This addendum forms part of the terms of service between
Northern Vector Systems (“the processor”, “we”) and the organization named in
the account or order form (“the controller”, “you”). It applies whenever we
process personal data on your behalf: the names, email addresses, roles and
activity of the members you manage through the platform. It does not replace
the privacy policy, which covers the data we hold as
controller in our own right (the accounts themselves, billing, security
logs).
[REVIEW: whole document against the GDPR Article 28 checklist, the UK
Addendum, and any state-law requirements (CCPA service-provider terms) for US
institutions. Every clause below is a draft for counsel.]
1. Roles
You decide why and how members’ personal data is processed and are the
controller. We process it only to provide the platform and as this addendum
instructs, and are the processor. Where we process data for our own purposes
(operating accounts, billing, security, legal obligations) we do so as an
independent controller under the privacy policy.
2. Details of processing
| Subject matter | Provision of DeFi Research Data Services to the controller’s members |
| Duration | The term of the agreement, plus the retention windows in Annex 2 |
| Nature and purpose | Hosting, storing, displaying, backing up and exporting members’ accounts and research; sending service email; keeping an audit log |
| Data subjects | The controller’s staff, students and collaborators who hold a seat |
| Categories of data | Name, email, role, organization membership, sign-in and activity records, research content the member creates, IP address in server logs |
| Special categories | None intended. The platform is not designed for them and you agree not to upload them |
3. Our obligations
We will:
- process personal data only on your documented instructions, which are
this addendum, the terms, and the settings your admins choose in the
platform, unless the law requires otherwise, in which case we tell you
first where we may; - ensure that everyone we authorise to process the data is bound by
confidentiality; - apply the security measures in Annex 3;
- engage sub-processors only under section 5;
- help you respond to data subjects’ requests, using the platform’s own
tools where they suffice (export, deletion, audit log) and by hand
otherwise; - help you meet your obligations on security, breach notification and
impact assessments, taking into account the information available to us; - delete or return the data at the end of the agreement under section 7;
- make available the information needed to show compliance, and allow
audits under section 8; - tell you without undue delay, and in any case within 48 hours of becoming
aware, of a personal data breach affecting your data, with what we know
about its nature, the data concerned, the likely consequences and the
measures taken[REVIEW: 48 hours is our proposal; some institutions ask for 24].
4. Your obligations
You warrant that you have a lawful basis for the processing you instruct, that
you have told your members what the platform does with their data, and that
you will not instruct us to process data in a way that breaks the law. You are
responsible for the admins you appoint and for the invitations they send.
5. Sub-processors
You authorise the sub-processors listed at
/legal/sub-processors (Annex 1). We email your
admins at least 30 days before adding one that will process your data. You may
object in writing within that period on reasonable data-protection grounds;
if we cannot resolve the objection you may end the agreement for the affected
service with a pro-rata refund. We remain responsible to you for each
sub-processor’s performance.
6. International transfers
Personal data is hosted in [REVIEW: AWS region]. Where a sub-processor is
outside that jurisdiction, transfers rely on the mechanism named against it
in Annex 1. Where the standard contractual clauses apply they are incorporated
into this addendum as Annex 4 [REVIEW: attach the SCCs, module 2
(controller to processor), and the UK Addendum where relevant].
7. Return and deletion
During the term, your admins can export any member’s research through the
platform and members can export their own. On termination we keep the data
for 30 days so you can export it, then delete it, except for what we must
keep as controller (billing records, the audit log for its retention period).
Backups age out within 30 days after deletion.
8. Audit
Once a year, on 30 days’ written notice, you may audit our compliance with
this addendum, by questionnaire in the first instance and, where a
questionnaire does not answer a reasonable concern, by an on-site or remote
review conducted by you or an independent auditor bound by confidentiality,
during business hours, without disrupting the service. [REVIEW: whether to
offer a third-party report (SOC 2 or ISO 27001) in place of audits; none
exists today.]
9. Liability
Liability under this addendum is subject to the limits in the terms of
service. [REVIEW: whether data-protection claims sit inside or outside the
general cap.]
10. Precedence
If this addendum conflicts with the terms, this addendum wins for the
processing of personal data. If a signed order form conflicts with this
addendum, the order form wins.
Annex 1: Sub-processors
The list at /legal/sub-processors, as published on
the effective date of this addendum and as updated under section 5. At the
effective date it names: Amazon Web Services (EC2, RDS, S3, SES, Secrets
Manager), Stripe, the public Ethereum RPC endpoints listed there, Google,
Anthropic, DeFiLlama, Sourcify, Etherscan, and Sentry where error tracking is
configured.
Annex 2: Retention
Retention windows are plan limits, so they follow the plan that covers the
organization. The current values are in the plans guide and
the privacy policy: discarded research for the plan’s
trash_retention_days, page history for its version_history_days, export
files for 7 days, backups for 30 days.
Annex 3: Security measures
- Encryption in transit (TLS) for every connection, including to the
database and the warehouse; encryption at rest on RDS and S3. - Passwords stored as bcrypt hashes; two-factor secrets encrypted at the
application layer; recovery codes stored as hashes; API keys stored as
SHA-256 digests. - Two-factor authentication required for every staff and partner account;
privileged staff actions require re-authentication and are recorded in an
append-only audit log. - Staff access to a customer account (“view as”) is time-limited, logged and
announced to the account holder by email. - Secrets held in AWS Secrets Manager, never in the repository.
- Nightly encrypted database backups with 30-day retention; documented
restore procedure tested[REVIEW: cadence]. - Rate limiting on sign-in, password reset and the API; account lockout
after repeated failed sign-ins. - Dependencies scanned and patched
[REVIEW: cadence]; a public
vulnerability disclosure policy with a
security.txt.
Annex 4: Standard contractual clauses
[REVIEW: insert the standard contractual clauses (module 2) and the UK
International Data Transfer Addendum, completed with the parties, the
processing details from section 2 and the measures from Annex 3.]