Data processing agreement
Last updated October 30, 2026
Draft: the company details in brackets are filled in before Scaled Support is sold. Everything else on this page describes how the service works today.
Our DPA uses the Common Paper DPA Standard Terms, a widely used free standard, with the cover page below. To sign, download the PDF, add your company’s details and signature, and email it to [contact email]. We countersign and send it back.
Agreement
| Term | Value |
|---|---|
| Agreement | The Scaled Support Terms of Service (https://scaledsupport.com/terms) between Provider and Customer. |
| Standard Terms | This Cover Page incorporates the Common Paper DPA Standard Terms Version 1.1 (https://commonpaper.com/standards/data-processing-agreement/1.1). If they conflict, this Cover Page wins. |
| Approved Subprocessors | Supabase; Vercel; OpenRouter; Amazon Web Services (Bedrock) and Google Cloud (Vertex AI); Microsoft Azure (OpenAI models). The current list, with locations, is at https://scaledsupport.com/security#subprocessors. |
| Provider Security Contact | [contact email] |
| Security Policy | The technical and organizational measures in Annex II and at https://scaledsupport.com/security. |
| Service Provider Relationship | To the extent the CCPA applies, Provider is Customer's service provider. |
| Governing Law and Chosen Courts | The law and courts of [Country of registration]. |
| Restricted Transfers | EEA and UK transfers use the Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 processor-to-processor) and the UK Addendum. Governing Member State: Ireland. |
| Changes to the Standard Terms | DPA Liability Cap: the liability cap in the Agreement applies to this DPA. |
Annex I(A): List of parties
| Term | Value |
|---|---|
| Data exporter | Customer, as named on the signature block. Role: controller (or processor for its own clients). |
| Data importer | [Company legal name], [Registered address], [Country of registration]. Contact: [contact email]. Role: processor. |
Annex I(B): Description of processing
| Term | Value |
|---|---|
| Service | Support ticketing and AI-drafted replies for messages in the Slack channels, mailbox and website chat Customer connects. |
| Categories of data subjects | Customer's own customers and their staff who write in; Customer's employees who use the service; website visitors who use the chat. |
| Categories of personal data | Names, email addresses, Slack user IDs, message and email content, file names (never file contents), and any personal data people choose to put in their messages. |
| Special category data | None intended. Customer should not connect channels used to share special category data. |
| Frequency of transfer | Continuous, while Customer uses the service. |
| Nature and purpose of processing | Receiving, storing and organizing messages as tickets; looking up Customer's help docs; generating draft replies with AI models under zero data retention; sending replies Customer approves or allows. |
| Duration of processing | For the term of the Agreement. Tickets and messages are deleted 365 days after their last activity (Customer can shorten this), and all Customer data within 30 days after the Agreement ends. |
Annex II: Technical and organizational measures
| Term | Value |
|---|---|
| Hosting | Data stored in the EU (Supabase, Ireland, eu-west-1); application in Dublin (Vercel). |
| Encryption | TLS in transit; encryption at rest; Slack and Gmail tokens additionally encrypted with AES-256-GCM. |
| Access control | Row-level security separates every workspace's data; only Customer's members can see its tickets; admin-only audit log of every bot action. |
| Data minimization | Only connected channels and mailbox are stored; attachments never stored; messages from other channels discarded on arrival; retention-based deletion. |
| AI providers | Requests routed only to endpoints with zero data retention and no training on Customer data. |
| Request integrity | Slack requests verified by signature; webhooks acknowledged and queued, never processed in the request. |
Common Paper Data Processing Agreement (Version 1.1) free to use under CC BY 4.0.