Data Processing Addendum

Last updated October 2026

This addendum forms part of the agreement between the customer ("Controller") and Vantage Cortex, Inc. ("Processor") for Socivant.

1. Scope

Processor processes customer personal data only to provide Socivant and on the Controller's documented instructions.

2. Security measures

• Tenant isolation with database row-level security.
• Encryption in transit and at rest; secrets encrypted with a separate key.
• SSO, SCIM, role-based access, two-factor enforcement, IP allowlists, audit logging.

3. Sub-processors

[List with locations to be completed: hosting, database, object storage, Anthropic, Google, Ayrshare, Resend, Stripe, Sentry.] Controller will be notified 30 days before new sub-processors are added.

4. International transfers

Standard Contractual Clauses apply where required. EU data residency is available on the Global plan.

5. Breach notification

Processor will notify Controller without undue delay, and within 72 hours, of becoming aware of a personal data breach.

6. Deletion and return

On termination, data is available for export for 30 days, then deleted, including media and backups on their normal rotation.

7. Audits

[To be drafted by counsel: SOC 2 report availability, questionnaire process.]