Data Processing Addendum
Effective November 8, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between Cairn Labs, Inc. ("Cairn", the "Processor") and the institution, employer or other organization that purchases seats or otherwise directs Cairn to process personal data on its behalf (the "Customer", the "Controller"). It applies wherever Cairn processes personal data subject to the GDPR, the UK GDPR, the Swiss FADP, the CCPA/CPRA or comparable law on the Customer's behalf.
For individuals using Cairn under a personal account, Cairn is the controller and the Privacy Policy applies instead of this DPA.
1. Definitions
"Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Supervisory Authority" and "Personal Data Breach" have the meanings given in the GDPR. "Service" means the Cairn service described in the Terms of Service. "Subprocessor" means a third party engaged by Cairn to process Personal Data. "Standard Contractual Clauses" means the clauses approved by European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.
2. Roles and scope
2.1 The Customer is the Controller of Personal Data of its members (students, clients, employees) processed through seats it purchases. Cairn is the Processor.
2.2 Where a member also uses Cairn features that the Customer cannot see, such as email text, portal extracts, messages and vault contents, Cairn processes that data as an independent Controller under the Privacy Policy, and the Customer has no access to it. The parties acknowledge this split and agree that the Customer's instructions do not extend to such data.
2.3 This DPA prevails over conflicting terms of the agreement with respect to Processing of Personal Data.
3. Details of processing
4. Processor obligations
Cairn will:
- Process Personal Data only on the Customer's documented instructions, including those in the agreement and in the Service configuration, unless required by law, in which case Cairn will inform the Customer before Processing unless the law prohibits it.
- Ensure that persons authorized to process Personal Data are bound by confidentiality.
- Implement the technical and organizational measures in Annex 2.
- Respect the conditions for engaging Subprocessors in section 6.
- Assist the Customer, taking into account the nature of Processing, in responding to Data Subject requests and in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation.
- Delete or return Personal Data at the end of the agreement as described in section 10.
- Make available the information needed to demonstrate compliance and allow for audits under section 8.
- Inform the Customer immediately if, in Cairn's opinion, an instruction infringes data protection law.
5. Controller obligations
The Customer warrants that it has a lawful basis for the Processing, has provided the notices required to Data Subjects, and that its instructions comply with law. The Customer is responsible for the accuracy of Personal Data it provides and for the configuration of the Service, including which fields members share with it.
6. Subprocessors
6.1 The Customer authorizes Cairn to engage the Subprocessors listed in Annex 3.
6.2 Cairn will give the Customer at least 30 days' notice by email before engaging a new Subprocessor that processes Personal Data. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro rata refund of prepaid fees.
6.3 Cairn will impose on each Subprocessor data protection obligations no less protective than those in this DPA and will remain liable for the Subprocessor's performance.
7. Data Subject requests
Cairn will, without undue delay, notify the Customer of any request it receives from a Data Subject that relates to the Customer's Personal Data, and will not respond except to acknowledge receipt or as the Customer instructs. The Service gives members self-service export and deletion, which the Customer accepts as a means of fulfilling access, portability and erasure requests.
8. Audits
Cairn will make available, on request and no more than once a year, its most recent third-party audit report, penetration-test summary and completed security questionnaire. Where these do not reasonably satisfy the Customer's legal obligations, the Customer may conduct an audit, with 30 days' notice, during business hours, at its own cost, subject to confidentiality and without disrupting the Service.
9. Personal Data Breach
Cairn will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notice will describe the nature of the breach, the categories and approximate number of Data Subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Cairn will cooperate with the Customer and take reasonable steps to mitigate the effects.
10. Deletion and return
At the end of the agreement, the Customer may export its Personal Data through the Service or request a machine-readable export. Cairn will delete the Customer's Personal Data from its live systems within 30 days after the end of the agreement, unless the law requires retention. Backups are not configured yet. When they are, they will be the database provider's restore history, planned to cover seven days or less, and deleted data will leave it when that window passes. Members' personal accounts, if they continue them, are governed by the Privacy Policy.
11. International transfers
Where Personal Data protected by the GDPR, the UK GDPR or the Swiss FADP is transferred to Cairn in the United States or to a Subprocessor outside the EEA, the UK or Switzerland, the transfer is made under the Standard Contractual Clauses, Module 2 (controller to processor), with the UK Addendum and Swiss amendments where applicable. The Clauses are incorporated by reference, with the Customer as data exporter and Cairn as data importer, Clause 7 (docking) included, Option 2 of Clause 9 with 30 days' notice, Clause 11 optional language excluded, Irish law and courts under Clauses 17 and 18, and Annexes 1 to 3 of this DPA serving as the Clauses' annexes.
12. CCPA/CPRA terms
Where the CCPA/CPRA applies, Cairn is a "service provider". Cairn will not sell or share Personal Information, retain, use or disclose it for any purpose other than the business purposes specified in the agreement, or combine it with Personal Information from other sources except as permitted by the CCPA. Cairn certifies that it understands these restrictions. Cairn will notify the Customer if it can no longer meet its obligations and will allow the Customer to take reasonable steps to stop and remediate unauthorized use.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the agreement, except that nothing limits liability to Data Subjects under Clause 12 of the Standard Contractual Clauses.
14. Term
This DPA takes effect when the agreement takes effect and remains in force for as long as Cairn processes Personal Data on behalf of the Customer.
Annex 1 — Parties and contacts
Data exporter (Controller): the Customer named in the order form, acting through the administrative contact listed there.
Data importer (Processor): Cairn Labs, Inc., 1209 Orange Street, Wilmington, DE 19801, United States. Contact: privacy@getoncairn.com.
Annex 2 — Technical and organizational measures
- Row-level security in Postgres enforcing tenant isolation for every query, with the acting user's identity set per transaction.
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) for all stores.
- Envelope encryption for secrets: per-secret AES-256-GCM data keys wrapped by master keys held outside the database; user id bound as authenticated data; key rotation without re-encryption of payloads.
- Database-backed sessions that can be revoked; httpOnly, Secure, SameSite cookies; two-factor authentication and passkeys available to all users.
- Signature verification on all inbound webhooks; rate limiting on authentication endpoints.
- Redaction of addresses, links, tokens and vault contents before any text is sent to a model provider; no credentials in prompts.
- Append-only audit log of sign-ins, exports and secret access, visible to the Data Subject.
- Least-privilege access for staff; no production tooling that reveals plaintext secrets or message bodies; access reviews quarterly.
- Vendor review before engaging a Subprocessor; data processing terms in every Subprocessor contract.
- Incident response plan with defined severity levels, 48-hour customer notification and post-incident review.
- Backups are planned and not yet configured: the database provider's point-in-time restore history, covering seven days or less, with restore tests recorded once it exists.
- Secure development practices: code review, dependency scanning, typed configuration, separate environments.