Data processing addendum

1. Roles

You are the controller of the personal data contained in the evidence you upload. Vaulith is your processor and acts only on your documented instructions, which for the ordinary operation of the service are the instructions expressed through the product itself.

Where your evidence contains personal data belonging to consumers, claimants or insureds, you remain the controller of that data and warrant that you are entitled to provide it.

2. Subject matter and duration

Processing lasts for the term of your subscription and for any period in which you ask us to retain content. It covers the evidence artifacts, AI model records, policy claims and questionnaire responses you supply, and the access logs generated when you share a profile.

3. Categories of data subject

• Your personnel, as account holders.
• Carrier reviewers you send a share link to: their address, and the times and targets of their reading.
• Incidentally, individuals named inside evidence you describe. The service does not read the document; it withholds an artifact from sharing when you record that it contains such data, which is a safeguard that depends on your record and not a guarantee.

4. Security

The technical measures are published at /legal/trust and are incorporated here by reference. Those that can be verified mechanically are asserted against a real database on every build, and we would rather you check than take our word.

5. Subprocessors

The current list is at /legal/trust. We will give you notice before adding one, and you may object. No model provider appears on that list, because the findings engine is a deterministic rules set rather than a language model, so your evidence is not sent anywhere to be assessed.

6. International transfers

Processing takes place in the United States. There is no onward transfer outside it.

7. Assistance

We will assist you with data subject requests, with security incidents, and with any data protection impact assessment your own obligations require, in each case within the period the applicable law allows and at no additional charge for requests of ordinary scope.

8. Breach notification

Without undue delay and in any event within seventy-two hours of confirming an incident affecting your content, with what we know, what we are doing, and what we recommend you do.

9. Deletion and return

On termination you may export your profiles and evidence in a machine-readable format. We action a deletion request within thirty days and confirm it in writing. Reviewer access logs are deleted on the schedule stated in the privacy notice, which is enforced by a scheduled job rather than by intention.

10. Audit

We will answer a reasonable security questionnaire once in any twelve month period. We do not currently hold a SOC 2 report and do not offer on-site audit, which is stated plainly on the trust page rather than negotiated away here.