Data Processing Addendum

DRAFT — pending legal review. This page is not legal advice and must be reviewed by qualified counsel before launch.

For agency workspace data, the customer is expected to act as controller and ErgoBase as processor, subject to final legal review.

ErgoBase processes customer personal data only to provide, secure, support, and improve the service as documented.

Measures include tenant-scoped access controls, Postgres row-level security, audit events, authentication through Clerk, production R2 evidence storage, and operational monitoring.

Planned sub-processors: Clerk, Neon, Cloudflare R2, Resend, Stripe, Sentry, Vercel, and Render.

Customer notice and objection mechanics must be finalized before launch.