This Data Processing Agreement ("DPA") is incorporated into and forms part of the Terms of Service between Sentinel Labs ("Processor", "we", "us") and the workspace owner ("Controller", "Customer", "you"). It applies when the Service processes personal data on behalf of Customer.
Customer is the Controller of personal data uploaded to or generated within the Service (including prospect records, contacts, activity logs). We act as the Processor.
Subject matter: the processing necessary to provide the Prospect Sentinel Service as described in the Terms of Service.
Duration: for the term of the Customer's active subscription, plus any data-retention period specified in the Privacy Policy.
Data subjects. Customer's employees and end users; business contacts at Customer's prospect organizations.
Personal data categories. Contact details (name, email, phone, title, LinkedIn URL), business addresses, notes and activity history about business contacts, IP addresses, and other technical metadata necessary to operate the Service.
The following providers support the verified launch configuration. This draft list and the applicable contractual arrangements must be reviewed before a final agreement is executed.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, auth, file storage | Database: US East (Ohio) |
| Vercel | Application hosting + edge | United States / Global |
| xAI | AI model processing | No regional processing commitment verified |
Stripe, Resend, and Sentry are optional integrations that are not enabled in the verified launch setup. Confirm the provider list, location, and contractual requirements before enabling an additional service. Supabase authentication email is separate from Resend; delivery has not yet been verified.
We will notify Customer at least [30 days] before adding or replacing a sub-processor. Customer may object in writing within the notice period; if the objection cannot be resolved we will give Customer the option to terminate the affected portion of the Service.
The security overview identifies current evidence and limits. This draft does not establish a completed independent audit or a tested recovery-time commitment.
We will notify Customer without undue delay (and in any case within 72 hours) after becoming aware of a personal data breach affecting Customer Data. The notification will include:
If we receive a request directly from a data subject (e.g. an access, deletion, or portability request), we will forward it to Customer without responding to the data subject directly, unless we are legally required to respond. We will assist Customer in responding to such requests within the timelines required by applicable law.
Customer may, at its expense and no more than once per twelve months (except where required by a supervisory authority), request information about our compliance with this DPA. Where appropriate we will provide third-party audit reports (e.g. SOC 2, ISO 27001) in lieu of an on-site audit.
The post-termination export window, deletion process, and backup retention must be confirmed in the final agreement. Automatic workspace deletion is not currently implemented. Contact us to define the scope of a return or deletion request; removing a prospect preserves history and is not complete erasure.
Before transferring personal data from the EEA, UK, or Switzerland, the applicable transfer mechanism and completed contractual terms must be established. This draft does not demonstrate that Standard Contractual Clauses or an end-to-end regional processing commitment have been executed for a customer's use.
Liability under this DPA is subject to the limitations set forth in the Terms of Service.
Data protection inquiries: keating.andrewj@gmail.com