DATA PROCESSING AGREEMENT

This agreement applies whenever your organization puts personal data into Brutus or hands it to us during an engagement. It is made with Tenger Ways, LLC, a Delaware limited liability company, of 156 Chappaqua Road, Briarcliff Manor, NY 10510. You are the controller: it is your data and your purposes. We are the processor: we act on your instructions and nothing else. It forms part of the Terms of Service, and where your organization has signed its own DPA with us, that one governs.

What we process, and why

The subject matter is the provision of Brutus and any consulting work you have engaged us for. The duration is the life of that engagement plus the deletion windows below. The categories of data are whatever your people put into the workspace or the systems they connect: typically names, work contact details, message and ticket content, financial and operational records, and whatever else lives in the tools you connect. The data subjects are typically your employees, your contractors, your clients and your suppliers.

Our instructions

We process personal data only to provide the service, to keep it secure, and to follow your documented instructions. Using the product is itself an instruction: when a person asks Brutus to reconcile an invoice, that is the instruction to process what the invoice contains. We do not process your personal data for our own purposes. We do not sell it. We do not use it to train models for anyone else, and we do not let our model providers train on it.

If an instruction from you would, in our view, break data protection law, we will tell you rather than quietly carry it out. If a law compels us to process beyond your instructions, we will tell you before we do, unless that law forbids telling you.

Confidentiality and the people who can see it

Access is limited to the people who need it to do their jobs, each under a confidentiality obligation that survives their leaving. Credentials are scoped per project and per person, they fail closed, and every read is logged and revocable. There is no master key, so there is no master key to lose.

Security

We keep technical and organizational measures appropriate to the risk, including encryption in transit and at rest, least-privilege access, logging of access to customer data, separation of client work, scoped and revocable credentials, and a documented process for handling incidents. We hold SOC 2 Type II, and on written request, no more than annually during the term, we will give you the third-party report evidencing the operating effectiveness of that control environment, together with summaries of our information security and disaster recovery policies and reasonable access to our senior IT people. The report is our confidential information and is covered by the confidentiality terms above.

Subprocessors

We use the subprocessors listed on that page, each under written terms no weaker than these, and we remain responsible to you for what they do. The page is the authoritative list. We will give at least thirty days’ notice before adding one, by email to your administrator. If you object on reasonable data protection grounds within those thirty days, we will work with you to find an alternative, and if there is none you may terminate the affected service without penalty.

Helping you with your obligations

If a data subject contacts us directly, we will point them to you rather than answer for you. We will help you respond to access, correction, deletion, portability and objection requests, and help with data protection impact assessments and regulator consultations, taking into account what the service makes technically possible.

If something goes wrong

We will notify you in writing without unreasonable delay, and in any case within forty-eight hours of becoming aware of a personal data breach affecting your data. The notice will say what happened, which categories and roughly how many records are affected, what we are doing about it, and what we suggest you do. We will keep you updated as we learn more rather than waiting until we have a complete picture, and we will not notify a regulator or an affected individual about an incident in your data without telling you first, unless the law compels us to.

Transfers

Our infrastructure and our subprocessors are primarily in the United States, and our Specialists work from the United States, India and Eastern Europe. Where personal data moves out of the UK or the European Economic Area, we rely on the Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, and on measures appropriate to the transfer.

Deletion and return

You can export your content at any time while the service is running. When an engagement ends, we will return or delete your personal data at your choice, and delete it within ninety days unless you ask for longer or a law requires us to keep it. Backups age out on their normal cycle, and anything held in a backup stays subject to this agreement until it does.

Audit

On reasonable notice, and no more than once a year unless a regulator or a breach warrants it, we will make available the information needed to show we are meeting this agreement, and submit to an audit by you or an auditor you appoint who is not a competitor of ours.

Signing it

If your organization needs this executed as a standalone document, or needs it on your paper, write to hello@tengerways.com and we will send a copy for signature.

Questions

Write to hello@tengerways.com and a person will answer. If a term here conflicts with a signed agreement between us, the signed agreement wins.

← All legal documents