Data Processing Agreement
Draft scaffold · no effective date · replace before beta onboarding
This page is a structural placeholder, not WinLayer's binding data processing agreement. It has not been reviewed by counsel and must be replaced before onboarding any customer.
Roles and definitions
Counsel to draftDefine WinLayer as processor and the customer as controller for customer-provided data; note WinLayer may be an independent controller for the public government data it aggregates. Counsel to confirm this split.
Subject matter and duration of processing
Counsel to draftWhat is processed, for how long, and for what purpose — tied to the subscription term.
- Processing covers company profile, uploaded documents, users, and usage telemetry for the duration of the subscription plus any retention window.
Nature and purpose of processing
Counsel to draftThe operations performed on customer data.
- Storage, indexing/embedding, AI analysis and generation, scoring, and delivery of results to the customer's workspace.
Subprocessors
Counsel to draftThe authoritative subprocessor list with locations, plus the customer's right to notice of changes and to object.
- Confirm the contracted entities and actual processing locations for AWS, Clerk, active AI and billing providers, and any activated graph, email, monitoring or integration provider. A catalog entry does not prove a provider is active.
- The application origin uses commercial AWS us-east-1; content delivery and external providers require separate location and transfer review. GovCloud is deferred.
Technical and organizational security measures
Counsel to draftThe Annex of security measures. Describe accurately, without claiming certifications not held.
- Encryption at rest and in transit; per-tenant isolation enforced by middleware and tested; append-only audit log; document malware quarantine; KMS-based envelope encryption for integration credentials.
- SOC 2 controls are groundwork only — not an audited report yet.
Data subject rights and assistance
Counsel to draftHow WinLayer helps the controller respond to access/deletion/portability requests.
- Export and deletion are implemented and can be invoked per tenant to service such requests.
Personal data breach notification
Counsel to draftTimeline and mechanism for notifying the controller of a breach.
Return and deletion on termination
Counsel to draftWhat happens to data when the agreement ends; align with the implemented deletion/purge and any legal-hold exceptions.
- Implemented: export, grace-period deletion, verified purge, and legal holds that can suspend deletion where required.
Government contact PII
Counsel to draftSpecific handling of the government point-of-contact personal data the platform aggregates — the highest-sensitivity category. Address lawful basis, minimization, and retention explicitly.
- Contracting officer / COR names and emails are stored; the plan flags this (G9) as requiring a defined PII policy before beta onboarding.
International transfers
Counsel to draftOnly if relevant. MVP is US-only, so transfers may be out of scope — counsel to confirm.