Data Processing Agreement

This Data Processing Agreement ("DPA") is between JOLIVE Labs Inc., 95 King William Court, Cambridge, Ontario N3C 4J3 ("SourceSecure") and [Firm legal name], [address] ("the Firm"). It forms part of the SourceSecure Terms of Service and any Order Form between the parties (together, "the Agreement"), and takes effect on the date it is signed or accepted at checkout. Where it is accepted at checkout, the Firm's name and address are those given on that checkout.

Version dpa-2026-10-13, published 13 October 2026.

1. Roles and laws

1.1 The Firm controls the personal information of its clients and staff that is handled through the Service. SourceSecure handles it only on the Firm's behalf and on its instructions, as set out in this DPA.

1.2 "Privacy Laws" means the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the privacy laws of Alberta and British Columbia where they apply, and any regulations under them.

1.3 "Personal Information" means information about an identifiable individual that SourceSecure handles for the Firm under the Agreement.

2. Instructions

2.1 SourceSecure will handle Personal Information only to provide the Service as the Firm has configured it, as described in Schedule A, and on the Firm's other documented instructions. The Firm's use of the Service's settings (seat types, firm policies, feature switches) counts as its instructions.

2.2 SourceSecure will not sell Personal Information, use it to train AI models, use it for advertising, or combine it with other customers' information, except as counts that identify no firm or person.

2.3 SourceSecure will tell the Firm if it believes an instruction breaks Privacy Laws.

3. Confidentiality and staff

SourceSecure will limit access to Personal Information to the people who need it to run the Service, and bind them to confidentiality.

4. Security

SourceSecure will maintain the safeguards in Schedule B, appropriate to the sensitivity of the information, and will not materially weaken them during the term.

5. Subprocessors

5.1 The Firm authorises the subprocessors listed in Schedule C. SourceSecure will bind each by written contract to protect Personal Information at least as well as this DPA requires, and remains responsible for them.

5.2 SourceSecure will email the Firm's admins at least 30 days before adding or replacing a subprocessor. If the Firm objects on reasonable privacy grounds and the parties cannot resolve it, the Firm may terminate the affected Service and receive a refund of fees prepaid for the period after termination.

6. Security incidents

6.1 If SourceSecure learns of a breach of security safeguards involving Personal Information, it will notify the Firm's admins without undue delay and in any case within 72 hours, with what is known at the time: what happened, what information and whose, the likely consequences, and what is being done.

6.2 SourceSecure will update the Firm as it learns more, cooperate with the Firm's assessment of whether there is a real risk of significant harm (or, under Law 25, a risk of serious injury), and help the Firm notify regulators and individuals where required. SourceSecure will keep a record of every breach for at least 24 months. How it responds is set out in its incident and breach response policy at sourcesecure.ca/incident-response.

6.3 Notice of a breach is not an admission of fault.

7. Requests from individuals and regulators

7.1 If an individual asks SourceSecure to access, correct or delete their Personal Information, SourceSecure will refer them to the Firm and help the Firm respond within the time Privacy Laws require.

7.2 If a regulator or law enforcement body asks SourceSecure for Personal Information, SourceSecure will tell the Firm first unless the law forbids it, and disclose no more than is legally required.

8. Location and transfers

8.1 SourceSecure stores Personal Information in Canada (Montreal). It will not move stored Personal Information outside Canada without telling the Firm at least 30 days beforehand.

8.2 Some subprocessors process information in the United States, as listed in Schedule C. In particular, redacted text for the optional AI features is processed by OpenAI in the United States, email delivery by Resend, and payments by Stripe. The Firm acknowledges this and confirms it has given any notice its staff and clients require. A Firm that does not want any such transfer can buy Guard seats, which include none of these features; each person can switch prompting tips off for their own browser, which stops all of them except a question that person chooses to put to Ask SourceSecure; and a Guard Enterprise team head can switch the Living Vault off for the Firm, which stops Ask SourceSecure and the other Living Vault features.

8.3 SourceSecure will provide the information the Firm reasonably needs to complete a privacy impact assessment.

9. Return and deletion

Within 30 days after the Agreement ends, SourceSecure will delete Personal Information from its systems, except invoices and records the law requires it to keep, which it will continue to protect under this DPA. Until then, the Firm's admins may download an export of the Firm's records, as one file, from the team page. The Firm's owner may also delete the Firm's records at once from the team page, which ends the Agreement. What is kept after deletion is set out in Schedule A. The Living Vault is held only on people's own computers and is not in SourceSecure's systems.

10. Assurance

Once a year, on written request, SourceSecure will answer the Firm's reasonable security questionnaire and provide a current summary of its safeguards. Any further audit will be at the Firm's cost, on 30 days' notice, during business hours, and subject to confidentiality.

11. Liability and precedence

11.1 Each party's liability under this DPA is subject to the limits in the Terms of Service.

11.2 If this DPA conflicts with the rest of the Agreement on the handling of Personal Information, this DPA wins.

11.3 This DPA lasts as long as SourceSecure handles Personal Information for the Firm.

Schedule A: Processing details

Schedule B: Security measures

1. Encryption of all traffic (TLS) and of stored data at rest; the Living Vault encrypted on the device with a key the browser does not release.
2. Detection, redaction and file reading performed on the user's device; only redacted text is sent for AI features, and the server checks again for an email address, a phone number or a long number and refuses the request if it finds one.
3. Hosting on Google Cloud in Montreal, with database delete protection and 7-day point-in-time recovery.
4. No downloadable server credentials; secrets held in Google Secret Manager; two-step verification on all administrative accounts.
5. Access to production limited to SourceSecure's operators; every firm's data separated, with automated tests that one firm cannot reach another's records.
6. Security headers on the website, a published vulnerability disclosure policy (security.txt), and periodic automated security scans.
7. A written incident and breach response policy, published at sourcesecure.ca/incident-response, and a breach register, with breach records kept for at least 24 months.

Schedule C: Subprocessors

Signatures