Data Processing Agreement

Using this DPA

This page is Sentrive’s Cover Page for the Common Paper Data Processing Agreement. It incorporates by reference the Common Paper DPA Standard Terms Version 1.1 (the “DPA Standard Terms”). Words with capitals have the meanings the DPA Standard Terms give them.

Provider is Sebastian Mattsson, a sole trader (enskild firma) in Sweden, trading as Sentrive. Customer is the customer under Sentrive’s Terms of Service, and accepts this DPA together with them, by creating a Sentrive account.

Key Terms

Agreement

This DPA supplements Sentrive’s Terms of Service (Common Paper Cloud Service Agreement), accepted on the day Customer creates its Sentrive account.

Approved Subprocessors

List of Subprocessors available at /subprocessors on the copy of Sentrive that holds Customer’s workspace (https://eu.sentrive.ai/subprocessors for the EU copy, https://us.sentrive.ai/subprocessors for the US copy). Provider tells Customer by email at least 10 business days before adding or replacing one (Section 2.6(a)), and Customer may object within 30 days of that notice.

Provider Security Contact

hello@sentrive.ai

Security Policy

As defined in the Agreement: Provider will use commercially reasonable efforts to secure the Service from unauthorized access, with the measures in Annex II below.

Breach Notification

Provider notifies Customer of a Security Incident without undue delay, and no later than 72 hours after becoming aware of it (Section 4.1), by email to Customer’s Notice Address.

Governing Law and Chosen Courts

As in the Agreement: The laws of Sweden.

Stockholm District Court (Stockholms tingsrätt).

Changes to the Agreement

Section 5.2 (Security Reports) of the DPA Standard Terms doesn’t apply: Provider isn’t audited by independent third-party auditors and has no Report. Customer’s requests for information go through Section 5.3 (Security Due Diligence).

Restricted Transfers

Governing Member State

EEA Transfers: Sweden.

UK Transfers: England and Wales.

EEA SCCs

Module Two (Controller to Processor) applies when Customer is a Controller, and Module Three (Processor to Sub-Processor) when Customer is a Processor, with the options Section 3.2 of the DPA Standard Terms sets:

the docking clause in Clause 7 doesn’t apply; in Clause 9, Option 2 (general written authorization) applies, with 10 business days’ notice of changes; the optional language in Clause 11 doesn’t apply; under Clause 17 (Option 1) the clauses are governed by the laws of Sweden; and under Clause 18(b) disputes are resolved in the courts of Sweden.

Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Provider’s supervisory authority is Integritetsskyddsmyndigheten (IMY), Sweden.

Annex I(A): List of Parties

Data Exporter

Customer. Contact: the email address of its Sentrive account. Activities: using Sentrive to run its business.

Role: Controller, or Processor where Customer processes the data on behalf of another controller.

Data Importer

Sebastian Mattsson, a sole trader (enskild firma) in Sweden, trading as Sentrive. Contact: hello@sentrive.ai. Activities: providing Sentrive.

Role: Processor.

Annex I(B): Description of Transfer and Processing Activities

Service

Sentrive, as described in the Agreement.

Categories of Data Subjects

Customer’s customers and the people who work at them; Customer’s employees and anyone else using Customer’s workspaces; and anyone else whose data Customer connects, imports or writes into Sentrive.

Categories of Personal Data

Name; contact information (email addresses, phone numbers, postal addresses); professional information (job titles, the companies people work for); transactional and financial information (subscriptions, invoices, payments and refunds, as Customer’s billing tools hold them); user activity (product usage Customer connects, and who did what in Sentrive’s audit log); and the notes, tasks and questions Customer’s people write.

Special Category Data

No. Customer will not submit special category data.

Frequency of Transfer

Continuous.

Nature and Purpose of Processing

Receiving, holding, using, updating, protecting, sharing with Approved Subprocessors, returning and erasing Customer Personal Data, to provide the Service: syncing the tools Customer connects, showing and searching its records, carrying out the changes its people approve, and answering their questions with Ask Sentrive.

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.

Annex II: Technical and Organizational Security Measures

• Workspace isolation: every workspace’s data carries its workspace, and the database’s row-level security, forced for the role the app runs as, lets a request read and write only the workspace it entered.
• Access by role: who may see or change each area of a workspace is decided by the roles its owners give, checked on every request.
• Encryption in transit: Sentrive is served only over HTTPS, with HTTP Strict Transport Security, and connects to its database over verified TLS.
• Encryption at rest of credentials: the keys and passwords of connected tools are encrypted with AES-256-GCM, bound to their workspace and connection, and never shown or logged. Passwords, session tokens and password-reset tokens are stored only as hashes.
• Audit log: every change made through Sentrive’s actions, by a person, an agent or the AI, is recorded with who proposed and approved it, in a log the app can only add to. Every AI request is logged too.
• Region isolation: each region’s copy of Sentrive (EU and US) has its own hosting, database, worker, email and error reporting, sharing nothing with the other. AI processing at Anthropic, in the United States, is the exception.
• Data minimization for AI: customers’ email addresses, phone numbers and postal addresses are hidden from every AI model.
• Logs without personal data: server logs and error reports hold the kind of error and where it happened, never messages, addresses, cookies or who was using Sentrive.
• Sign-in: email addresses are verified, passwords must be long and not common, attempts are rate limited, and requests from other sites are refused.
• Erasure: Customer can delete synced data when it disconnects a tool, and its people can delete their Ask Sentrive conversations; anything else is deleted on request (Section 7).

Annex III: List of Subprocessors

The Approved Subprocessors, with their locations and what each processes, are listed at /subprocessors on the copy of Sentrive that holds Customer’s workspace (https://eu.sentrive.ai/subprocessors for the EU copy, https://us.sentrive.ai/subprocessors for the US copy).

Attribution

Common Paper Data Processing Agreement (Version 1.1) free to use under CC BY 4.0. The DPA Standard Terms are Common Paper’s; this Cover Page is Sentrive’s.