementing relevant safeguards required under Applicable Data Protection Laws. This includes any client notices or consents Customer needs before entering client information into the Service.

2.6 Subprocessors.

(a) Provider will not provide, transfer, or hand over any Customer Personal Data to a Subprocessor unless Customer has approved the Subprocessor. The current list of Approved Subprocessors includes the identities of the Subprocessors, their country of location, and their anticipated Processing tasks. Provider will inform Customer at least 15 days in advance and in writing (email to the workspace owner is enough) of any intended changes to the Approved Subprocessors, whether by addition or replacement of a Subprocessor, which allows Customer to have enough time to object to the changes before Provider begins using the new Subprocessor. Provider will give Customer the information necessary to allow Customer to exercise its right to object. Customer has 30 days after notice of a change to object, otherwise Customer will be deemed to accept the changes. If Customer objects within 30 days of notice, Customer and Provider will cooperate in good faith to resolve Customer's objection or concern. If they cannot resolve it, Customer may terminate the Agreement by notice, and Provider will refund any prepaid Fees for the remainder of the current Subscription Period. If Provider must replace a Subprocessor urgently, for example because of a provider outage or a security risk, Provider may make the change at once and will give notice as soon as practical, with the same right to object.

(b) When engaging a Subprocessor, Provider will have a written agreement with the Subprocessor that ensures the Subprocessor only accesses and uses Customer Personal Data (i) to the extent required to perform the obligations subcontracted to it, and (ii) consistent with the terms of the Agreement. For AI model providers and other large providers, this written agreement may be the provider's standard business or API terms and data processing addendum.

(c) If the GDPR applies to the Processing of Customer Personal Data, (i) the data protection obligations described in this DPA (as referred to in Article 28(3) of the GDPR, if applicable) are also imposed on the Subprocessor, and (ii) Provider's agreement with the Subprocessor will incorporate these obligations, including details about how Provider and its Subprocessor will coordinate to respond to inquiries or requests about the Processing of Customer Personal Data. In addition, Provider will share, at Customer's request, a copy of its agreements (including any amendments) with its Subprocessors, or a link to them where they are published standard terms. To the extent necessary to protect business secrets or other confidential information, including personal data, Provider may redact the text of its agreement with its Subprocessor prior to sharing a copy.

(d) Provider remains fully liable for all obligations subcontracted to its Subprocessors, including the acts and omissions of its Subprocessors in Processing Customer Personal Data. Provider will notify Customer of any failure by its Subprocessors to fulfill a material obligation about Customer Personal Data under the agreement between Provider and the Subprocessor.

3. Restricted Transfers

3.1 Authorization. Customer agrees that Provider may transfer Customer Personal Data outside the EEA, the United Kingdom, or other relevant geographic territory as necessary to provide the Service. The Service processes data in the United States. If Provider transfers Customer Personal Data to a territory for which the European Commission or other relevant supervisory authority has not issued an adequacy decision, Provider will implement appropriate safeguards for the transfer of Customer Personal Data to that territory consistent with Applicable Data Protection Laws.

3.2 Ex-EEA Transfers. Customer and Provider agree that if the GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the EEA to Provider outside of the EEA, and the transfer is not governed by an adequacy decision made by the European Commission, then by entering into this DPA, Customer and Provider are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:

(a) Module Two (Controller to Processor) of the EEA SCCs applies when Customer is a Controller and Provider is Processing Customer Personal Data for Customer as a Processor.

(b) Module Three (Processor to Sub-Processor) of the EEA SCCs applies when Customer is a Processor and Provider is Processing Customer Personal Data on behalf of Customer as a Subprocessor.

(c) For each module, the following applies (when applicable):

• The optional docking clause in Clause 7 does not apply;
• In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of Subprocessor changes is 15 days;
• In Clause 11, the optional language does not apply;
• All square brackets in Clause 13 are removed;
• In Clause 17 (Option 1), the EEA SCCs will be governed by the laws of the Governing Member State;
• In Clause 18(b), disputes will be resolved in the courts of the Governing Member State; and
• The Cover Page to this DPA contains the information required in Annex I, Annex II, and Annex III of the EEA SCCs.

3.3 Ex-UK Transfers. Customer and Provider agree that if the UK GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the United Kingdom to Provider outside of the United Kingdom, and the transfer is not governed by an adequacy decision made by the United Kingdom Secretary of State, then by entering into this DPA, Customer and Provider are deemed to have signed the UK Addendum and its Annexes, which are incorporated by reference. Any such transfer is made pursuant to the UK Addendum, which is completed as follows:

(a) Section 3.2 of this DPA contains the information required in Table 2 of the UK Addendum.

(b) Table 4 of the UK Addendum is modified as follows: Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum; to the extent the ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the parties will work in good faith to revise this DPA accordingly.

(c) The Cover Page contains the information required by Annex 1A, Annex 1B, Annex II, and Annex III of the UK Addendum.

3.4 Other International Transfers. For Personal Data transfers where Swiss law (and not the law in any EEA member state or the United Kingdom) applies to the international nature of the transfer, references to the GDPR in Clause 4 of the EEA SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority will include the Swiss Federal Data Protection and Information Commissioner.

4. Security Incident Response

Upon becoming aware of any Security Incident, Provider will: (a) notify Customer without undue delay, and no later than 72 hours after becoming aware of the Security Incident; (b) provide timely information about the Security Incident as it becomes known or as is reasonably requested by Customer; and (c) promptly take reasonable steps to contain and investigate the Security Incident. Notice will go to the workspace owner's email address. Provider's notification of or response to a Security Incident as required by this DPA will not be construed as an acknowledgment by Provider of any fault or liability for the Security Incident.

5. Audit & Reports

5.1 Audit Rights. Provider will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Provider will allow for and contribute to audits, including inspections by Customer, to assess Provider's compliance with this DPA. However, Provider may restrict access to data or information if Customer's access to the information would negatively impact Provider's intellectual property rights, confidentiality obligations, other customers' data, or other obligations under Applicable Laws. Customer acknowledges and agrees that it will only exercise its audit rights under this DPA and any audit rights granted by Applicable Data Protection Laws by instructing Provider to comply with the reporting and due diligence requirements below, unless Applicable Data Protection Laws or a supervisory authority require more. Provider will maintain records of its compliance with this DPA for 3 years after the DPA ends.

5.2 No Third-Party Audit Report. Provider does not currently hold SOC 2, ISO 27001, HIPAA, or any other security certification or third-party audit report. Provider's security measures are described in Annex II and at /legal/security.

5.3 Security Due Diligence. Provider will respond to reasonable requests for information made by Customer to confirm Provider's compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its information security program. All such requests must be in writing, made to the Provider Security Contact, and may only be made once a year, unless a Security Incident has occurred or a supervisory authority requires it.

6. Coordination & Cooperation

6.1 Response to Inquiries. If Provider receives any inquiry or request from anyone else about the Processing of Customer Personal Data, Provider will notify Customer about the request and Provider will not respond to the request without Customer's prior consent. Examples of these kinds of inquiries and requests include a judicial or administrative or regulatory agency order about Customer Personal Data where notifying Customer is not prohibited by Applicable Law, or a request from a data subject. If allowed by Applicable Law, Provider will follow Customer's reasonable instructions about these requests, including providing status updates and other information reasonably requested by Customer. If a data subject makes a valid request under Applicable Data Protection Laws to delete or opt out of Customer's giving of Customer Personal Data to Provider, Provider will assist Customer in fulfilling the request according to the Applicable Data Protection Law. Provider will cooperate with and provide reasonable assistance to Customer, at Customer's expense, in any legal response or other procedural action taken by Customer in response to a third-party request about Provider's Processing of Customer Personal Data under this DPA.

6.2 DPIAs and DTIAs. If required by Applicable Data Protection Laws, Provider will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant data protection authorities, taking into consideration the nature of the Processing and Customer Personal Data.

7. Deletion of Customer Personal Data

7.1 Deletion by Customer. Provider will enable Customer to delete Customer Personal Data in a manner consistent with the functionality of the Service, including by deleting chats and files and by setting chat retention. Provider will comply with this instruction as soon as reasonably practicable except where further storage of Customer Personal Data is required by Applicable Law. Deleted data may remain in encrypted backups until they age out under the backup schedule in Annex II (up to about 12 months), and in AI model provider systems for the periods stated on the Cover Page.

7.2 Deletion at DPA Expiration.

(a) After the Agreement ends, Provider will suspend the workspace and offer Customer an export of Customer Content for 30 days. After that period, Provider will delete Customer Personal Data from its live systems unless further storage of Customer Personal Data is required or authorized by Applicable Law. Backup copies are deleted as the backups age out, up to about 12 months. If return or destruction is impracticable or prohibited by Applicable Laws, Provider will make reasonable efforts to prevent additional Processing of Customer Personal Data and will continue to protect the Customer Personal Data remaining in its possession, custody, or control.

(b) If Customer and Provider have entered the EEA SCCs or the UK Addendum as part of this DPA, Provider will only give Customer the certification of deletion of Personal Data described in Clause 8.1(d) and Clause 8.5 of the EEA SCCs if Customer asks for one.

8. Limitation of Liability

8.1 Liability Caps and Damages Waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party's total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement.

8.2 Related-Party Claims. Any claims made against Provider or its Affiliates arising out of or related to this DPA may only be brought by the Customer entity that is a party to the Agreement.

8.3 Exceptions. This DPA does not limit any liability to an individual about the individual's data protection rights under Applicable Data Protection Laws. In addition, this DPA does not limit any liability between the parties for violations of the EEA SCCs or UK Addendum.

9. Conflicts Between Documents

This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs or the UK Addendum, (2) this DPA, and then (3) the Agreement.

10. Service Provider Terms (US State Privacy Laws)

To the extent the California Consumer Privacy Act, as amended (CCPA), or a similar US state privacy law applies to Customer Personal Data, Provider is a "service provider" or "processor" under that law, and Provider will:

(a) not sell or share Customer Personal Data, as those terms are defined in the CCPA;

(b) not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes stated in this DPA and the Agreement, or as otherwise permitted by the CCPA;

(c) not retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Provider;

(d) not combine Customer Personal Data with personal information it receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as the CCPA permits;

(e) comply with the CCPA and provide the same level of privacy protection the CCPA requires of Customer;

(f) notify Customer if Provider determines that it can no longer meet its obligations under the CCPA; and

(g) allow Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, and to take reasonable steps to confirm that Provider uses Customer Personal Data consistently with Customer's CCPA obligations, through the process in Section 5.

Provider certifies that it understands and will comply with these restrictions. Provider will pass these obligations on to its Subprocessors through its written agreements with them.

11. Term of Agreement

This DPA will start when Customer accepts the Agreement and will continue until the Agreement expires or is terminated. However, Provider and Customer will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until Customer stops transferring Customer Personal Data to Provider and Provider stops Processing Customer Personal Data.

12. Definitions

• "Applicable Laws" means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern a party.
• "Applicable Data Protection Laws" means the Applicable Laws that govern how the Service may process or use an individual's personal information, personal data, personally identifiable information, or other similar term, including the CCPA.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended, and its regulations.
• "Controller" will have the meaning(s) given in the Applicable Data Protection Laws for the company that determines the purpose and extent of Processing Personal Data.
• "Cover Page" means the Cover Page section of this DPA, which Customer accepts by accepting the Agreement.
• "Customer Personal Data" means Personal Data that Customer or its Users upload or provide to Provider as part of the Service and that is governed by this DPA.
• "DPA" means these DPA Standard Terms, the Cover Page, Annex II, and the policies and documents referenced in the Cover Page.
• "EEA SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "European Economic Area" or "EEA" means the member states of the European Union, Norway, Iceland, and Liechtenstein.
• "GDPR" means European Union Regulation 2016/679 as implemented by local law in the relevant EEA member nation.
• "Personal Data" will have the meaning(s) given in the Applicable Data Protection Laws for personal information, personal data, or other similar term.
• "Processing" or "Process" will have the meaning(s) given in the Applicable Data Protection Laws for any use of, or performance of a computer operation on, Personal Data, including by automatic methods.
• "Processor" will have the meaning(s) given in the Applicable Data Protection Laws for the company that Processes Personal Data on behalf of the Controller.
• "Restricted Transfer" means (a) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not subject to adequacy regulations adopted pursuant to Section 17A of the United Kingdom Data Protection Act 2018.
• "Security Incident" means a Personal Data Breach as defined in Article 4 of the GDPR, and, where the GDPR does not apply, a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Service" means the product and services described in the Agreement.
• "Special Category Data" will have the meaning given in Article 9 of the GDPR.
• "Subprocessor" will have the meaning(s) given in the Applicable Data Protection Laws for a company that, with the approval and acceptance of Controller, assists the Processor in Processing Personal Data on behalf of the Controller.
• "UK GDPR" means European Union Regulation 2016/679 as implemented by section 3 of the United Kingdom's European Union (Withdrawal) Act of 2018 in the United Kingdom.
• "UK Addendum" means the international data transfer addendum to the EEA SCCs issued by the Information Commissioner for Parties making Restricted Transfers under S119A(1) Data Protection Act 2018.

Annex II: Technical and Organisational Measures

These are the measures Provider uses to protect Customer Personal Data. Provider may improve them over time but will not materially reduce the overall level of protection during the term of the Agreement. Provider holds no security certifications.

Isolation between firms

• Each firm gets its own workspace stack at its own address (https://{slug}.zrico.app), with its own databases, search index, and document index.
• Each firm's stack runs on its own private network. Firm networks cannot reach each other. Databases and internal services are never exposed to the internet.
• Firm workspaces run on a separate domain (zrico.app) from the marketing site and dashboard (zrico.com), so they do not share cookies.
• Each firm has its own AI gateway key and usage budget.

Network and edge

• All public traffic passes through Cloudflare (proxy, web application firewall, and TLS). The origin server accepts web traffic only from Cloudflare IP ranges.
• A reverse proxy (Traefik) is the only component that accepts connections. Intrusion detection and blocking (CrowdSec) runs at the edge.
• Administrative SSH access is limited to approved administrator IP addresses.

Encryption

• In transit: TLS between users and Cloudflare, and between Cloudflare and the origin server (Cloudflare Origin CA certificates). Connections to AI model providers and other Subprocessors use TLS.
• At rest: nightly backups are encrypted with restic before they leave the server. Secrets are stored on the server with root-only access, and off-server copies are encrypted with SOPS and age.
• Server storage: the workspace server is in a US data center run by our hosting provider. Database credentials and firm secrets are stored only on the server, readable by root only, and copies kept off the server are encrypted.
• Stored third-party credentials in each workspace are encrypted with a per-firm key.

Access control

• Workspace sign-in is by invitation only. There is no self-signup. Two-factor authentication is offered to every workspace user.
• Dashboard sign-in uses email and password with email verification. Two-factor authentication (TOTP) is required for firm owners and admins and for Provider's platform administrators.
• Provider personnel get the least access needed for their role. Production secrets are held only by the components that need them. Internal tools sit behind an access gateway.
• Optional Microsoft 365 (Entra ID) sign-in, when offered, is locked to the firm's own Microsoft tenant.

Logging and monitoring

• Logs never contain secrets, prompts, AI responses, or file contents.
• The AI gateway records usage metadata only (user email, model, token counts, cost). It does not store prompts or responses. These usage records are kept for 400 days.
• Uptime is monitored from a separate server, with a public status page at https://status.zrico.com.

Backups and recovery

• Nightly encrypted backups to Cloudflare R2 storage.
• Backups are kept on a rotating schedule: 7 daily, 4 weekly, and 12 monthly. Deleted data can persist in backups for up to about 12 months before it ages out.

AI model providers

• AI models are used only through paid business API accounts. No provider trains on Customer Content.
• Processing is in the United States. Claude models are reached through Anthropic's API with fallback to AWS Bedrock US inference profiles. GPT models are reached through an OpenAI project with US data residency.
• Provider does not route workspaces to AI models that require extended retention with safety review.

Software maintenance

• Container images are pinned to specific versions and scanned for known vulnerabilities. Operating-system security updates install automatically every day, and image updates are applied after review.

Incident response

• Provider maintains an incident response process to detect, contain, investigate, and recover from Security Incidents, and to notify affected customers as described in Section 4. Security reports can be sent to security@zrico.com.

Data minimization and deletion

• Firms choose chat retention (keep, 30, 90, or 365 days).
• When cancellation takes effect, the workspace is suspended, an export is offered for 30 days, and the workspace is then deleted from live systems.

Attribution

This DPA is based on the Common Paper Data Processing Agreement Standard Terms Version 1.1, posted at https://commonpaper.com/standards/data-processing-agreement/1.1/, free to use under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). It has been modified. Changes include: completing the Cover Page and Annex II for the Service; changing the subprocessor notice period to 15 days and adding a termination right on unresolved objections; replacing the third-party audit report section because Provider has no such report; adding AI provider retention details, deletion and backup timing, and US state privacy (CCPA) service provider terms; and renumbering. Common Paper is not responsible for these changes and does not endorse this DPA.