Data processing addendum
Avocet CRM acts as a processor for the customer data you connect. The DPA covers processing scope, our security measures, subprocessor notification, 72-hour breach notification, deletion on termination, and your audit rights.
A countersignable DPA is available on request while this page is under legal review. Email privacy@tryavocet.com and we will send it the same day.
Who is controller and who is processor?
You are the controller of the customer data in your workspace. Avocet CRM is the processor, acting only on your documented instructions. For our own account and billing data we are the controller.
What technical measures does the DPA commit you to?
Tenant isolation enforced by database row-level security, encryption in transit and at rest, encryption of stored credentials with versioned keys, least-privilege access, an append-only audit trail, and separate environments with separate credentials.
These are described in detail on the security page and are tested in continuous integration.
What is your breach notification commitment?
Notification without undue delay and within 72 hours of becoming aware, including what we know, what we do not yet know, and what we are doing. We will not wait for a complete picture before telling you something happened.
How are subprocessor changes handled?
Every subprocessor is listed publicly. We give 30 days notice before adding one, and you may object. Adding a model provider is treated as a material change and gets the same notice.
What happens to data on termination?
Deleted within 30 days of termination, with backups rolling off within 35 days. Export is available throughout.