Skip to main content
Start your 30-day trial
Legal

Data Processing Addendum

Every customer receives baseline data-processing terms in section 10 of the Terms of Service. Enterprise customers can also execute a Data Processing Addendum with their agreement. This page describes both; it is not itself a signed contract.

Baseline terms for every customer; executed DPA per enterprise agreement.

Request an executable copy or submit redlines at Ollie@safegora.com. A public fill-in-the-blank template is not published here.

What every customer receives

Section 10 of the Terms of Service sets the data-processing terms that apply to every customer without a separate signature: processing only on documented instructions, California service-provider restrictions, security and breach notice, sub-processor notice with an objection and refund right, assistance with privacy requests, and return and deletion.

What enterprise customers receive

When an enterprise order includes a DPA, SafeGora acts as processor / service provider for Customer Personal Data submitted to the production Services. The executed instrument — not this page — is the binding text, and it controls where it conflicts with Terms of Service section 10.

  • Sub-processors that handle Customer Personal Data are listed at /legal/subprocessors.
  • Security measures in production are summarized on /security.
  • Hosting for the production application data plane (Cloud Run, Cloud SQL, Cloud Storage, and Cloud Logging) is in the United States (Google Cloud, us-west1). AI text generation uses a Google global endpoint, as the sub-processor list describes. The sub-processor list does not name a backup geography. International-transfer terms, when required, are set in the executed DPA.
  • SafeGora is not a HIPAA covered entity or Business Associate and does not execute Business Associate Agreements at this time. Do not upload protected health information.

What this page does not do

  • It is not a countersigned DPA and not an order form.
  • It does not publish bracketed customer-name placeholders or a separate self-serve clickwrap DPA; the baseline terms are part of the Terms of Service.
  • It does not claim SOC 2, ISO, VPAT, or trust-center completion.

Not yet published

A public executable enterprise DPA with annexes, a self-serve DSAR workflow with published fulfillment times, and any HIPAA path are not yet published. Until those land, procurement works from an executed copy.

Contact

Executable copies, redlines, and data-protection inquiries: Ollie@safegora.com.

Last updated

October 28, 2026.