Data Processing Addendum
Critical Bridge by Sovergence · Last updated: November 7, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between Sovergence, LLC, doing business as Sovergence Consulting ("Processor") and the organization that holds the Account ("Customer"). It applies when Sovergence processes personal data contained in Customer Data on Customer's behalf. If this DPA conflicts with the Terms on personal data, this DPA controls.
1. Roles and scope
Customer is the controller (or a processor acting for its own customer), and Sovergence is the processor (or subprocessor). Sovergence processes Customer personal data only to provide, secure and support the Services, and only on Customer's documented instructions. The Terms, Customer's configuration of the Services and Customer's use of platform features are those instructions. Sovergence will tell Customer if it believes an instruction breaks the law.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and processing Customer Data in the Services |
| Duration | The term of the Terms, plus the export and deletion period after it |
| Nature and purpose | Storage, organization, retrieval, AI-assisted extraction and drafting, reporting, transmission and deletion, to deliver the Services |
| Data subjects | Customer's users, employees, contractors, customers, prospects and contacts named in documents |
| Personal data | Names, business contact details, job titles, organization details, signatures, and any personal data contained in uploaded documents |
| Special categories | None intended. Customer must not submit them unless agreed in writing (see the Acceptable Use Policy) |
3. Confidentiality
Sovergence makes sure everyone it authorizes to process Customer personal data is bound by confidentiality. Sovergence staff access Customer Data only when Customer grants support access, or as needed for security and legal compliance, and every such access is logged.
4. Security
Sovergence maintains appropriate technical and organizational measures, including encryption in transit, tenant isolation enforced in the database, role-based and least-privilege access, multi-step approvals for releases, permanent audit logs, backups and staff security practices. Sovergence may update these measures if overall protection does not decrease.
5. Subprocessors
Customer authorizes Sovergence to use the subprocessors on its published Subprocessors list. Sovergence will bind each subprocessor to data protection terms at least as protective as this DPA and remains responsible for their performance. Sovergence will post changes to the list and notify Customer at least 15 days before a new subprocessor begins processing Customer personal data. Customer may object on reasonable data protection grounds; if the parties cannot resolve it, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.
6. Assistance and data subject requests
Sovergence will tell Customer promptly about any request it receives directly from a data subject about Customer personal data, and will not respond except to direct the requester to Customer. Sovergence will provide reasonable help, mostly through platform features, so Customer can meet its obligations on data subject requests, security, breach notification and data protection impact assessments.
7. Security incidents
Sovergence will notify Customer without undue delay, and in any case within 72 hours, after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer personal data. The notice will describe what is known, the likely consequences and the steps taken, and Sovergence will update it as more is learned.
8. Deletion and return
During the subscription, Customer can export Customer Data through the Services. After the Terms end, Customer has 30 days to export it. Sovergence then deletes Customer personal data within 90 days, except copies the law requires it to keep, which remain protected under this DPA. Backups are overwritten on their normal cycle.
9. Audits
On written request no more than once a year, Sovergence will answer reasonable security questionnaires and provide information needed to show compliance with this DPA. Where the law requires an on-site audit, it will be at Customer's cost, on 30 days' notice, during business hours, and under confidentiality.
10. International transfers
Sovergence processes Customer personal data in the United States and Canada. Where the law requires a transfer mechanism, such as for data from the European Economic Area, United Kingdom or Switzerland, the parties agree to the applicable Standard Contractual Clauses, or the UK Addendum, which are incorporated by reference.
11. U.S. state privacy laws
Where U.S. state privacy laws apply, Sovergence acts as a service provider or processor. It will not sell or share Customer personal data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, or combine it with personal data from other sources except as those laws allow.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service.