Data Processing Agreement (DPA) at AskVault
What the DPA covers
A Data Processing Agreement is the contract between you (the Data Controller) and AskVault (the Data Processor) governing how we handle personal data on your behalf. Required for GDPR compliance and increasingly for similar laws (UK DPA, California CCPA, India DPDP Act).
AskVault's DPA covers:
- Controller-processor relationship. Roles, responsibilities, and limitations.
- Categories of personal data processed. What types of data AskVault holds.
- Purposes of processing. Why we hold it.
- Sub-processors. The third parties AskVault uses, with notification process for changes.
- Security measures. Encryption, access controls, audit logs.
- Breach notification. Notification to affected customers without undue delay.
- International transfers. Standard Contractual Clauses (SCCs) for EU-to-non-EU transfers.
- Audit rights. Customer's right to audit AskVault's compliance.
- Termination and deletion. What happens to your data after contract end.
The DPA is a standard form; Enterprise customers can negotiate specific provisions.
When you need a DPA
Three triggers:
- You process EU resident data. GDPR Article 28 requires a DPA between Controller and Processor.
- You're a B2B SaaS with enterprise customers. Your customers' procurement teams require a DPA in your vendor agreement.
- You operate in a jurisdiction with similar laws. UK, California, Brazil, India, Singapore all have processor-controller requirements.
For workspaces processing only your own internal data with no third-party data subjects, a DPA is less critical but still recommended.
Availability
A DPA is available on request — email [email protected].
How to request the DPA
- Email [email protected]. Include your workspace name and plan; AskVault sends the standard-form DPA as a PDF.
- Sign and return it. Sign the PDF and send it back by email. For Enterprise, your Account Manager can route it through the master agreement instead.
- Counter-sign by AskVault. AskVault counter-signs and you receive the executed PDF.
For Enterprise contracts, the DPA is bundled with the master agreement. Your AskVault Account Manager handles the signing flow.
What's in the standard DPA
Six sections:
Section 1: Definitions and roles
Defines Controller (you) and Processor (AskVault). Defines personal data, processing, sub-processor, data subject. Standard GDPR-aligned definitions.
Section 2: Scope of processing
Specifies that AskVault processes data only on your documented instructions. Lists the types of personal data we hold (customer emails, names, phone numbers, chat content) and the purposes (delivering the AskVault service).
Section 3: Sub-processors
Lists the categories of sub-processors AskVault uses. Specifies the 30-day advance notice requirement for changes. Specifies your right to object to sub-processor changes.
Section 4: Security measures
Specifies the technical and organizational measures AskVault uses: encryption, access controls, audit logging, vulnerability management. References the security measures on our security overview.
Section 5: Breach notification
Notification to your designated security contact without undue delay after AskVault confirms a personal-data breach. Specifies what information the notification contains.
Section 6: International transfers
For EU-to-non-EU transfers (the AskVault primary region is in the United States), the DPA incorporates Standard Contractual Clauses (Module Two: Controller to Processor) by reference.
What you provide as Controller
Three things you, as Controller, are responsible for:
- Lawful basis. You determine the legal basis for processing personal data through AskVault (consent, legitimate interest, contractual necessity, etc.).
- Data subject rights. You handle requests from your customers to access, correct, or delete their data. AskVault provides the infrastructure to fulfill those requests.
- Documented instructions. Your use of AskVault is the documented instruction. If you want AskVault to process data in a specific non-standard way, an addendum is needed.
For most customers, the standard DPA captures the standard usage. No addendums needed.
Sub-processor change notification
Per the DPA, AskVault notifies customers 30 days in advance when:
- A sub-processor is added.
- A sub-processor is removed.
- A sub-processor's scope materially changes.
Notification methods:
- Email to the workspace owner's account email. That is the only notice channel.
Customers can object to a change. If we cannot resolve the objection within 30 days, you can terminate the affected workspace with data export.
Audit rights
Customers have the right to audit AskVault's compliance with the DPA. Three options:
- Documentation review. Review the security overview and SOC 2 page. AskVault does not hold its own SOC 2 report; our database provider holds a SOC 2 Type II report.
- Questionnaire-based. Send a vendor security questionnaire to [email protected] and AskVault will respond.
- On-site audit. Available on Enterprise contracts with 60-day notice. Scope and cost negotiated.
Most reviews start with the questionnaire. See the SOC 2 page for what is and is not covered.
Termination and deletion
When your paid subscription ends, the account moves to the Free plan. Your workspaces are not deleted, but Free limits apply. To remove your data, delete the workspace or your account from Settings; export anything you need first. A Free workspace with no conversations for 30 days can be removed, after a pause notice at 21 days.
Deleted data can stay in our database provider's encrypted backups until those backups expire. Email [email protected] for the current backup window.
Customer-specific DPA versions
Some customers require specific provisions:
- California CCPA addendum. For US-California-resident data subjects.
- UK DPA addendum. Post-Brexit UK-specific provisions.
- HIPAA Business Associate Agreement. Not offered. AskVault does not currently sign BAAs on any plan; do not send protected health information (PHI) through AskVault.
- Country-specific addendums. Brazil LGPD, India DPDP Act, Singapore PDPA, etc.
Most addendums are available on Enterprise contracts. Reach out to [email protected].
Common pitfalls
Customer doesn't request a DPA. Then they're processing personal data through AskVault without a contractually-binding agreement. Risk for both parties. Always sign a DPA when handling third-party personal data.
Customer signs DPA but doesn't review. Then later questions arise about provisions they never read. Read it before signing. Reach out to [email protected] with questions.
DPA conflicts with master agreement. Standard DPA has narrow scope. If your master AskVault contract has conflicting clauses, we sort it out during contract review.
Sub-processor change objection. Customer objects to a new sub-processor. We work through the objection; in rare cases the customer terminates. Plan for sub-processor stability in your usage.
FAQ
Can I get a DPA?
A DPA is available on request — email [email protected].
Can I download the DPA before signing up?
Yes. This page summarises every section of the standard DPA, and the full PDF is sent on request to [email protected]: no account required. Helps procurement teams evaluate AskVault before account creation.
Does AskVault sign customer-provided DPA templates?
Sometimes. Standard customer DPAs that align with our security posture get signed quickly. Heavily customized DPAs require legal review. Reach out to [email protected] with your template.
What's the difference between the DPA and the Terms of Service?
Terms of Service govern the commercial relationship. DPA governs data processing specifically. Both apply.
Can I extend the data retention period?
Yes on Enterprise contracts. Standard conversation retention depends on the plan: 7 days on Free, 30 on Starter, 90 on Growth and 365 on Business and Enterprise. Longer terms are negotiated case by case. AskVault does not accept HIPAA-covered data (PHI) on any plan.