Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer organisation (the “Controller”) and ISOSOC Advisory Ltd, a company registered in England and Wales (company number 17254731) (the “Processor”, “we”) for use of riskregister.com. Where we process personal data contained in Customer Data on the Controller’s behalf, we do so only as a processor. This DPA prevails over any conflicting term in the main agreement with respect to the processing of personal data.

• Subject matter: provision of the riskregister.com service.
• Duration: for the term of the agreement and any retention period described in our Privacy Policy.
• Nature and purpose: hosting, storage and processing of Customer Data to operate, secure and support the Service.
• Types of personal data: account identifiers (email, name, role) and any personal data the Controller chooses to include in its risk, control and comment records.
• Categories of data subjects: the Controller’s members and any individuals referenced in its content.

We will:

• process personal data only on the Controller’s documented instructions, including the agreement and this DPA, unless required otherwise by law;
• ensure that personnel authorised to process personal data are bound by confidentiality;
• implement appropriate technical and organisational measures (see the annex below);
• assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting its security, breach-notification and impact-assessment obligations; and
• at the Controller’s choice, delete or return personal data at the end of the engagement, subject to retention required by law.

The Controller authorises our use of the subprocessors listed below. Each is engaged under terms that impose data-protection obligations no less protective than this DPA. We keep the list below up to date. Before we add or replace a subprocessor, we will tell the Controller and give it the opportunity to object on reasonable data-protection grounds.

• Vercel — Application hosting, content delivery and bot protection.
• Supabase — Managed PostgreSQL database hosting.
• Clerk — Authentication and identity (email one-time-code sign-in).
• Stripe — Payment processing and subscription billing.
• Resend — Transactional email delivery.
• Anthropic — AI-assisted risk generation, suggestions and categorisation.
• Apollo — Company information lookup from your organisation's web domain, to prefill its profile.
• Upstash — Rate limiting (managed Redis).
• Sentry — Application error monitoring.
• Inngest — Background job orchestration (webhook delivery, reminders).
• PostHog (EU) — Product analytics and session recordings, without cookies and with all on-screen text and everything typed masked, processed and stored in the EU (Frankfurt).

Where we or our subprocessors transfer personal data across borders, including to the United States, we put in place an appropriate transfer mechanism — the EU Standard Contractual Clauses and, for transfers from the UK, the UK International Data Transfer Addendum — together with any supplementary measures required.

We will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably necessary for the Controller to meet its own notification obligations. Our standard target for notification is without undue delay, and in any event within 72 hours of becoming aware.

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, including inspections, by the Controller or its mandated auditor, subject to reasonable conditions: at least 30 days’ written notice, no more than once in any 12-month period, during business hours, without disrupting the Service, and under confidentiality undertakings. Where available, we may satisfy audit requests by providing third-party certifications or reports.

On termination, the Controller may export Customer Data using the Service’s export features for a reasonable period. After that period we will delete Customer Data in line with our retention practices, except where retention is required by law.

We maintain measures appropriate to the risk, including:

• Tenant isolation — row-level security in the database enforces strict separation between organisations.
• Encryption — data is encrypted in transit (TLS) and at rest at our hosting and database providers.
• Authentication — passwordless sign-in removes password-reuse and credential-theft risk; programmatic access uses scoped, revocable tokens.
• Access control — role-based permissions and least-privilege internal access.
• Auditability — an append-only audit log records actions taken in each account.
• Resilience — rate limiting and provider-level backups and monitoring.

To enter into a signed copy of this DPA or to raise a data-protection query, contact legal@riskregister.com.