Data Processing Agreement

This Data Processing Agreement ("DPA") is between JOLIVE Labs Inc., 95 King William Court, Cambridge, Ontario N3C 4J3 ("SourceSecure") and [Firm legal name], [address] ("the Firm"). It forms part of the SourceSecure Terms of Service and any Order Form between the parties (together, "the Agreement"), and takes effect on the date it is signed or accepted at checkout.

1. Roles and laws

1.1 The Firm controls the personal information of its clients and staff that is handled through the Service. SourceSecure handles it only on the Firm's behalf and on its instructions, as set out in this DPA.

1.2 "Privacy Laws" means the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the privacy laws of Alberta and British Columbia where they apply, and any regulations under them.

1.3 "Personal Information" means information about an identifiable individual that SourceSecure handles for the Firm under the Agreement.

2. Instructions

2.1 SourceSecure will handle Personal Information only to provide the Service as the Firm has configured it, as described in Schedule A, and on the Firm's other documented instructions. The Firm's use of the Service's settings (seat types, firm policies, feature switches) counts as its instructions.

2.2 SourceSecure will not sell Personal Information, use it to train AI models, use it for advertising, or combine it with other customers' information, except as counts that identify no firm or person.

2.3 SourceSecure will tell the Firm if it believes an instruction breaks Privacy Laws.

3. Confidentiality and staff

SourceSecure will limit access to Personal Information to the people who need it to run the Service, and bind them to confidentiality.

4. Security

SourceSecure will maintain the safeguards in Schedule B, appropriate to the sensitivity of the information, and will not materially weaken them during the term.

5. Subprocessors

5.1 The Firm authorises the subprocessors listed in Schedule C. SourceSecure will bind each by written contract to protect Personal Information at least as well as this DPA requires, and remains responsible for them.

5.2 SourceSecure will email the Firm's admins at least 30 days before adding or replacing a subprocessor. If the Firm objects on reasonable privacy grounds and the parties cannot resolve it, the Firm may terminate the affected Service and receive a refund of fees prepaid for the period after termination.

6. Security incidents

6.1 If SourceSecure learns of a breach of security safeguards involving Personal Information, it will notify the Firm's admins without undue delay and in any case within 72 hours, with what is known at the time: what happened, what information and whose, the likely consequences, and what is being done.

6.2 SourceSecure will update the Firm as it learns more, cooperate with the Firm's assessment of whether there is a real risk of significant harm (or, under Law 25, a risk of serious injury), and help the Firm notify regulators and individuals where required. SourceSecure will keep a record of every breach for at least 24 months.

6.3 Notice of a breach is not an admission of fault.

7. Requests from individuals and regulators

7.1 If an individual asks SourceSecure to access, correct or delete their Personal Information, SourceSecure will refer them to the Firm and help the Firm respond within the time Privacy Laws require.

7.2 If a regulator or law enforcement body asks SourceSecure for Personal Information, SourceSecure will tell the Firm first unless the law forbids it, and disclose no more than is legally required.

8. Location and transfers

8.1 SourceSecure stores Personal Information in Canada (Montreal). It will not move stored Personal Information outside Canada without telling the Firm at least 30 days beforehand.

8.2 Some subprocessors process information in the United States, as listed in Schedule C. In particular, redacted text for the optional AI features is processed by OpenAI in the United States, and email delivery by Resend. The Firm acknowledges this and confirms it has given any notice its staff and clients require. Firms that do not want any such transfer can switch coaching and reply marks off.

8.3 SourceSecure will provide the information the Firm reasonably needs to complete a privacy impact assessment, including the assessment in the SourceSecure document set.

9. Return and deletion

Within 30 days after the Agreement ends, SourceSecure will delete Personal Information from its systems, except invoices and records the law requires it to keep, which it will continue to protect under this DPA. Before the end, the Firm's admin may ask SourceSecure for an export of the Firm's records. The Living Vault is held only on people's own computers and is not in SourceSecure's systems.

10. Assurance

Once a year, on written request, SourceSecure will answer the Firm's reasonable security questionnaire and provide a current summary of its safeguards. Any further audit will be at the Firm's cost, on 30 days' notice, during business hours, and subject to confidentiality.

11. Liability and precedence

11.1 Each party's liability under this DPA is subject to the limits in the Terms of Service.

11.2 If this DPA conflicts with the rest of the Agreement on the handling of Personal Information, this DPA wins.

11.3 This DPA lasts as long as SourceSecure handles Personal Information for the Firm.

Schedule A: Processing details

Schedule B: Security measures

1. Encryption of all traffic (TLS) and of stored data at rest; the Living Vault encrypted on the device with a key the browser does not release.
2. Detection, redaction and file reading performed on the user's device; only redacted text is sent for AI features, and the server checks again for anything unredacted.
3. Hosting on Google Cloud in Montreal, with database delete protection and 7-day point-in-time recovery.
4. No downloadable server credentials; secrets held in Google Secret Manager; two-step verification on all administrative accounts.
5. Access to production limited to SourceSecure's operators; every firm's data separated, with automated tests that one firm cannot reach another's records.
6. Security headers on the website, a published vulnerability disclosure policy (security.txt), and periodic automated security scans.
7. A written incident and breach response policy, with breach records kept for 24 months.

Schedule C: Subprocessors

Signatures