Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the business customer (“Customer”) and Verrim LLC, an Arizona limited liability company (“Verrim”), for the Service, and applies when Verrim processes personal information contained in Customer’s uploaded certificates and related records (“Customer Data”) on Customer’s behalf. It is published here so security and legal reviews can answer their data questions without a request first. A countersigned copy is available at hello@verrim.com.

Customer is the controller (or “business” under the California Consumer Privacy Act) of Customer Data. Verrim is the processor (“service provider”): we process Customer Data only to provide, secure, and support the Service, and we do not sell it or use it for advertising. Verrim does not combine Customer Data with information from other sources except as needed to provide the Service, will notify Customer if it determines it can no longer meet its obligations under this DPA or applicable privacy law, and Customer may take reasonable steps to stop and remediate any unauthorized use of Customer Data.

Verrim processes Customer Data only on Customer’s documented instructions, including the settings Customer chooses in the Service, unless the law requires otherwise — in which case we will inform Customer unless the law prohibits it.

Processing covers storing certificate documents, reading and extracting their fields (including with AI-assisted tools), verifying permit numbers against state sources where supported, sending certificate requests and reminders at Customer’s direction, producing reports and audit trails, and matching ecommerce orders from Customer’s connected store against certificates. The data subjects are Customer’s business customers, their representatives, and Customer’s buyers; the data can include names, business addresses, tax and exemption identification numbers, and signatures.

Verrim uses vetted subprocessors to run the Service: cloud hosting and storage, database infrastructure, AI document processing, transactional email delivery, payment processing, and product analytics. Each is bound by terms that limit its use of Customer Data to providing its service to us, and we do not allow our AI providers to use Customer Data to train their models. Our current subprocessor list is published at verrim.com/legal/subprocessors. We will give notice before adding or replacing a subprocessor; if Customer reasonably objects on data-protection grounds and we cannot offer a reasonable alternative, Customer may terminate the affected service and receive a prorated refund of prepaid fees for it.

Data is encrypted in transit and at rest. Access is controlled through per-tenant authorization rules (row-level security), role-based access inside Customer’s workspace, optional two-step verification at sign-in, and audit logging of workspace activity. Integration credentials, such as store access tokens, are stored encrypted.

Everyone Verrim authorizes to process Customer Data is bound by confidentiality obligations.

Taking into account the nature of the Service, Verrim will reasonably assist Customer in responding to data subject requests (access, correction, deletion, export), and will forward any request we receive directly to Customer rather than answering it ourselves.

On written request, no more than once per year, Verrim will provide information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security practices and responses to Customer’s reasonable security questionnaires.

If Verrim becomes aware of a breach affecting Customer Data, we will notify Customer without undue delay with the information we have, and keep Customer updated as we learn more — and in any case in time for Customer to meet its own notification obligations, including any 72-hour regulatory deadlines that apply to Customer.

Items Customer deletes in the Service remain in Trash for 30 days for recovery, then are permanently removed along with their stored files. On termination, Verrim deletes or de-identifies Customer Data on the same schedule, except where the law requires longer retention. Customer can export certificates and records before closing the account.

The Service is operated from the United States and Customer Data is hosted in the United States. Verrim serves US businesses and does not target data subjects outside the US.

This DPA applies for as long as Verrim processes Customer Data and ends when that processing ends.

hello@verrim.com.