This Data Processing Agreement ("DPA") forms part of the agreement between Docuplete, Inc. ("Processor") and the subscribing organisation ("Controller") for use of the Docuplete platform. By executing a Docuplete subscription or order form, Controller agrees to be bound by this DPA. A signed copy may be requested by emailing legal@docuplete.com.
"Controller" means the organisation subscribing to Docuplete that determines the purposes and means of processing Personal Data through the platform (e.g., the registered investment adviser, law firm, insurance agency, or other professional services firm).
"Processor" means Docuplete, Inc., which processes Personal Data on behalf of the Controller pursuant to this DPA.
"Personal Data" means any information relating to an identified or identifiable natural person that is submitted by or on behalf of the Controller's clients through the Docuplete platform, including but not limited to: names, Social Security numbers, dates of birth, financial account numbers, email addresses, IP addresses, and document field values.
"Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, and deletion.
"Sub-processor" means any third party engaged by the Processor to assist in processing Personal Data.
"Data Subject" means the natural person to whom the Personal Data relates — typically the Controller's client who completes a Docuplete interview session.
This DPA governs the processing of Personal Data by Docuplete on behalf of the Controller in connection with the provision of the Docuplete document automation platform. Processing commences on the effective date of the Controller's subscription and continues until the subscription is terminated and all Personal Data has been deleted or returned in accordance with Section 10.
| Item | Description |
|---|---|
| Nature | Collection, storage, use, transmission, and deletion of Personal Data to enable document automation, interview facilitation, PDF generation, e-signature collection, and delivery to integrations configured by the Controller |
| Purpose | To provide the Docuplete document automation service as configured and directed by the Controller, including generating completed PDF documents, collecting electronic signatures, and routing completed documents to the Controller's configured integrations (Google Drive, HubSpot, Dropbox, OneDrive, webhooks, email) |
| Duration | For the term of the Controller's subscription plus any retention period specified herein or agreed separately |
Personal Data processed under this DPA may include:
Data Subjects are the natural persons whose Personal Data is submitted through Controller-initiated Docuplete document sessions — typically the Controller's clients, prospective clients, or counterparties who complete a guided interview or signing session.
The Controller represents and warrants that:
Docuplete agrees to:
| Measure | Implementation |
|---|---|
| Encryption at rest | AES-256-GCM authenticated encryption for client interview answer data |
| Encryption in transit | TLS 1.2 or higher for all data transmission |
| Access control | Multi-tenant isolation enforced at database level; all queries scoped to organisation ID; role-based access within organisations |
| Authentication | Clerk-managed authentication with MFA support for organisation users; OTP verification for document signatories |
| Audit logging | Immutable audit trail for all document session events; access logs retained for 90 days |
| Vulnerability management | Dependency auditing; security patch deployment within 30 days of critical CVE publication |
| Incident response | Written incident response plan; breach notification procedure as described in Section 7(e) |
| Sub-processor security | Contractual security requirements imposed on all Sub-processors (see Section 9) |
The Controller authorises Docuplete to engage the following Sub-processors for the purposes described:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway (Railway Corp.) | API server hosting and execution environment | United States |
| Vercel, Inc. | Frontend hosting and static asset delivery | United States |
| Cloudflare, Inc. (R2) | Document and asset object storage | United States |
| Resend, Inc. | Transactional email delivery (OTP codes, submission notifications) | United States |
| Stripe, Inc. | Payment processing (billing data only — not document or client personal data) | United States |
| Neon / PostgreSQL host | Database hosting for session, submission, and audit trail data | United States |
Docuplete will notify the Controller of any intended addition or replacement of Sub-processors no less than 30 days in advance. The Controller may object to a new Sub-processor in writing within 14 days. If no resolution is reached, either party may terminate the subscription without penalty.
Upon termination of the Controller's subscription:
Personal Data processed under this DPA is stored and processed in the United States. If the Controller is subject to data transfer restrictions under non-U.S. law (including GDPR for EU/EEA data subjects), the parties agree to execute the applicable Standard Contractual Clauses (SCCs) or other approved transfer mechanism upon request.
The Controller may, no more than once per calendar year and on at least 30 days written notice, request an audit of Docuplete's data processing practices relevant to this DPA. Docuplete may satisfy this obligation by providing its then-current SOC 2 report (when available) or by responding to a written security questionnaire. Physical audits of Docuplete facilities or systems require mutual agreement and are subject to confidentiality restrictions.
Each party's liability under this DPA is subject to the limitations and exclusions set out in the applicable Docuplete Terms of Service. Nothing in this DPA is intended to confer greater liability on either party than that agreed in the Terms of Service.
This DPA is governed by the laws of the State of Delaware, United States, without regard to conflict of law principles. For Controllers subject to GDPR, the parties agree that EU data protection law governs the parties' obligations with respect to EU/EEA personal data.
In the event of a conflict between this DPA and the Docuplete Terms of Service, this DPA governs with respect to the processing of Personal Data. In the event of a conflict between this DPA and any applicable Standard Contractual Clauses, the SCCs govern.
This DPA is effective upon the Controller's acceptance of the Docuplete Terms of Service. A countersigned copy of this DPA may be requested by emailing legal@docuplete.com. Docuplete will return a signed copy within 5 business days.
Docuplete, Inc. (Processor)
[Controller Organisation Name]
Docuplete, Inc. · Questions: legal@docuplete.com · This is a template document. Consult legal counsel before execution.