Data Processing Agreement

A standard Data Processing Agreement is available upon request.

• AWS hosting — us-east-1 and us-west-2.
• Encryption — AES-256 at rest; TLS 1.3 in transit.
• Tenant isolation — logical isolation through TenantID partitioning at the database level.
• Retention — metadata 3 years; raw evidence logs 1 year or the customer-specific contractual period.
• RBAC — Viewer, Investigator, Lead, Admin.
• Data residency — maintained within the applicable regional AWS boundary.

AI provider — OpenAI GPT-4o through Azure OpenAI Service under an enterprise agreement. Training policy — client data is not used for foundational-model training. AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.