This Data Processing Agreement ("DPA") forms part of the agreement between Onboard AI ("Processor", "we") and Customer name ("Controller", "you") governing Onboard AI's processing of personal data on your behalf through the Service.
⚠️ Placeholder entity: do not send until Onboard AI is incorporated.
1. Roles
For the categories of data described in Section 2 of the Privacy Policy as "Processor" (end-client data, business communications pulled from connected integrations, and meeting recordings/transcripts), you are the Controller and Onboard AI is the Processor.
For workspace staff account data, the roles are mixed as described in the Privacy Policy — Onboard AI acts in part as an independent controller for its own operational purposes (security, billing, metering).
This classification should be confirmed by your legal counsel against your specific use of the Service.
2. Subject matter and duration
- Subject matter: processing of personal data as necessary to provide the Service described in the Terms of Service.
- Duration: for the term of your agreement with Onboard AI, plus any post-termination retention described in Section 7 below.
- Nature and purpose: event ingestion and classification, client record management, AI-assisted drafting and automation, meeting recording/transcription, as described in the product and the Privacy Policy.
- Categories of data subjects: your workspace's staff/users, your end-clients and their contacts, and (for meeting recordings) meeting participants.
- Categories of personal data: names, email addresses, business communications content, meeting audio/transcripts, and related metadata, as described in the Privacy Policy, Section 3.
3. Processor obligations
Onboard AI will:
- Process personal data only on your documented instructions (as expressed through your use and configuration of the Service), except where required by law
- Ensure personnel with access to personal data are subject to confidentiality obligations
- Implement the technical and organizational security measures described in Section 5
- Engage subprocessors only as listed in Section 4, and notify you before adding or replacing one (see Section 4)
- Assist you, to the extent technically feasible, with data-subject rights requests and your own compliance obligations (Section 6)
- Notify you without undue delay upon becoming aware of a personal data breach affecting your data
- Delete or return personal data at the end of the service relationship, as described in Section 7
4. Subprocessors
You consent to Onboard AI's use of the following subprocessors as of the date of this DPA:
| Subprocessor | Purpose | Location |
|---|---|---|
| Railway | Hosting, database, cache | us-west2 (United States) |
| Ollama Cloud | AI inference | United States |
| Pinecone | Vector embeddings | AWS us-east-1 (unconfirmed) |
| Resend | Transactional email | United States |
Change process: Onboard AI does not yet have an automated subprocessor-notification system. During the pilot period, we will notify you by email at least 14 days before adding or replacing a subprocessor that will process your data. You may object on reasonable grounds related to data protection; if we cannot address your objection, you may terminate the affected part of the Service.
5. Security measures
- Field-level encryption (AES-256-GCM) for sensitive data categories at rest
- Application-level multi-tenant isolation
- Daily encrypted database backups, retained 14 days (no point-in-time recovery currently offered — see Privacy Policy Section 7)
- Audit logging of account and data actions
- SSO support
6. Assistance with data subject rights and DPIAs
Onboard AI will provide reasonable assistance to help you respond to data-subject requests (access, correction, deletion, portability) concerning personal data processed through the Service, to the extent such assistance is technically feasible given the Service's current capabilities.
Known current limitation: the Service does not yet have an automated mechanism for erasing a single individual's data across integrations (e.g., removing one person's messages from synced Slack history) independent of deleting the whole workspace. Such requests are handled manually on a best-effort basis during the pilot period. This is disclosed so you can factor it into your own compliance obligations as Controller.
7. Data return and deletion
At the end of your use of the Service, you may request export of your data (subject to current export capabilities — note that recordings, transcripts and notes are not currently exportable; this is disclosed as a known limitation). Following workspace deletion, Onboard AI will purge personal data per the process described in Privacy Policy Section 8, subject to the backup-retention window described in Privacy Policy Section 7 (up to 14 days).
8. International transfers
Processing occurs on infrastructure located in the United States (Railway, us-west2). Where this DPA covers personal data originating in the EU, UK, or other jurisdictions with cross-border transfer restrictions:
⚠️ Not yet in place: Onboard AI has not yet implemented a cross-border transfer mechanism (e.g., Standard Contractual Clauses). This DPA cannot be validly relied upon for EU-origin personal data transfers until this is resolved. Flag to counsel before signing with any customer whose data includes EU data subjects.
9. Audit rights
On your written request, no more than once a year and after any security incident that affects your data, we will give you the information reasonably needed to confirm we are meeting this DPA: this DPA, our current subprocessor list, and a description of our security measures. We will answer reasonable written questions about how we process your data. On-site audits are not included at this stage. If a regulator requires an inspection, we will cooperate as the law requires.
10. Liability
Governed by the liability terms of the underlying Terms of Service / Pilot Agreement between the parties.