Data Processing Addendum

This Data Processing Addendum (this “DPA”) forms part of the agreement between Fulcrum Technologies, Inc. dba Spiral, Inc. (“Spiral”) and the customer that agrees to it (“Customer”) for the Spiral service. That agreement is the Spiral Terms of Service, or a separate written agreement between Customer and Spiral that governs the Service (in each case, the “Agreement”).

This DPA applies when, and to the extent that, Spiral Processes Customer Personal Data on Customer’s behalf in the course of providing the Service. Section 4 also applies to the additional Security Incidents that Section 12 defines for resources that Customer controls. Section 12 defines the capitalized terms. Capitalized terms that this DPA does not define have the meanings that the Agreement gives them.

#1. Processor and Subprocessor Relationships

1.1 Spiral as Processor. In situations where Customer is a Controller of the Customer Personal Data, Spiral will be deemed a Processor that is Processing Personal Data on behalf of Customer.

1.2 Spiral as Subprocessor. In situations where Customer is a Processor of the Customer Personal Data, Spiral will be deemed a Subprocessor of the Customer Personal Data.

1.3 Data Outside this DPA. This DPA does not apply to Personal Data for which Spiral decides the purposes and means of the Processing as a Controller. That Personal Data is the account and business contact information of Users, and the information about Users’ use of the Product that Spiral Processes to bill for, secure, support, and improve the Service. Spiral’s privacy policy describes that Processing. The nature of the Processing decides whether this DPA applies. The name that the Agreement gives to a category of data does not. This DPA also does not apply to data that remains in storage or compute resources that Customer controls, except to the extent that Spiral accesses that data to provide the Service. This exclusion does not limit Section 4 for a Security Incident that affects Personal Data in those resources.

#2. Processing

2.1 Processing Details. Annex I describes the subject matter, nature, purpose, and duration of this Processing, as well as the categories of Personal Data collected and the categories of data subjects.

2.2 Processing Instructions. Customer instructs Spiral to Process Customer Personal Data: (a) to provide and maintain the Service; (b) as may be further specified through Customer’s use of the Service; (c) as documented in the Agreement; and (d) as documented in any other written instructions given by Customer and acknowledged by Spiral about Processing Customer Personal Data under this DPA. Spiral will abide by these instructions unless prohibited from doing so by Applicable Laws. Spiral will immediately inform Customer if it is unable to follow the Processing instructions. Spiral will also inform Customer immediately if, in Spiral’s opinion, an instruction infringes Applicable Data Protection Laws. Customer has given and will only give instructions that comply with Applicable Laws.

2.3 Processing by Spiral. Spiral will only Process Customer Personal Data in accordance with this DPA, including the details in Annex I. If Spiral updates the Service to update existing or include new products, features, or functionality, Spiral may change the details in Annex I as needed to reflect the updates by notifying Customer of the updates and changes.

2.4 Customer Processing. Where Customer is a Processor and Spiral is a Subprocessor, Customer will comply with all Applicable Laws that apply to Customer’s Processing of Customer Personal Data. Customer’s agreement with its Controller will similarly require Customer to comply with all Applicable Laws that apply to Customer as a Processor. In addition, Customer will comply with the Subprocessor requirements in Customer’s agreement with its Controller.

2.5 Consent to Processing. Customer has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Customer Personal Data to Spiral and/or the Service, including making all disclosures, obtaining all consents, providing adequate choice, and implementing relevant safeguards required under Applicable Data Protection Laws.

2.6 Subprocessors.

(a) Spiral will not provide, transfer, or hand over any Customer Personal Data to a Subprocessor unless Customer has approved the Subprocessor. Customer approves the Subprocessors on the list at https://spiraldb.com/subprocessors (the “Approved Subprocessors”). The current list of Approved Subprocessors includes the identities of the Subprocessors, their country of location, and their anticipated Processing tasks. Spiral will inform Customer at least 10 business days in advance and in writing of any intended changes to the Approved Subprocessors whether by addition or replacement of a Subprocessor, which allows Customer to have enough time to object to the changes before Spiral begins using the new Subprocessor(s). Spiral will give Customer the information necessary to allow Customer to exercise its right to object to the change to Approved Subprocessors. Customer may object to the change on reasonable data protection grounds, by written notice to legal@spiraldb.com within those 10 business days, otherwise Customer will be deemed to accept the changes.

(b) If Customer objects within those 10 business days, Customer and Spiral will cooperate in good faith to resolve Customer’s objection or concern. The objection stays open until the parties resolve it, or until 30 days after Spiral receives it. While the objection is open, Spiral will not use the new Subprocessor to Process Customer Personal Data. If Spiral cannot provide the Service to Customer without the new Subprocessor, Spiral will tell Customer so, and Customer may terminate the part of the Service that the change affects at once. If the parties do not resolve the objection within those 30 days, Customer may terminate that part of the Service by written notice to Spiral, and Spiral may then use the new Subprocessor. Customer remains liable for the Fees that accrue before a termination under this Section 2.6(b). These outcomes are Customer’s only remedies for the objection.

(c) When engaging a Subprocessor, Spiral will have a written agreement with the Subprocessor that ensures the Subprocessor only accesses and uses Customer Personal Data (i) to the extent required to perform the obligations subcontracted to it, and (ii) consistent with the terms of Agreement.

(d) If the GDPR applies to the Processing of Customer Personal Data, (i) the data protection obligations described in this DPA (as referred to in Article 28(3) of the GDPR, if applicable) are also imposed on the Subprocessor, and (ii) Spiral’s agreement with the Subprocessor will incorporate these obligations, including details about how Spiral and its Subprocessor will coordinate to respond to inquiries or requests about the Processing of Customer Personal Data. In addition, Spiral will share, at Customer’s request, a copy of its agreements (including any amendments) with its Subprocessors. To the extent necessary to protect business secrets or other confidential information, including personal data, Spiral may redact the text of its agreement with its Subprocessor prior to sharing a copy.

(e) Spiral remains fully liable for all obligations subcontracted to its Subprocessors, including the acts and omissions of its Subprocessors in Processing Customer Personal Data. Spiral will notify Customer of any failure by its Subprocessors to fulfill a material obligation about Customer Personal Data under the agreement between Spiral and the Subprocessor.

2.7 Personnel and Security. Spiral will implement and maintain the technical and organizational measures that Annex II describes. Spiral will ensure that each person that it authorizes to Process Customer Personal Data is bound by a duty of confidentiality.

#3. Restricted Transfers

3.1 Authorization. Customer agrees that Spiral may transfer Customer Personal Data outside the EEA, the United Kingdom, or other relevant geographic territory as necessary to provide the Service. If Spiral transfers Customer Personal Data to a territory for which the European Commission or other relevant supervisory authority has not issued an adequacy decision, Spiral will implement appropriate safeguards for the transfer of Customer Personal Data to that territory consistent with Applicable Data Protection Laws.

3.2 Transfers Subject to the GDPR. Customer and Spiral agree that if the GDPR applies to a transfer of Customer Personal Data from Customer to Spiral, and that transfer is a Restricted Transfer, then by entering into this DPA, Customer and Spiral are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference. This rule applies whether Customer is established inside or outside the EEA. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:

(a) Module Two (Controller to Processor) of the EEA SCCs apply when Customer is a Controller and Spiral is Processing Customer Personal Data for Customer as a Processor.

(b) Module Three (Processor to Sub-Processor) of the EEA SCCs apply when Customer is a Processor and Spiral is Processing Customer Personal Data on behalf of Customer as a Subprocessor.

(c) For each module, the following applies (when applicable): (i) Customer is the data exporter and Spiral is the data importer; (ii) the optional docking clause in Clause 7 does not apply; (iii) in Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of Subprocessor changes is 10 business days; (iv) in Clause 11, the optional language does not apply; (v) all square brackets in Clause 13 are removed; (vi) in Clause 17 (Option 1), the EEA SCCs will be governed by the laws of Ireland; (vii) in Clause 18(b), disputes will be resolved in the courts of Ireland; and (viii) Annex I and Annex II of this DPA and the list of Approved Subprocessors contain the information required in Annex I, Annex II, and Annex III of the EEA SCCs.

3.3 Transfers Subject to the UK GDPR. Customer and Spiral agree that if the UK GDPR applies to a transfer of Customer Personal Data from Customer to Spiral, and that transfer is a Restricted Transfer, then by entering into this DPA, Customer and Spiral are deemed to have signed the UK Addendum and their Annexes, which are incorporated by reference. This rule applies whether Customer is established inside or outside the United Kingdom. Any such transfer is made pursuant to the UK Addendum, which is completed as follows:

(a) Annex I of this DPA contains the information required in Table 1 of the UK Addendum. Section 3.2 of this DPA contains the information required in Table 2 of the UK Addendum.

(b) Table 4 of the UK Addendum is modified as follows: Neither party may end the UK Addendum as set out in Section 19 of the UK Addendum; to the extent ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the parties will work in good faith to revise this DPA accordingly.

(c) Annex I and Annex II of this DPA and the list of Approved Subprocessors contain the information required by Annex 1A, Annex 1B, Annex II, and Annex III of the UK Addendum.

3.4 Transfers Subject to Swiss Law. Customer and Spiral agree that if the FADP applies to a transfer of Customer Personal Data from Customer to Spiral, and that transfer is a Restricted Transfer, then the EEA SCCs, completed as Section 3.2 states, are incorporated by reference and apply to that transfer with these changes:

(a) For a transfer that the FADP governs and the GDPR does not, references to the GDPR in the EEA SCCs are references to the FADP, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

(b) For a transfer that both the FADP and the GDPR govern, the EEA SCCs apply to all of the Processing as Section 3.2 completes them. The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority to the extent that the FADP governs the transfer, in parallel with the supervisory authority under Clause 13 of the EEA SCCs.

(c) In both cases, the term “Member State” in the EEA SCCs does not exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence under Clause 18(c).

3.5 Alternative Transfer Mechanisms. If Spiral adopts another lawful mechanism for a transfer that this Section 3 covers, such as a certification under the EU-US Data Privacy Framework, that mechanism applies to the transfer in place of the EEA SCCs and the UK Addendum, to the extent that it covers the transfer.

#4. Security Incident Response

4.1 When Spiral becomes aware of a Security Incident, Spiral will notify Customer without undue delay. Spiral will provide information as it becomes known and as Customer reasonably requests. The initial notice may contain incomplete information, with further details in subsequent updates. Spiral will promptly take reasonable steps to contain and investigate the Security Incident. Spiral’s notice and response do not constitute an admission of fault or liability.

#5. Audit and Reports

5.1 Audit Rights. Spiral will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Spiral will allow for and contribute to audits, including inspections by Customer, to assess Spiral’s compliance with this DPA. Customer will exercise its audit rights under this DPA, and any audit rights granted by Applicable Data Protection Laws, first through the Report and the information that Sections 5.2 and 5.3 describe, and then through an audit under Section 5.4. Spiral will maintain records of its compliance with this DPA for 3 years after the DPA ends.

5.2 Security Reports. Customer acknowledges that Spiral is regularly audited against the standards defined in Annex II by independent third-party auditors. Upon written request, Spiral will give Customer, on a confidential basis, a summary copy of its then-current Report so that Customer can verify Spiral’s compliance with the standards defined in Annex II.

5.3 Security Due Diligence. In addition to the Report, Spiral will respond to reasonable requests for information made by Customer to confirm Spiral’s compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its information security program. All such requests must be in writing and made to legal@spiraldb.com and may only be made once a year. The limit of once a year does not apply to a request that a supervisory authority requires, that follows a Security Incident, or that Customer makes because it has reasonable grounds to believe that Spiral does not comply with this DPA.

5.4 Audits. If the Report and the information under Section 5.3 do not satisfy an audit right that Applicable Data Protection Laws, the EEA SCCs, or the UK Addendum give Customer, or a requirement of a supervisory authority, Customer may audit Spiral’s compliance with this DPA, including by inspection, under these conditions:

• Customer may audit at most once in any twelve-month period. This limit does not apply to an additional audit that a supervisory authority requires, that follows a Security Incident, or that Customer requests because it has reasonable grounds to believe that Spiral does not comply with this DPA.
• Customer will give Spiral at least 30 days’ written notice. For an additional audit of one of those three kinds, a shorter notice that is reasonable in the circumstances is sufficient.
• The parties will agree the scope, the dates, and the duration before the audit starts, and neither party will unreasonably withhold or delay its agreement.
• The audit will take place during Spiral’s business hours and will not unreasonably disrupt Spiral’s business.
• Customer, or an independent auditor that is not a competitor of Spiral and that is bound by a written duty of confidentiality, will perform the audit.
• Customer will pay the costs of the audit, including Spiral’s reasonable costs.
• Spiral may apply proportionate safeguards to protect the data of its other customers, its confidential information, and the security of the Service. The audit will not include access to the data of any other customer, or to systems that do not Process Customer Personal Data.

The results of an audit are Spiral’s Confidential Information.

#6. Coordination and Cooperation

6.1 Response to Inquiries. If Spiral receives a third-party request about Customer Personal Data, Spiral will notify Customer unless Applicable Laws prohibit notice. Spiral will not respond without Customer’s prior consent unless Applicable Laws require a response. These requests include orders from authorities and requests from data subjects. Spiral will follow Customer’s reasonable instructions to the extent that Applicable Laws permit. Spiral will assist Customer with a valid request to delete Customer Personal Data or to exercise another right under Applicable Data Protection Laws. Customer remains responsible for its response to the request.

Spiral will reasonably assist Customer with a legal response to a third-party request, at Customer’s expense. This allocation does not apply to routine assistance with data subject requests or the assessments in Section 6.2. Nothing in this Section limits Spiral’s obligations under Section 3, the EEA SCCs, or the UK Addendum.

6.2 DPIAs and DTIAs. If required by Applicable Data Protection Laws, Spiral will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant data protection authorities, taking into consideration the nature of the Processing and Customer Personal Data.

6.3 Scope and Charges. Spiral will provide the reasonable assistance required by this Section without additional charges, except for the legal response costs in Section 6.1. That assistance takes account of the nature of the Processing and the information available to Spiral. Optional services beyond that assistance may require a separate written agreement with agreed charges. Spiral will not delay required assistance while the parties discuss optional services or their charges.

#7. Deletion of Customer Personal Data

7.1 Deletion by Customer. Spiral will enable Customer to delete Customer Personal Data through the Service. Spiral will comply with a valid deletion instruction promptly and within 30 days after receipt. This deadline applies to copies outside backups, except where Applicable Laws require retention. Spiral will delete backup copies on its regular backup schedule, within 180 days after the instruction. The restrictions on backup copies in Section 7.2(b) also apply to those copies.

7.2 Return or Deletion at the End of Service.

(a) When the Agreement or an Order ends, Spiral will return or delete the affected Customer Personal Data, as Customer chooses. This Section applies to data that Spiral no longer needs to provide another active Order. The relevant date is the expiration or termination date of that Agreement or Order. Customer chooses return if it asks Spiral in writing, before that date, to keep the Customer Personal Data available for export. If Spiral terminates without prior notice, Customer may make that request within 10 days after the termination, and Spiral will not delete Customer Personal Data during those 10 days. On that request, Spiral will keep the Customer Personal Data available for Customer to export for 30 days after that date (the “Export Period”). If the Agreement gives Customer a longer period to retrieve its data, such as the retrieval period under the EU Data Act, that period is the Export Period. If Customer does not make that request, Customer chooses deletion.

(b) Spiral will delete Customer Personal Data outside backups within 30 days after the affected Agreement or Order ends. If Customer elects an Export Period, that deadline runs from the end of the Export Period. Spiral will delete copies in its backups on its regular backup schedule, and no later than 180 days after the same date. Until Spiral deletes a backup copy, Spiral will not Process it for any purpose other than storage and the restoration of its systems, and this DPA continues to apply to it.

(c) Spiral may keep Customer Personal Data after those periods only to the extent that, and only for as long as, a law that applies to Spiral requires Spiral to keep it. Spiral will tell Customer of the requirement unless that law prohibits it, will Process that Customer Personal Data only for the purpose that the law requires, and will delete it when the requirement ends.

(d) If Customer and Spiral have entered the EEA SCCs or the UK Addendum as part of this DPA, Spiral will certify to Customer that it deleted the Customer Personal Data, as Clause 8.5 of the EEA SCCs describes, when the deletion is complete. In other cases, Spiral will give that certification if Customer asks for one.

7.3 Storage that Customer Controls. Section 7.2 does not apply to data in storage that Customer controls. Spiral deletes data in that storage only as Customer directs through the Service, and only to the extent that the access that Customer granted permits. Customer is responsible for the retention and deletion of that data, and for the removal of Spiral’s access to that storage.

#8. US State Privacy Laws

8.1 Service Provider Relationship. To the extent that the US State Privacy Laws apply to Customer Personal Data, Customer is a business and Spiral is its service provider, and Spiral:

• will Process Customer Personal Data only for the business purpose of providing the Service under the Agreement, and for no other commercial purpose;
• will not sell or share Customer Personal Data;
• will not retain, use, or disclose Customer Personal Data outside the direct business relationship between Spiral and Customer, except as the US State Privacy Laws permit a service provider to do;
• will not combine Customer Personal Data with Personal Data that Spiral receives from another source, except as the US State Privacy Laws permit a service provider to do;
• will comply with the obligations that the US State Privacy Laws impose on Spiral as a service provider, and will provide the level of privacy protection that those laws require; and
• will notify Customer if Spiral determines that it can no longer meet its obligations under the US State Privacy Laws.

8.2 Remediation. If Spiral gives that notice, or if Customer reasonably believes that Spiral uses Customer Personal Data in a manner that the Agreement does not permit, Customer may take reasonable and appropriate steps to stop and remediate the unauthorized use, including by exercising its rights under Section 5.

#9. Liability under this DPA

9.1 Liability Caps and Damages Waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party’s total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement.

9.2 Related-Party Claims. Any claims made against Spiral or its Affiliates arising out of or related to this DPA may only be brought by the Customer entity that is a party to the Agreement.

9.3 Exceptions. This DPA does not limit any liability to an individual about the individual’s data protection rights under Applicable Data Protection Laws. In addition, this DPA does not limit any liability between the parties for violations of the EEA SCCs or UK Addendum.

#10. Conflicts Between Documents

10.1 This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs or the UK Addendum, (2) this DPA, and then (3) the Agreement.

#11. Term of this DPA

11.1 Term. This DPA will start when Customer accepts the Agreement and will continue until the Agreement expires or is terminated. However, Spiral and Customer will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until Customer stops transferring Customer Personal Data to Spiral and Spiral stops Processing Customer Personal Data.

11.2 Changes to this DPA. Spiral may update this DPA in the way that the Agreement permits Spiral to update its terms. Spiral may also update this DPA when a change in Applicable Data Protection Laws requires it, and Spiral will give Customer notice of that update.

#12. Definitions of this DPA

“Applicable Laws” means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern a party.

“Applicable Data Protection Laws” means the Applicable Laws that govern how the Service may process or use an individual’s personal information, personal data, personally identifiable information, or other similar term.

“Controller” will have the meaning(s) given in the Applicable Data Protection Laws for the company that determines the purpose and extent of Processing Personal Data.

“Customer Personal Data” means Personal Data that Spiral Processes on Customer’s behalf in connection with the Service. It includes Personal Data supplied by or on behalf of Customer and Personal Data generated through that Processing.

“EEA SCCs” means the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the European Council.

“European Economic Area” or “EEA” means the member states of the European Union, Norway, Iceland, and Liechtenstein.

“GDPR” means European Union Regulation 2016/679 as implemented by local law in the relevant EEA member nation.

“Personal Data” will have the meaning(s) given in the Applicable Data Protection Laws for personal information, personal data, or other similar term.

“Processing” or “Process” will have the meaning(s) given in the Applicable Data Protection Laws for any use of, or performance of a computer operation on, Personal Data, including by automatic methods.

“Processor” will have the meaning(s) given in the Applicable Data Protection Laws for the company that Processes Personal Data on behalf of the Controller.

“Report” means audit reports prepared by another company according to the standards defined in Annex II on behalf of Spiral.

“FADP” means the Swiss Federal Act on Data Protection.

“Restricted Transfer” means a transfer of Personal Data that Applicable Data Protection Laws permit only if a transfer safeguard applies. It means: (a) where the GDPR applies, a transfer of personal data to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (b) where the UK GDPR applies, a transfer of personal data to a country outside of the United Kingdom which is not subject to adequacy regulations adopted pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (c) where the FADP applies, a disclosure of personal data to a country that Swiss law does not recognize as providing adequate protection.

“Security Incident” means a breach of security that affects Customer Personal Data in the possession or control of Spiral or a Subprocessor under this DPA and results in any of these events:

• accidental or unlawful destruction, loss, or alteration of Customer Personal Data;
• unauthorized disclosure of Customer Personal Data; or
• unauthorized access to Customer Personal Data.

A Security Incident also includes the same events affecting Personal Data in storage or compute resources that Customer controls if the breach occurs through the systems or credentials of Spiral or a Subprocessor. This coverage applies whether or not Spiral or a Subprocessor accessed that data before the breach. An incident confined to Customer’s own resources, without either connection to Spiral or a Subprocessor described above, is outside this definition. Unsuccessful attempts that do not compromise Personal Data are not Security Incidents.

“Service” means the product and/or services described in the Agreement.

“Special Category Data” will have the meaning given in Article 9 of the GDPR.

“Subprocessor” will have the meaning(s) given in the Applicable Data Protection Laws for a company that, with the approval and acceptance of Controller, assists the Processor in Processing Personal Data on behalf of the Controller.

“UK GDPR” means European Union Regulation 2016/679 as implemented by section 3 of the United Kingdom’s European Union (Withdrawal) Act of 2018 in the United Kingdom.

“UK Addendum” means the international data transfer addendum to the EEA SCCs issued by the Information Commissioner for Parties making Restricted Transfers under S119A(1) Data Protection Act 2018.

“US State Privacy Laws” means the California Consumer Privacy Act, as amended (the “CCPA”), and the comparable privacy laws of other US states. The terms “business”, “service provider”, “sell”, and “share” have the meanings that the CCPA gives them.

#Annex I: Details of the Processing

A. The parties. The data exporter is Customer, as Customer’s account or Service Order identifies it. Customer’s contact is its account or billing contact. Customer acts as a Controller or a Processor. The data importer is Fulcrum Technologies, Inc. dba Spiral, Inc., 169 Madison Ave, STE 11081, New York, New York 10016, United States. Spiral’s contact is legal@spiraldb.com. Spiral acts as a Processor or a Subprocessor.

B. Description of the processing.

C. Competent supervisory authority. The competent supervisory authority is the authority that Clause 13 of the EEA SCCs identifies for the data exporter.

#Annex II: Security Measures

Spiral maintains these measures for the systems that it uses to Process Customer Personal Data. Spiral may change the measures if the change does not materially reduce the overall protection of Customer Personal Data. Customer is responsible for its secure use of the Service, which includes the protection of its credentials, the configuration of the Service and of its access controls, and the security of storage and compute resources that Customer controls.

• Security program. Spiral maintains a written information security program with assigned responsibility and reviews it at least once a year. An independent auditor examines Spiral’s security controls and issues a SOC 2 Type 2 report.
• Access by Spiral personnel. Spiral limits access to systems that Process Customer Personal Data to the personnel who need that access for their role, grants the least privilege that the role needs, and reviews access periodically. Spiral removes access when a person no longer needs it.
• Customer authentication and authorization. The Service authenticates each request, supports single sign-on, and checks the grants of the caller before it gives access to a resource. A credential that the Service issues for storage access is limited to one resource and expires after a short period.
• Tenant separation. The Service separates the data of each customer logically. Each resource belongs to one project, and storage access is limited to that resource.
• Encryption. Spiral encrypts Customer Personal Data in transit over public networks. Customer Personal Data in storage that Spiral manages is encrypted at rest. Customer can keep its data in storage that Customer controls, under encryption keys that Customer manages.
• Logging and monitoring. Spiral logs access to its production systems and monitors those systems for security events. The Service provides audit logs to Customer.
• Vulnerability management. Spiral identifies vulnerabilities in its systems and software and remediates them according to their risk.
• Incident response. Spiral maintains an incident response plan that covers detection, containment, remediation, and notification.
• Personnel. Spiral personnel are bound by confidentiality obligations and receive security training.
• Vendors. Spiral assesses the security of each Subprocessor before it engages the Subprocessor, and binds each Subprocessor by contract as Section 2.6 requires.
• Resilience. Spiral maintains measures that are designed to restore the availability of the Service after an incident.
• Data minimization. Customer can keep its table data in storage that Customer controls. In that configuration, the control plane of the Service holds metadata, such as names, versions, commit history, and grants.

Parts of this DPA are adapted from the Data Processing Agreement Standard Terms, Version 1.1, by Common Paper, which is licensed under CC BY 4.0. Spiral changed the text.