Data Processing Agreement

Effective July 17, 2026 · v1.1.0 · Material changes will be posted here with an updated effective date.

This DPA supplements our Terms of Service and Privacy Policy.

This is a DPA template, not a binding contract with visitors to this website. It describes the terms GovCertix LLC will offer to Customers as a supplement to a signed AutoSAM subscription agreement, and it applies only when incorporated into an executed Customer subscription agreement. AutoSAM is currently in an early-access, pre-general-availability phase; sections below that describe product processing, infrastructure, or security controls are qualified accordingly. To request a signed copy, email legal@autosam.io.

1. Definitions

“Data Controller” means the Customer: the entity that determines the purposes and means of processing Personal Data through the AutoSAM platform.

“Data Processor” means GovCertix LLC, operating as AutoSAM, which processes Personal Data on behalf of the Customer.

“Personal Data” means any information relating to an identified or identifiable natural person, including names, email addresses, and account identifiers.

2. Scope of Processing

This DPA applies once incorporated into an executed Customer subscription agreement. AutoSAM's product architecture does not accept, process, or store Controlled Unclassified Information (CUI), ITAR/EAR‑controlled technical data, classified information, or other procurement-sensitive material (ADR-UPLOAD-01); this bounds what “Processing” under this DPA can ever mean, and is described further in Privacy Policy §1.5. When the AutoSAM product is generally available, processing activities will include:

• User account management and authentication

• SAM.gov registration monitoring and compliance alerts

• Email notifications and digest delivery

• Billing and subscription management via Stripe

• Usage analytics for product improvement

GovCertix LLC shall process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law. If GovCertix LLC believes an instruction infringes applicable data protection law, it shall promptly notify the Customer.

3. Data Security

Today.

• 256-bit TLS encryption for data in transit, provided by our hosting provider (Vercel)

• AutoSAM/GovCertix LLC does not currently hold SOC 2 Type II certification. Some infrastructure providers we plan to use hold their own SOC 2 Type II reports (e.g., Vercel); AutoSAM does not inherit certification by using a certified provider. AutoSAM's own SOC 2 attestation is on our compliance roadmap, not yet obtained.

• No FedRAMP authorization exists, and none is required at this stage.

Upon general availability.

GovCertix LLC intends to implement, and represent contractually once the underlying infrastructure is live, the following additional measures:

• AES-256 encryption for data at rest

• Row-level security (RLS) for multi-tenant data isolation

• Role-based access control for all user operations

• Periodic security reviews and penetration testing

• US-based data centers for data at rest; edge caching and CDN operations may transit through global points of presence with no persistent storage

3a. Confidentiality of Processing Personnel

GovCertix LLC ensures that all persons authorized to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory. Such personnel are informed of their responsibilities regarding the protection of Personal Data and the requirements of applicable data protection laws.

4. Sub-processors

Current sub-processors.

• Vercel Inc.: Application hosting for the marketing site (U.S.)

• Microsoft Corporation: Exchange Online / M365 SMTP for outbound lead-form and contact-form email (U.S.)

• PostHog Inc.: Product analytics; loaded per the Analytics Behavior statement above (U.S.)

• Sentry Inc.: Functional error monitoring (U.S.)

Planned sub-processors (activated at product general availability).

• Supabase Inc.: Application database, authentication, and storage (U.S.)

• Stripe Inc.: Payment processing (U.S.)

Once the AutoSAM product is generally available, all paid-plan Customers will receive at least 30 days' notice before we add or replace a sub-processor. During the current pre-launch period, updates to this list will be published here with a dated version-history entry.

GovCertix LLC shall impose the same data protection obligations on each sub-processor as set out in this DPA. GovCertix LLC remains liable to the Customer for the performance of its sub-processors' obligations. Customers may object to the addition of a new sub-processor within 30 days of notice; unresolved objections entitle the Customer to terminate the affected service without penalty.

5. Data Subject Rights

Until the AutoSAM product reaches general availability, all data subject rights (access, rectification, erasure, portability, restriction, objection) are handled by contacting us at privacy@autosam.io.

Once the AutoSAM product is generally available, Customer users will additionally be able to exercise data subject rights via self-service tools (JSON/ZIP export and account deletion) in their AutoSAM account settings, consistent with GDPR Article 17 (Right to Erasure) and CCPA requirements.

5a. Assistance with Controller Obligations

GovCertix LLC shall assist the Customer, taking into account the nature of processing and information available to GovCertix LLC, in fulfilling the following obligations:

(a) Responding to data subject rights requests under GDPR Articles 15–22;

(b) Providing information necessary for breach notification under GDPR Articles 33 and 34;

(d) Engaging with supervisory authorities under GDPR Article 36.

Assistance for requests that go beyond standard self-service tools available in the AutoSAM platform may be billed at cost.

5b. Audit Rights

GovCertix LLC shall make available to the Customer all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits and inspections conducted by the Customer or its designated auditor. Audits are subject to the following conditions:

(a) The Customer shall provide at least 30 days' written notice prior to any audit;

(b) Audits shall be conducted at the Customer's expense;

(c) Where GovCertix LLC has obtained its own SOC 2 Type II report or an independent penetration test summary, it may offer these in lieu of on-site audits, where reasonably appropriate. Until such reports exist, GovCertix LLC will cooperate with reasonable Customer audit requests on 30 days' notice at the Customer's expense.

6. Data Retention

Personal Data is retained for the duration of the service agreement. Upon account deletion, all Personal Data is permanently erased within 30 days, except where retention is required by law (e.g., tax records retained for 7 years as a matter of audit conservatism).

Upon termination or expiration of the service agreement, GovCertix LLC shall, at the Customer's election: (a) return all Personal Data in a structured, machine-readable format (JSON/ZIP export); or (b) securely delete all Personal Data within 30 days. GovCertix LLC will provide written confirmation of deletion upon request. This obligation does not apply to data retained under applicable law (e.g., financial records).

7. Breach Notification

In the event of a Personal Data breach, GovCertix LLC will notify the affected Customer without undue delay and no later than 48 hours of becoming aware of the breach, so as to enable the Customer to fulfill its own 72-hour supervisory-authority notification obligation under GDPR Article 33(1). This 48-hour commitment reflects GovCertix LLC's obligation as processor under GDPR Article 33(2) to notify the Customer “without undue delay.”

8. Contact

For DPA-related inquiries, contact:

GovCertix LLC
2461 Eisenhower Ave, Suite 200
Alexandria, VA 22314
legal@autosam.io

8a. International Data Transfers

Where Personal Data is transferred to the United States from the EU/EEA, such transfers are made under Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Decision 2021/914). For transfers of Personal Data from the United Kingdom to the United States, the parties incorporate the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (as issued by the UK Information Commissioner's Office, in force 21 March 2022), which applies in addition to the SCCs referenced above. Customers may request a copy of the applicable SCCs and UK Addendum by emailing privacy@autosam.io.

8b. Schrems II Supplementary Measures

In accordance with the European Data Protection Board's Recommendations 01/2020 on supplementary measures for EU→US data transfers following the Court of Justice of the European Union's Schrems II decision (C-311/18), GovCertix LLC implements or intends to implement the following supplementary measures:

• TLS 1.2+ encryption for all data in transit between EU data subjects and US infrastructure (in place today)

• AES-256 encryption at rest for Personal Data stored in US-based systems (planned for product general availability, per §3)

• Access controls limiting personnel access to Personal Data on a need-to-know basis

• Contractual restrictions prohibiting disclosure of Personal Data to government authorities except as required by law, with prompt notification to the Customer where legally permissible

• Regular review of US surveillance law developments and their potential impact on data transfers

These measures supplement the Standard Contractual Clauses referenced in §8a and are subject to periodic review and update.

Last updated: July 17, 2026 · v1.1.0. To request a signed copy of this DPA, email legal@autosam.io.

Annex 1: Description of Processing Activities

Nature of Processing: Account management, SAM.gov compliance monitoring, alert delivery, billing, analytics, error monitoring, once the AutoSAM product is generally available. Today, this DPA has no live processing to describe because no Customer subscription agreement has been executed.

Purpose of Processing: Delivery of the AutoSAM platform services as described in the Terms of Service.

Type of Personal Data: Account identifiers (name, email, user ID), usage telemetry, IP addresses, billing references.

Categories of Data Subjects: Employees, contractors, and representatives of Customer organizations.

Duration: Duration of the subscription agreement plus retention periods stated in §6.

Annex 2: Technical and Organizational Measures

The following describes the technical and organizational security measures GovCertix LLC has in place today, and those it intends to have in place by the time this DPA is incorporated into an executed Customer subscription agreement. This Annex is subject to update on 30 days' notice.

Access control

• Role-based access control (RBAC) for all user and administrative operations (planned for GA)

• Multi-factor authentication (MFA) support for all accounts (planned for GA)

• Row-level security (RLS) enforced at the database layer for multi-tenant isolation (planned for GA; no database is deployed today)

• Principle of least privilege applied to all internal personnel access

Encryption

• TLS 1.2+ (256-bit) encryption for all data in transit (in place today)

• AES-256 encryption for all data at rest (planned for GA)

• Encryption keys managed by infrastructure providers with hardware security module (HSM) backing (planned for GA)

Infrastructure security

• US-only data residency for data at rest, once product infrastructure is deployed

• AutoSAM/GovCertix LLC does not currently hold SOC 2 Type II certification; some infrastructure providers we plan to use (e.g., Vercel) hold their own SOC 2 Type II reports

• Network-level isolation and firewalling between service components (planned for GA)

• Automated vulnerability scanning and dependency patching

Monitoring and logging

• Real-time error monitoring via Sentry (in place today)

• Centralized audit logging for security-relevant events (planned for GA)

• Automated alerting for anomalous access patterns (planned for GA)

• Audit logs retained for 365 days, once implemented

Incident response

• Documented incident response plan with defined severity levels

• 48-hour breach notification commitment to Customers (per §7)

• Post-incident review and remediation tracking

Personnel

• All personnel authorized to process Personal Data bound by confidentiality obligations

• Security awareness training for all team members

• Background checks for personnel with access to production systems (planned for GA)

Business continuity

• Automated daily database backups with point-in-time recovery (planned for GA; no database is deployed today)

• Multi-region CDN for application availability (in place today via Vercel)

• Disaster recovery procedures with defined recovery time objectives (RTO) (planned for GA)

Version History

Version	Date	Summary of changes
v1.1.0	July 17, 2026	Go-live legal hardening pass: added the “template, not binding” header, added Microsoft (M365 SMTP) as a current subprocessor for outbound email, split the list into “Current” and “Planned” tiers, qualified infrastructure/security claims as today-vs-GA, added zero-custody cross-reference, corrected the GDPR Article 33 breach-notification citation, and added the UK IDTA reference. Corrected 2026-07-29: this entry previously and incorrectly stated that Upstash was engaged as a planned subprocessor; Upstash is not a current or planned subprocessor and has been removed from the planned list. Corrected 2026-08-05: this entry also previously and incorrectly stated that Resend was a current subprocessor processing contact-form submissions. Resend was never engaged and never processed any data; the sub-processor list above (Section 4) is sourced live from the shared registry and reflects this correction automatically.
v1.0	March 21, 2026	Initial publication

This document: v1.1.0; last reviewed July 17, 2026.