Data processing agreement

Draft for counsel. Not executed. European customers will ask for a signed version of this before sending real visitor data.

Roles. The customer is the controller of its visitors' data. Tellshield is the processor, handling that data only to score interaction authenticity and to show the customer the result.

Instructions. Processing is limited to the documented signals, the retention windows, and the customer's configuration (origins, rules, actions). Tellshield does not sell visitor data and does not use one customer's content to train a model. There is no model in the MVP.

Security. Secret keys and session tokens are stored as hashes. Verification tokens are signed, short-lived, and single-use. Access to the dashboard is password-based, rate limited, and scoped to one organization.

Subprocessors. Today: the database host, the Redis host, and, if a token is configured, IPinfo for network classification. A published list belongs here before launch. Customers should be told before a subprocessor is added.

Deletion. Sessions after 7 days, verifications after 90 days, raw events after the session ends. On a customer's written request, their organization, sites, and verifications are deleted.

Incidents. A breach of customer or visitor data should be reported to the customer without undue delay, with what happened, what was affected, and what was done.