Data Processing Addendum

1Roles

The Customer is the Controller of personal data contained in Customer Data. TrueSynthesis is the Processor, acting only on the Customer’s documented instructions. Where TrueSynthesis engages a third party to process Customer Data, that party is a Sub-processor.

The underlying agreement, this Addendum, and the Customer’s configuration choices in the CorpusAegis portal constitute the Customer’s complete documented instructions. TrueSynthesis processes Customer Data for no other purpose.

2Subject matter, duration, nature, purpose

Whether CorpusAegis accepts special-category data at all is an open business decision. The current recommendation is an explicit written prohibition unless and until a specific engagement is separately scoped and priced.

3Processor obligations

TrueSynthesis shall:

1. Process Customer Data only on documented Customer instructions, including for international transfers, unless required otherwise by law — in which case TrueSynthesis notifies the Customer before processing unless legally prohibited.
2. Ensure personnel authorized to process Customer Data are bound by confidentiality.
3. Implement the technical and organizational measures described in §6.
4. Respect the Sub-processor conditions in §5.
5. Assist the Customer, insofar as possible, in responding to data-subject requests.
6. Assist the Customer with security, breach notification, impact assessments, and prior consultation, taking into account the nature of processing and the information available to TrueSynthesis.
7. Delete or return Customer Data per §7.
8. Make available information necessary to demonstrate compliance, and permit audits per §8.
9. Immediately inform the Customer if, in its opinion, an instruction infringes applicable data-protection law.

4Customer obligations

The Customer warrants that it has a lawful basis for the personal data it uploads, that it has provided any required notices to data subjects, and that its instructions comply with applicable law. The Customer determines what documents enter the corpus. TrueSynthesis does not inspect, filter, or classify Customer documents for legal permissibility.

5Sub-processors

The Customer provides general written authorization for TrueSynthesis to engage Sub-processors, subject to the conditions below. TrueSynthesis imposes data-protection obligations on each Sub-processor no less protective than this Addendum, and remains fully liable for each Sub-processor’s performance.

5.2 Model processing

In the standard hosted configuration, answer generation runs on open-weight models self-hosted by TrueSynthesis. No third-party model provider receives customer document text.

This is a configuration commitment, not an incidental fact, and TrueSynthesis will pin and verify it per tenant. Third-party model APIs are used in TrueSynthesis’s own internal research and evaluation on public and synthetic corpora; they are not enabled for customer tenants.

This is the largest open item in this draft. Two decisions remain: whether any tier may ever route customer document text to a third-party model provider, and if so, the disclosure and flow-down consequences. Until they are resolved, the engineering rule stands — no customer tenant is configured with a third-party answer or judge model.

5.3 Changes

TrueSynthesis gives 30 days’ written notice before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected service without penalty for the unused prepaid term.

6Security measures

This table is deliberately honest about what does not yet exist. It is accurate as a description of the platform on 2026-08-04, and it would be inaccurate as a description of a live multi-tenant service — because there is not one.

The rows marked designed, not yet built must close before any customer corpus containing personal data is onboarded. That is the reason CorpusAegis does not accept customer documents today.

7Deletion and return

On termination, or on written request, TrueSynthesis deletes Customer Data on the schedule and with the limitations set out in the Data Retention and Deletion Policy, including the stated backup carve-out. On request made before deletion, TrueSynthesis returns the processed corpus, retrieval index, permitted model artifacts, configuration, and evaluation results.

8Audit

TrueSynthesis makes available the information reasonably necessary to demonstrate compliance with this Addendum. The Customer may audit no more than once per twelve months, on 30 days’ notice, during business hours, subject to confidentiality, at the Customer’s expense, and without access to other customers’ data or to TrueSynthesis’s proprietary platform internals. An independent third-party audit report, once available, satisfies this obligation.

9Personal data breach

TrueSynthesis notifies the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data, with the information then available, supplemented as the investigation proceeds.

48 hours is a proposal. It is more demanding than the processor’s legal duty and requires an on-call rota that can meet it. The number is subject to counsel review and to that rota existing.

10International transfers

Not drafted. All current Sub-processors are US-based and the initial target market is US-based organizations. An EU, UK, or Swiss customer requires the appropriate transfer mechanism — standard contractual clauses with the relevant module, the UK addendum, and a transfer impact assessment. No EU customer may be signed against this draft.

11Order of precedence

In the event of conflict, this Addendum prevails over the underlying agreement with respect to the processing of personal data.

12Open items before execution

No customer document containing personal data is processed until items 1, 5, and 6 close.