Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Quiet Forge ("Processor") and the Customer ("Controller") and applies to the processing of personal data on behalf of the Controller in the course of providing the Service.

1. Subject matter

The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Service as described in the Terms.

2. Duration

Processing continues for the term of the Service agreement and ends on its termination (subject to deletion timelines below).

3. Nature and purpose

Hosting, storing, and operating the Service on behalf of the Controller. The Processor will not access Customer Data except as necessary for support, security, or as instructed.

4. Categories of data

Identifiers (email, name), authentication data (hashed password, sessions), Customer Data (project/task content), usage logs, billing data.

5. Categories of data subjects

The Controller's employees, contractors, and end users.

6. Sub-processors

The Controller authorizes the Processor to engage sub-processors listed in the Privacy Policy. The Processor will notify the Controller of any new sub-processor at least 30 days before adding them.

7. Security measures

TLS 1.2+ in transit, AES-256 at rest, role-based access, 2FA for staff, encrypted daily backups, periodic security reviews. Security incidents reported within 72 hours.

8. Assistance

The Processor will assist the Controller in fulfilling data-subject requests and DPIA obligations as reasonably required.

9. Return and deletion

Upon termination, the Processor will delete or return all Customer Data within 30 days, except where retention is required by law (e.g., billing records).

10. Audits

The Processor will make available, on reasonable request, all information necessary to demonstrate compliance, including SOC 2 reports (when available) and answers to security questionnaires.

This DPA is provided as a template. For a signed version with mutual amendments, contact legal@quietforge.tech.