Data Processing Addendum

The Customer decides what data goes into Geistra and why (the controller). Geistra processes it only to provide Geistra, on the Customer’s documented instructions (the processor). The Terms, the Customer’s settings, and what the Customer and its AI apps do in Geistra are those instructions.

• Data: whatever the Customer stores: records, files and their text, saved conversations, apps, tasks and settings. It may include personal data of the Customer’s staff, clients and others, and confidential or privileged material.
• Purpose: storing, organizing, searching, sharing (as the Customer directs), and the AI features the Customer uses.
• Duration: while the Customer uses Geistra, plus the deletion periods in section 8.

Everyone at Geistra who can access Customer Data is bound by confidentiality. They access it only to provide support the Customer asks for, to investigate security or abuse, or when the law requires.

Geistra doesn’t use Customer Data to train or improve AI models, sell it, use it for advertising, or combine it with other customers’ data. Geistra’s AI provider, Amazon Bedrock, doesn’t use it to train models or share it with the model’s developer.

The Customer authorizes the subprocessors on the subprocessors page. Each is bound by written terms at least as protective as this addendum, and Geistra remains responsible for them.

Geistra gives at least 30 days’ notice of a new subprocessor on that page and by email to Customers who ask for it. A Customer who reasonably objects may end the agreement and receive a refund of prepaid fees for the unused period.

AI apps the Customer connects (such as ChatGPT or Claude) act for the Customer, not Geistra, and aren’t Geistra’s subprocessors.

Customer Data is stored and processed in the United States (Amazon Web Services: us-east-1 for storage; us-east-1, us-east-2 and us-west-2 for AI processing). Geistra won’t move it outside the United States without notice under section 5.

• Encryption in transit (TLS 1.2 or later) and at rest (AWS-managed keys; customer secrets with envelope encryption).
• Every request is authenticated and checked against the Customer’s roles and permissions before it touches data. AI apps get only the access the person approves, and sensitive actions wait for the person’s approval.
• An audit trail of who changed what, including which AI app acted.
• Uploaded files are scanned for malware, and unscanned files can’t be downloaded.
• Least-privilege access between Geistra’s own components; rate limits and a web application firewall.
• Daily backups, kept 35 days in a locked vault, and point-in-time recovery of the database.

The Customer can export its data and delete Spaces or accounts at any time.

When the agreement ends, the Customer has 30 days to export, then Geistra deletes Customer Data. Deleted data leaves live systems within an hour and backups within 35 days.

On request, Geistra confirms the deletion in writing.

Geistra notifies the Customer without undue delay, and within 72 hours, after confirming unauthorized access to Customer Data. The notice says what happened, what data is affected (as far as known), what Geistra is doing, and who to contact. Geistra keeps the Customer updated and helps it meet its own notification duties.

Geistra helps the Customer respond to requests from people about their personal data (access, correction, deletion), mostly through Geistra’s own tools.

Requests Geistra receives directly are passed to the Customer. Government and other third-party requests are handled as the Terms describe.

Geistra answers reasonable written security questionnaires once a year, or after a breach. Geistra will share independent audit reports, such as SOC 2, when it has them.

If this addendum conflicts with the Terms on how Customer Data is protected, this addendum wins. A separately signed agreement with the Customer wins over both.