This Data Processing Addendum (“DPA”) forms part of the agreement between Trenchant Labs LLC (“Processor”) and the customer (“Controller”) for the Trenchant Countersign cloud service (the “Service”). It applies where Processor processes personal data on Controller's behalf. To request a countersigned copy, write to legal@trenchantlabs.com.
1. Roles and instructions
Controller determines the purposes and means of processing Customer Personal Data. Processor processes it only on Controller's documented instructions, which are the agreement, this DPA, and Controller's configuration of the Service, unless law requires otherwise, in which case Processor will tell Controller first where the law allows.
2. Confidentiality
Processor ensures that personnel authorised to process Customer Personal Data are bound by confidentiality and access it only as needed to provide, secure and support the Service.
3. Security
Processor implements the technical and organisational measures in Annex II and may update them provided the overall level of protection is not reduced.
4. Sub-processors
Controller authorises the sub-processors listed on the sub-processors page. Processor gives at least [30 days] notice of a new sub-processor; Controller may object on reasonable data protection grounds, and if the parties cannot resolve the objection, Controller may terminate the affected Service and receive a refund of prepaid fees. Processor imposes data protection terms on each sub-processor no less protective than this DPA and remains responsible for it.
Where Controller supplies its own AI model provider credential, that provider processes data under Controller's own contract with it and is not Processor's sub-processor.
5. Data subject requests
Taking into account the nature of the processing, Processor assists Controller, through the Service's features or on request, in responding to requests from data subjects. Processor forwards any request it receives directly to Controller.
6. Assistance
Processor provides reasonable assistance with Controller's data protection impact assessments and prior consultations, to the extent they concern the Service.
7. Personal data breaches
Processor notifies Controller without undue delay, and in any case within [48 hours], after becoming aware of a personal data breach affecting Customer Personal Data, with the information Controller reasonably needs to meet its own obligations, and updates it as more becomes known.
8. International transfers
Customer Personal Data is hosted in the United States. Transfers from the EEA, UK or Switzerland are made under [the EU Standard Contractual Clauses, Module 2, and the UK International Data Transfer Addendum, incorporated by reference with the selections in Annex III].
9. Audits
Processor makes available the information reasonably necessary to demonstrate compliance with this DPA, including [third-party reports or certifications, if and when held] and answers to security questionnaires. Where that is not sufficient, Controller may audit on [30 days] notice, no more than once a year, at its own cost, under confidentiality, in a way that does not compromise other customers' data.
10. Deletion and return
At the end of the agreement, Controller may export Customer Personal Data for [30 days]. Processor then deletes it from the Service, and from backups as they expire within [N days], unless law requires retention.
Annex I — Details of processing
| Subject matter | Provision of the Service: IT service management, configuration management, workflow and evidence records, and optional AI agent features. |
|---|---|
| Duration | The term of the agreement plus the deletion period in section 10. |
| Nature and purpose | Hosting, storage, retrieval, display, transmission (including email notifications and, where Controller enables them, sending ticket content to Controller's chosen model provider), backup and deletion. |
| Data subjects | Controller's staff and contractors who use the console; Controller's end users and customers who raise requests; people named in tickets or configuration items. |
| Categories of data | Names, work contact details, job titles, team and department membership, sign-in and security event records, ticket content and attachments, and anything Controller chooses to record in the Service. |
| Special categories | None intended. Controller should not submit special category data without agreement. |
Annex II — Technical and organisational measures
- Tenant isolation: every tenant table is protected by forced PostgreSQL row-level security, so a query without a tenant scope returns nothing rather than another tenant's rows.
- Encryption: data encrypted in transit with TLS and at rest by Google Cloud.
- Access control: role-based permissions; single sign-on with Google, Microsoft Entra ID or Okta; authenticator-app codes; step-up re-authentication before sensitive approvals; SCIM deprovisioning.
- Secrets: integration and model credentials stored in a secret manager and referenced, never stored as plain values in the database or readable back by anyone.
- Audit: an append-only security event log of sign-ins, denials, administrative changes and agent decisions, with alert rules over it.
- AI controls: agents hold no permissions of their own and act within a named user's permissions; configurable human confirmation, two-person approval and spend caps.
- Operations: automated tests and review before every change; [backup frequency, restore testing, RPO and RTO]; [personnel security, vulnerability management and incident response procedures].
Annex III — Transfer details
[SCC module, clause 7 docking, clause 9 option and period, clause 11 option, clause 13 supervisory authority, clause 17 and 18 governing law and courts; UK Addendum tables.]