Data Processing Addendum | The Graphite Lab

Version 1.0. This addendum covers the personal information inside our tools, like your customers’ names, calls, and invoices: what we do with it, what we never do, and who helps us handle it.

This Data Processing Addendum (“DPA”) explains how The Graphite Lab Inc. handles the personal information inside our tools on behalf of the businesses that use them. It is part of the agreement between The Graphite Lab Inc., 1011 Hancock Street, Suite 102, Philadelphia, PA 19123 (“TGL,” “we,” “us”), and the customer that uses our services (“Customer,” “you”). That agreement is made up of our Terms of Service and any order documentation (together, the “Agreement”).

This DPA applies automatically whenever TGL processes Customer Personal Data to provide the Services. You don’t need to sign it separately. If you’d like a countersigned copy, email contact@thegraphitelab.com.

Definitions

Words in capitals have the meanings below. Words defined in the Agreement keep those meanings. If a Data Protection Law uses a different word for the same idea (for example “business” and “controller,” or “service provider” and “processor”), the matching word in this DPA covers it.

1.1 Account Data means personal information about Customer’s own account users, administrators, and billing contacts, such as names, work emails, and login details. TGL handles Account Data for its own purposes under the TGL Privacy Policy, not under this DPA.

1.2 AI Provider means a Subprocessor that supplies an artificial intelligence model or service used inside the Services, such as a language model, speech to text, text to speech, or a voice agent.

1.3 Customer Personal Data means personal information that TGL processes on Customer’s behalf to provide the Services. It includes personal information that Customer or its users put into the Services, that TGL pulls from an Integration at Customer’s direction, or that the Services collect for Customer (for example, from people who call or text Customer through a Tool). It includes Outputs to the extent they contain personal information. It does not include Account Data or Usage Data.

1.4 Data Protection Laws means all privacy, data protection, and data security laws that apply to a party’s processing of Customer Personal Data under the Agreement. That includes, where they apply: the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its regulations (“CCPA”); the consumer privacy laws of other US states, such as Virginia, Colorado, Connecticut, Texas, and Oregon; US state data breach and data security laws; Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”); Quebec’s Act respecting the protection of personal information in the private sector (the “Quebec Act”); and the private sector privacy laws of Alberta and British Columbia.

1.5 Individual means the person a piece of Customer Personal Data is about. Data Protection Laws may call this person a “consumer” or “data subject.”

1.6 Integration means a third-party system that Customer connects to the Services, such as ServiceTitan, BuildOps, Housecall Pro, Jobber, ServiceNow, or Acumatica. An Integration is Customer’s own vendor, not a TGL Subprocessor. Customer’s agreement with that vendor governs the data held in that system.

1.7 Output means content a Tool produces for Customer, such as a call summary, a transcript, a draft message, a draft review reply, or a cleaned record.

1.8 Process means any operation performed on personal information, such as collecting, recording, storing, using, analyzing, transmitting, disclosing, or deleting it.

1.9 Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data held by TGL or a Subprocessor. It includes a “confidentiality incident” under the Quebec Act. It does not include unsuccessful attempts or routine activity that doesn’t compromise Customer Personal Data, such as pings, port scans, blocked login attempts, or denial of service attacks.

1.10 Sell and Share have the meanings given in the CCPA. Targeted advertising has the meaning given in the other US state privacy laws.

1.11 Services means the TGL products and related support that Customer uses under the Agreement. Each product is a Tool, for example Night Line, Call Catch, Call Capture, Chase Note, and Data Cleanse.

1.12 Subprocessor means a third party that TGL engages to Process Customer Personal Data for the Services.

1.13 Usage Data means technical and operational information about how the Services run, such as counts of calls handled or records processed, Rivet consumption, timestamps, error codes, feature settings, and performance measurements. Usage Data does not include the content of calls, messages, records, or Outputs, and TGL will not use it to identify an Individual.

Roles and scope

2.1 Customer is in charge of the data. For Customer Personal Data, Customer is the “business” or “controller” (and, in Canada, the organization in control of the information). TGL is Customer’s “service provider,” “contractor,” or “processor.” TGL Processes Customer Personal Data only on Customer’s behalf and as this DPA allows.

2.2 If Customer is itself a processor. If Customer handles Customer Personal Data for someone else, such as a franchisor or property manager, Customer confirms that its instructions to TGL are authorized by that party, and TGL acts as Customer’s subprocessor. Customer remains TGL’s only point of contact.

2.3 Account Data and Usage Data are separate. TGL decides how Account Data and Usage Data are used. The TGL Privacy Policy covers them. This DPA does not.

2.4 Integrations. When Customer connects an Integration, TGL reads data from it, and where a Tool is built to do so writes data back to it, only as Customer directs through the Tool’s settings. TGL is not responsible for how the Integration vendor handles data in its own systems.

2.5 Details of processing. Schedule 1 describes the Individuals, the types of data, the purposes, and the duration of processing.

Instructions and business purposes

3.1 Only on Customer’s instructions. TGL will Process Customer Personal Data only to provide, support, and secure the Services for Customer, as described in Schedule 1, and as Customer otherwise instructs in writing. Customer’s instructions are the Agreement, this DPA, the settings Customer chooses in the Services, and any other written instruction both parties agree to.

3.2 Specific business purposes. TGL Processes Customer Personal Data only for these business purposes:

running each Tool Customer turns on, as described in Schedule 1;
storing Customer Personal Data and Outputs so Customer can view, search, export, and use them;
providing support and troubleshooting when Customer asks, or when needed to fix a problem with Customer’s account;
detecting, preventing, and investigating security incidents, fraud, abuse, and illegal activity affecting the Services; and
complying with law, as described in Section 3.4.

3.3 Unlawful instructions. TGL will tell Customer if it believes an instruction violates a Data Protection Law, and may pause the affected processing until Customer changes or confirms the instruction. TGL is not required to give legal advice.

3.4 Legal requirements. If a law, court order, or government request requires TGL to Process or disclose Customer Personal Data, TGL will tell Customer first, unless the law forbids it, so Customer can object. TGL will disclose only what is legally required and will push back on requests that appear overbroad or unlawful.

What TGL will not do

4.1 Restrictions. TGL will not:

Sell or Share Customer Personal Data, or use it for targeted advertising or cross-context behavioral advertising;
retain, use, or disclose Customer Personal Data for any purpose other than the business purposes in Section 3.2, including any other commercial purpose, unless a Data Protection Law expressly permits it;
retain, use, or disclose Customer Personal Data outside the direct business relationship between TGL and Customer;
combine Customer Personal Data with personal information TGL receives from or for anyone else, or collects from its own interactions with Individuals, except as the CCPA regulations allow for the business purposes above (for example, to detect security incidents);
use Customer Personal Data or Outputs to train, fine-tune, or otherwise improve any AI model, whether TGL’s own or a third party’s;
use Customer Personal Data to build profiles of Individuals for anyone other than Customer, or to provide services to TGL’s other customers; or
try to re-identify any data that Customer has de-identified.

4.2 Improving the Services. TGL may use Usage Data to run, measure, secure, and improve the Services. TGL may look at Customer Personal Data to fix a problem Customer reports, or to make a Tool work better for Customer itself, as the CCPA regulations allow. Neither permits anything Section 4.1 forbids.

4.3 No de-identified datasets. TGL will not create or use de-identified or aggregated data sets from Customer Personal Data, other than Usage Data.

4.4 Notice if TGL can’t comply. TGL will tell Customer within 5 business days if it decides it can no longer meet its obligations under this DPA or a Data Protection Law. Customer may then, on notice, take reasonable and appropriate steps to stop and fix any unauthorized use of Customer Personal Data, including suspending the affected Tool.

4.5 Certification. TGL certifies that it understands the restrictions in this Section 4 and will comply with them.

AI processing

5.1 How the Tools use AI. Most Tools send part of Customer Personal Data to an AI Provider to do their job. For example, a Tool may stream a live call through a voice agent, send call audio for transcription, send a transcript to a language model to write a summary, or send invoice details to a language model to draft a reminder. Schedule 2 names the AI Providers.

5.2 Only what’s needed. TGL sends an AI Provider only the Customer Personal Data reasonably needed for the task at hand.

5.3 No training. TGL does not use Customer Personal Data or Outputs to train or fine-tune AI models. TGL uses each AI Provider under terms, account settings, or both, that prohibit the AI Provider from using Customer Personal Data or Outputs to train or improve its models.

5.4 AI Provider retention. Some AI Providers keep inputs and outputs for a limited time under their terms, for example to detect abuse or meet legal requirements, and then delete them. They may not use that data for any other purpose. Where an AI Provider lets TGL choose a retention setting, TGL uses the shortest setting that lets the Tool work.

5.5 Outputs belong to Customer. As between the parties, Outputs are Customer’s data. AI can make mistakes. Customer is responsible for reviewing Outputs before relying on them for decisions that matter, such as billing, collections, or anything said publicly.

5.6 Customer controls review. Some Tools work in real time, such as a voice agent answering a call. For Tools that draft or change content, Customer controls, through the settings the Tool offers, which Tools may send, post, or save Outputs without a person’s review. TGL will not change a Tool so that it acts without review, where it previously waited for review, without telling Customer in advance and giving Customer a way to keep review on.

5.7 Human access by TGL. TGL personnel do not read, listen to, or label Customer Personal Data to improve AI models. Authorized TGL personnel may access Customer Personal Data only when Customer asks for support, to investigate a problem, error, or abuse, to respond to a Security Incident, or as required by law.

5.8 No significant automated decisions. The Tools are not designed to make decisions about Individuals that have legal or similarly significant effects, such as decisions about credit, employment, housing, or insurance. Customer will not configure or use a Tool to make those decisions without first agreeing with TGL in writing on any additional safeguards a Data Protection Law requires.

5.9 No voiceprints or voice cloning of callers. The Services do not use call audio to create voiceprints, to identify or verify a person by their voice, or to clone a caller’s voice.

Customer’s responsibilities

6.1 Lawful collection. Customer is responsible for having the legal right to collect Customer Personal Data and to have TGL Process it, including giving any notice and getting any consent the law requires. That includes data Customer pulls from an Integration.

6.2 Privacy notices. Customer’s privacy notice to its own customers and staff must allow for processing by vendors like TGL, including AI processing and processing in the United States, where the law requires that disclosure.

6.3 Data Customer should not send. Customer will not use the Services to Process, and will configure the Tools so they don’t collect, any of the following, unless TGL agrees in writing:

full payment card numbers or bank account numbers;
Social Security, Social Insurance, driver’s license, or other government ID numbers;
health information covered by HIPAA or similar health privacy laws;
biometric identifiers; or
information Customer knows is about children under 13.

TGL is not a HIPAA business associate and does not sign business associate agreements.

6.4 Settings. Customer is responsible for the settings, scripts, greetings, and prompts it chooses for each Tool, and for what its users do in the Services.

Calls, recordings, texts, and AI voice

7.1 Customer obtains consent. Customer decides whether to use Tools that answer, record, transcribe, or analyze calls, or that send texts or emails. As the business whose phone line it is and whose customers are calling, Customer is responsible for giving every notice and getting every consent the law requires. In particular:

Recording and transcription. Several US states, including California and Pennsylvania, require consent from everyone on a call before it is recorded, and Canadian law requires notice. Customer will make sure callers are told, at the start of any call a Tool records, transcribes, or analyzes, that the call may be recorded and handled by an automated system.
AI disclosure. Customer will make sure callers are told they are speaking with an automated or AI assistant, not a person, at the start of any call a voice agent answers or places.
Outbound calls and texts. If Customer configures a Tool to place calls or send texts, Customer is the caller or sender. Customer is responsible for the consent the Telephone Consumer Protection Act and state and Canadian laws require (including prior express consent for calls that use an artificial or AI-generated voice, and prior express written consent for telemarketing), for honoring opt-outs and calling-hour limits, and for complying with carrier messaging rules.

7.2 Default disclosure. Voice Tools come with a default greeting that tells callers they’ve reached an automated assistant and that the call may be recorded and transcribed. Customer can change the wording. If Customer removes or weakens the disclosure, Customer is responsible for that choice. TGL will pass along to Customer any opt-out request it receives.

7.3 Recordings serve Customer only. TGL and its Subprocessors use call audio and transcripts only to perform the Tool for Customer, under Sections 4 and 5. No one uses them to train models or for their own purposes.

7.4 Customer indemnity. Customer’s indemnity in the Agreement covers third-party claims arising from Customer’s failure to give a notice or get a consent that this Section 7 makes Customer’s responsibility.

Confidentiality

8.1 Personnel. TGL makes sure every employee and contractor who can access Customer Personal Data is bound by a written duty of confidentiality that continues after their work for TGL ends, accesses it only as needed for the business purposes in Section 3.2, and is informed of their obligations under this DPA.

8.2 How long. Customer Personal Data stays confidential for as long as TGL or its Subprocessors hold it.

Security

9.1 TGL’s measures. TGL maintains reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data, suited to the nature of the data and the size of TGL’s business. Schedule 3 describes them. TGL may update its measures over time but will not materially reduce the overall level of protection.

9.2 Customer’s side. Customer is responsible for security on its side, including managing its users and their access, protecting its own credentials and Integration credentials, and choosing settings suited to its data.

Subprocessors

10.1 Authorization. Customer authorizes TGL to use the Subprocessors listed in Schedule 2, and to engage new Subprocessors under this Section 10.

10.2 Same protections. Before a Subprocessor can access Customer Personal Data, TGL will have a written contract with it that limits its use of the data to providing its service to TGL, requires it to protect the data at least as well as this DPA requires of TGL, prohibits it from Selling or Sharing the data or using it to train models, and requires it to delete or return the data when its service ends. TGL stays responsible to Customer for its Subprocessors’ compliance with this DPA.

10.3 Notice of new Subprocessors. TGL keeps the current list in Schedule 2. At least 15 days before a new Subprocessor starts processing Customer Personal Data, TGL will update the list and email Customer’s account owner.

10.4 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing contact@thegraphitelab.com within that 15-day period. The parties will work in good faith to resolve it, for example by not using that Subprocessor for Customer’s data. If they can’t resolve it within 30 days, Customer may terminate the affected Tool, or the Agreement if the Subprocessor affects all Tools, by written notice. TGL will then refund any prepaid fees for the unused part of the term for what Customer terminated, notwithstanding anything in the Terms of Service about refunds.

10.5 Emergency replacement. If TGL must replace a Subprocessor urgently to keep the Services secure or running, for example because the Subprocessor suffered a breach or shut down, TGL may do so right away and will give notice as soon as practical. Customer’s objection right in Section 10.4 still applies.

Help with requests and assessments

11.1 Requests sent to TGL. If TGL receives a request from an Individual about Customer Personal Data, for example to access, correct, or delete it, TGL will forward it to Customer within 5 business days. TGL will not respond itself, except to tell the Individual to contact Customer, unless Customer instructs otherwise or the law requires.

11.2 Helping Customer respond. Taking into account the nature of the processing, TGL will help Customer respond to Individuals’ requests under Data Protection Laws, through features of the Services where available and otherwise on Customer’s written request. TGL will carry out a deletion or correction instruction from Customer without undue delay, and within 30 days.

11.3 Assessments. TGL will give Customer information reasonably needed to complete any data protection assessment, risk assessment, cybersecurity audit, or (for Quebec) privacy impact assessment that a Data Protection Law requires of Customer about its use of the Services.

11.4 Cost. This help is included in the fees, unless a request is unusually large or repetitive, in which case TGL may charge a reasonable fee after telling Customer in advance.

Security Incidents

12.1 Notice. TGL will notify Customer without undue delay, and in any event within 72 hours, after TGL becomes aware of a Security Incident. TGL will send the notice to Customer’s account owner and any security contact Customer has given TGL.

12.2 What the notice says. To the extent known, the notice will describe what happened and when; the types of Customer Personal Data and the approximate number of Individuals and records involved; the likely consequences; what TGL has done and will do to contain and fix it; and a contact at TGL. If not everything is known yet, TGL will send what it has and follow up as it learns more.

12.3 Response. TGL will promptly take reasonable steps to contain, investigate, and fix the Security Incident, keep Customer informed, and give Customer the information and help it reasonably needs to meet its own notification and record-keeping duties, including the breach records PIPEDA requires and the incident register the Quebec Act requires.

12.4 Who notifies Individuals. Customer decides whether to notify Individuals, regulators, or others, and does the notifying, unless the law requires TGL to do it directly. TGL will not notify Individuals or regulators about a Security Incident involving Customer Personal Data without first consulting Customer, unless the law requires it.

12.5 Notification costs. If a Security Incident results from TGL’s or a Subprocessor’s breach of this DPA, TGL will reimburse Customer’s reasonable, documented costs of notices to Individuals and regulators that the law requires, subject to Section 16.

12.6 Not an admission. Giving notice is not an admission of fault or liability.

Retention, return, and deletion

13.1 During the term. TGL keeps Customer Personal Data as Customer configures in the Services, or otherwise for as long as needed to provide the Services. Customer can ask TGL to delete Customer Personal Data at any time by emailing contact@thegraphitelab.com, and TGL will do so under Section 11.2.

13.2 When the Agreement ends. When the Agreement ends:

Customer may export its Customer Personal Data and Outputs for 30 days. TGL will help on request, in a common machine-readable format.
After that 30-day window, TGL will delete Customer Personal Data from its systems within 30 days, and instruct its Subprocessors to delete it too.
Copies in backups will expire within 35 days after that. Until then, they stay protected under this DPA and are not used for anything else.
TGL may keep Customer Personal Data longer only where the law requires it, only for that purpose, and while continuing to protect it under this DPA.

13.3 Integrations are not affected. Deleting Customer Personal Data from the Services does not delete anything from Customer’s Integrations. Data written back to an Integration at Customer’s direction stays there under Customer’s control.

13.4 Confirmation. On request, TGL will confirm in writing that deletion is complete.

Audits and compliance information

14.1 Questionnaire first. Once every 12 months, on written request, TGL will answer a reasonable security and privacy questionnaire and give Customer the information needed to show it complies with this DPA.

14.2 Further audit. If the questionnaire and information don’t reasonably show compliance, or after a Security Incident, or if a regulator requires it, Customer may audit TGL’s compliance with this DPA, itself or through an independent auditor that is not a TGL competitor and signs a confidentiality agreement. Customer must give at least 30 days’ notice and a proposed scope. Audits will be remote where practical, during business hours, limited to Customer’s data and the systems that handle it, no more than once every 12 months (except after a Security Incident or at a regulator’s request), and at Customer’s cost. TGL won’t give access to other customers’ data or to information that would compromise its security.

14.3 Independent assessment. Instead of a Customer audit under Section 14.2, TGL may arrange, at its own cost, for a qualified, independent assessor to assess its policies and technical and organizational measures using an accepted control framework, and give Customer the report.

14.4 Fixing problems. If an audit or assessment finds that TGL doesn’t comply with this DPA, TGL will fix the gap promptly and tell Customer how.

14.5 Reasonable steps. These rights are the reasonable and appropriate steps Customer may take under the CCPA to make sure TGL uses Customer Personal Data in a way consistent with Customer’s obligations.

Where data is processed

15.1 Location. TGL and its Subprocessors store and process Customer Personal Data in the United States. TGL will give notice under Section 10.3 before processing Customer Personal Data in any other country.

15.2 Canada. For Customer Personal Data about Individuals in Canada, TGL will protect the data at a level comparable to what Customer must provide under PIPEDA and provincial law. Customer stays accountable for that data, and is responsible for telling Individuals that their information may be processed and stored in the United States, where courts, law enforcement, and national security authorities may be able to access it under US law.

15.3 Alberta. If Customer is subject to Alberta’s Personal Information Protection Act, TGL will give Customer the information it needs about TGL’s processing outside Canada, including the countries and purposes, so Customer can include it in its policies and notices.

15.4 Quebec. For Customer Personal Data about Individuals in Quebec, the following also apply:

This DPA is the written contract required by section 18.3 of the Quebec Act. TGL will use that data only to perform the Services for Customer, will protect its confidentiality using the measures in Section 8 and Schedule 3, and will not keep it after the Agreement ends except as Section 13 allows.
TGL will promptly notify Customer’s person in charge of the protection of personal information of any violation, or credible attempted violation, by any person of TGL’s confidentiality obligations about that data. Customer will tell TGL who that person is.
Customer may carry out any verification relating to those confidentiality obligations, in the manner set out in Section 14.
Because the data is stored outside Quebec, section 17 of the Quebec Act requires Customer to assess the transfer before sending the data. The parties agree this DPA forms part of the written agreement that section requires, and TGL will give Customer the information it reasonably needs for that assessment under Section 11.3.

15.5 EU and UK data. The Services are offered to businesses in the United States and Canada. This DPA does not cover personal data subject to the EU or UK General Data Protection Regulation, and Customer will not send that data to the Services.

Liability

16.1 The Terms’ limits apply. Each party’s liability arising out of or related to this DPA, including for Security Incidents, is subject to the exclusions and limitations of liability in the Agreement, and counts toward the same cap.

16.2 What can’t be limited. Nothing in this DPA limits either party’s liability to an Individual or regulator where a Data Protection Law doesn’t allow it to be limited.

Term, changes, and order of precedence

17.1 Term. This DPA lasts as long as TGL Processes Customer Personal Data, including after the Agreement ends until deletion under Section 13 is complete. Sections that by their nature should survive will survive.

17.2 Changes. TGL may update this DPA to reflect changes in Data Protection Laws, the Services, or Subprocessors (Subprocessor changes follow Section 10). TGL will post the new version here and email Customer’s account owner at least 30 days before a change takes effect. A change that materially reduces the protection of Customer Personal Data will not apply to Customer during its current subscription term without Customer’s written agreement, unless a Data Protection Law requires it.

17.3 Order of precedence. If documents conflict about Customer Personal Data, this order applies: first, any terms a Data Protection Law requires to be in this DPA, including Section 15.4; then this DPA; then the order documentation; then the Terms of Service. The TGL Privacy Policy does not govern Customer Personal Data.

17.4 Governing law. The governing law and courts clause of the Terms of Service applies to this DPA, except where a Data Protection Law requires otherwise.

17.5 Notices. Notices to TGL under this DPA go to contact@thegraphitelab.com, or by mail to The Graphite Lab Inc., 1011 Hancock Street, Suite 102, Philadelphia, PA 19123. Notices to Customer go to the account owner’s email on file and any security or privacy contact Customer gives TGL.

Schedules

Schedule 1: Details of processing

Individuals. Customer’s customers and prospects, such as homeowners, tenants, property managers, and commercial contacts; people who call, text, or email Customer through a Tool; people who review Customer; and Customer’s employees and contractors, such as technicians, dispatchers, and office staff, whose names or work details appear in jobs, calls, or messages.

Types of personal information. Names; service and billing addresses; phone numbers; email addresses; call audio, transcripts, and summaries; text and email content; job, appointment, and service history; equipment and site details; estimates, invoices, amounts due, and payment status; reviews and reviewer names; technician names, assignments, and work notes; and Integration record IDs. No sensitive categories are intended (see Section 6.3).

Nature and purpose of processing, by type of Tool. Which of these apply depends on the Tools Customer turns on:

Call tools (for example, Night Line and Call Catch) answer calls with an AI voice agent, capture caller details and the reason for the call, and may record, transcribe, and summarize the call. They use telephony and voice AI Subprocessors and may use language models.
Call write-up tools (for example, Call Capture) turn call recordings or transcripts into notes or records. They use speech to text and language models.
Drafting tools (for example, Chase Note) draft messages, such as follow-ups on past-due invoices or replies to reviews, from Customer’s records. They use language models.
Data tools (for example, Data Cleanse) review, clean, and standardize Customer’s job and customer records. They may use language models.
All Tools read from and, where built to do so, write back to Customer’s Integrations as Customer configures, and store data and Outputs so Customer can use them.

Duration. For the term of the Agreement, plus the return and deletion periods in Section 13.

Frequency. Continuous while a Tool is turned on.

Schedule 2: Subprocessors

TGL uses these Subprocessors to Process Customer Personal Data. All are located in the United States. None may use Customer Personal Data to train AI models. New Subprocessors are added under Section 10.

OpenAI. Language models that analyze, summarize, and draft text. United States.
Anthropic. Language models that analyze, summarize, and draft text. United States.
ElevenLabs. AI voice agent, speech to text, text to speech, and call handling. United States.
Twilio. Phone numbers, call routing, and text messaging. United States.
Supabase. Database and file storage. United States.
Vercel. Application hosting. United States.

Integrations such as ServiceTitan, BuildOps, Housecall Pro, Jobber, ServiceNow, and Acumatica are Customer’s own vendors, not TGL Subprocessors. Stripe processes billing information as part of Account Data, not Customer Personal Data.

Schedule 3: Security measures

TGL maintains at least the following measures:

Encryption. Customer Personal Data is encrypted in transit over the internet and encrypted at rest by TGL’s hosting and database providers.
Access limited to need. Only TGL personnel who need access to Customer Personal Data to do their jobs have it, each with their own account. Access is removed when it is no longer needed.
Multi-factor authentication. Administrative accounts for TGL’s core systems, including hosting, database, AI, and telephony providers, require multi-factor authentication.
Logging and monitoring. TGL keeps logs of key system activity and watches for errors and unusual activity.
Vendor review. TGL reviews the security and data terms of each Subprocessor before using it, and turns off model training and uses the shortest practical retention settings where a provider offers them.
Backups. Customer Personal Data is backed up by TGL’s database provider, and backups follow the timelines in Section 13.
Incident response. TGL has a process for responding to Security Incidents, including the notice in Section 12.