Data Processing Addendum (Summary)

The customer is the controller of the personal data in its Customer Content. Fulcrum is the processor and processes that data only to provide the Service.

We process personal data only on the customer's documented instructions, which include the Terms of Service, the customer's configuration of the Service, and the DPA itself.

Personnel with access to personal data are bound by confidentiality obligations and receive access on a least-privilege basis.

Encryption in transit and at rest, role-based access control, per-tenant data isolation, logging and monitoring, and regular review of controls. The Security Overview describes these measures.

We use vetted subprocessors for hosting, telephony, payments, AI models, email, and monitoring. Each is bound by data protection terms consistent with the DPA. A current list is available on request, and customers are notified of material changes with a right to object.

We provide the tools and assistance customers reasonably need to respond to access, correction, deletion, and portability requests from their own customers.

We notify affected customers without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting their data, with the information needed for their own notifications.

On termination, customers can export their data. We then delete personal data within the period stated in the DPA, except where law requires retention.

The DPA grants customers audit rights, exercised through documentation and, where justified, independent review. International transfers rely on Standard Contractual Clauses and equivalent safeguards.

Enterprise customers receive an executed DPA at onboarding. Customers on any plan can request one at [email protected].