Data Processing Addendum

Status. This is the working template Monolith Data Systems LLC negotiates from. The executable form for any specific customer requires counsel review on both sides. Email admin@monolithdata.com to start a DPA conversation.

1. Parties

This Data Processing Addendum ("DPA") supplements the master subscription agreement (the "Agreement") between Monolith Data Systems LLC, a Connecticut limited liability company ("Processor", "Monolith", "we", or "us"), and the customer entity identified in the Agreement ("Controller", "Customer", or "you").

2. Scope + roles

Customer is the data controller of personal data submitted to the CoreFlow OS service. Monolith processes that personal data solely on Customer's documented instructions to provide the service, as a data processor. The categories of data subjects, types of personal data, processing purposes, and retention periods are described in Annex A.

3. Customer obligations

• Has all necessary rights and consents to share personal data with Monolith.
• Complies with applicable data-protection laws as a controller.
• Configures CoreFlow OS to reflect data-subject preferences (consent toggles, RTBF, export).
• Does not submit special-category data (health, biometric, etc.) without prior written agreement.

4. Monolith obligations as Processor

• Process personal data only per Customer's documented instructions (incl. the Agreement, this DPA, and Customer's in-product configuration).
• Ensure personnel authorized to process personal data are bound by confidentiality.
• Implement and maintain technical + organizational security measures appropriate to the risk (described in Annex B).
• Notify Customer without undue delay of a personal-data breach affecting Customer data, per the incident response runbook (/help > ops).
• Assist Customer in fulfilling data-subject rights requests (access, rectification, deletion, portability) via the in-product surfaces and reasonable cooperation.
• Make available the information necessary for Customer to demonstrate compliance with this DPA.

5. Sub-processors

Customer authorizes Monolith to engage the sub-processors listed at /legal/sub-processors for the purposes described there. We'll notify Customer of additions or replacements at least 30 days before a new sub-processor processes Customer data; Customer may object on reasonable grounds.

6. International data transfers

Monolith is US-based at v1.0. Customer data is processed in the United States. If Customer requires EU/EEA, UK, or other-jurisdiction data residency, this DPA does not currently support it — see /legal/us-only for the roadmap.

7. Data subject rights

Monolith provides in-product tools that Customer can use to assist data subjects:

• Export at /settings/account/export — produces a zip of org-scoped data.
• Deletion request at /settings/account/delete — submits an RTBF request reviewed by Monolith staff; executed within a 30-day grace window.
• Audit log at /settings/audit — visibility into actions against the org, including platform-admin (break-glass) access.

8. Term + termination

This DPA is effective until the Agreement terminates. On termination, Monolith will:

• Make Customer data available for export for 30 days following the effective termination date.
• Delete Customer data within 60 days of termination, except where retention is required by law (billing/legal records, anonymized to remove personal data where feasible).

9. Liability

The liability provisions of the Agreement govern this DPA. Where applicable law caps processor liability differently for data-protection breaches, the higher applicable cap applies.

Annex A — Data categories

Annex B — Security measures

• Encryption in transit (TLS 1.3+) and at rest (Postgres at-rest encryption).
• Row-level security on every tenant-scoped table; cross-tenant isolation test matrix.
• Per-user TOTP available; mandatory enrollment after 15-day grace window.
• Per-user-and-IP failed-login lockout (5 failures / 15 min).
• Audit log of role-membership changes + platform-admin access; break-glass admin requires written reason + auto-expires.
• Vulnerability scanning on dependencies (Snyk) + secrets scanning (Gitleaks) on every PR.
• Incident response runbook with SEV1/2/3 severity matrix + customer-comm cadence; published status page.
• LLM threat model documenting prompt-injection / tool-use / training-data-leak mitigations.