This document is pending review by legal counsel and may change. If you need a signed version or have questions, email support@compliancegrid.ai.
This addendum applies to personal data that a customer (the "Controller") submits to ComplianceGrid (the "Processor") through the Service, and forms part of the Terms of Service or your signed agreement. A signed copy is available on request at support@compliancegrid.ai.
1. Subject matter and details of processing
- Purpose. Providing compliance screening, risk scoring, tariff, filing and data-lookup services the Controller requests.
- Data subjects. Individuals and representatives of businesses that the Controller screens or looks up.
- Categories. Names, aliases, country, business identifiers, and, where the Controller supplies them, date of birth, last four digits of an SSN, and passport or national ID numbers ("sensitive identifiers").
- Duration. For as long as the Controller uses the Service, plus the deletion period in section 8.
2. Instructions
We process personal data only on the Controller's documented instructions, which are these terms, the API requests it makes and its account settings, unless the law requires otherwise. We will tell the Controller if we think an instruction breaches data protection law.
3. Sensitive identifiers
The Processor commits that:
- date of birth, year and place of birth, SSN digits, passport and national ID numbers are used only to match records on the Processor's own systems;
- they are never included in a prompt or other input sent to a language model or other third-party AI service;
- they are redacted from stored screening records, request logs and webhook payloads before storage.
4. AI processing
The Controller can forbid all language-model processing per request (aiMode: "off") or for its whole account. When AI is on, the AI providers listed in the subprocessor list receive the inputs described there. Under those providers' standard API terms, inputs are not used to train their models; they may retain inputs and outputs for a limited period. Zero data retention is not currently enabled.
5. Confidentiality and personnel
Personnel with access to personal data are bound by confidentiality obligations and have access only as needed to provide and secure the Service.
6. Security
We maintain the measures described on the security page, including encryption in transit and at rest, hashed API keys, encrypted stored secrets, rate limiting, signed webhooks and redacted logging. We do not yet hold a SOC 2 report or an independent penetration test result; the security page shows their status.
7. Subprocessors
The Controller authorizes the subprocessors on the subprocessors page. We will update that page when they change and impose data protection obligations on each that are no less protective than these. We remain responsible for their performance.
8. Return and deletion
On request or when the account closes, we will delete or return the Controller's personal data, including screening records, unless the law requires us to keep it. Backups age out in the ordinary course.
9. Assistance and rights requests
We will help the Controller respond to data subject requests and carry out impact assessments, taking into account the nature of the processing. If a data subject contacts us directly about data we hold for the Controller, we will refer them to the Controller.
10. Personal data breaches
We will notify the Controller without undue delay after becoming aware of a breach affecting its personal data and give the information we have to help it meet its own obligations.
11. Audits
We will answer reasonable security questionnaires and, for enterprise customers, make available the documentation needed to show compliance with this addendum. On-site audits are by agreement.
12. Location and transfers
Personal data is hosted in the United States (see the security page). Transfers from other regions rely on the transfer mechanism agreed in the customer's agreement.