Data Processing Addendum

Last updated: September 22, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement (the “Agreement”) between Proserus, Inc. (“Proserus”) and the law firm or organization identified in the Agreement (“Customer”). It applies to Proserus's processing of Customer Data in providing Proserus Legal (the “Service”).

1. Definitions

• “Customer Data” means all data, including Personal Data, that Customer or its users submit to the Service or that the Service generates from it on Customer's behalf.
• “Personal Data” means information relating to an identified or identifiable natural person contained in Customer Data.
• “Data Protection Laws” means all laws applicable to the processing of Personal Data under the Agreement, including U.S. state privacy laws and, where applicable, the GDPR and UK GDPR.
• “Subprocessor” means a third party engaged by Proserus to process Customer Data.
• “Controller,” “processor,” “data subject,” and “processing” have the meanings given in Data Protection Laws; “business” and “service provider” under U.S. state laws correspond to controller and processor.

2. Roles and Scope

Customer is the controller (or business) of Customer Data and Proserus is the processor (or service provider). Customer determines the purposes and means of processing; Proserus processes Customer Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's configuration of the Service, and any further written instructions Customer gives. Proserus will inform Customer if it believes an instruction violates Data Protection Laws.

Where Customer's users are the clients of Customer's clients or other third parties (for example, information about opposing parties or witnesses), Customer represents that it has a lawful basis to process that data and to instruct Proserus to do so.

3. Proserus Obligations

Proserus will:

• process Customer Data only for the purposes in Annex 1 and as needed to provide, secure, and support the Service;
• not sell or share Customer Data, use it for advertising, combine it with data from other customers except in aggregated form that cannot identify Customer or any person, or use it to train machine-learning models;
• ensure that personnel with access to Customer Data are bound by confidentiality obligations and receive appropriate training;
• implement and maintain the technical and organizational measures in Annex 2;
• assist Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting Customer's security, breach-notification, and impact-assessment obligations;
• make available the information reasonably necessary to demonstrate compliance with this DPA; and
• notify Customer if it can no longer meet its obligations under this DPA.

4. Subprocessors

Customer authorizes Proserus to engage the Subprocessors listed at legal.proserus.com/subprocessors and, subject to this Section, to engage additional or replacement Subprocessors. Proserus will give Customer at least 30 days' written notice (by email to Customer's administrator and by updating that page) before a new Subprocessor processes Customer Data. Customer may object in writing on reasonable data-protection grounds within that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected part of the Service and receive a pro-rated refund of any prepaid fees for the remainder of the term.

Proserus will impose on each Subprocessor data-protection obligations no less protective than those in this DPA and remains responsible for each Subprocessor's performance. Services Customer contracts directly (Microsoft 365, and any AI provider account for which Customer supplies its own credentials) are not Subprocessors.

5. Security

Proserus will maintain the technical and organizational measures described in Annex 2 and on the Security page, which may be updated from time to time provided that the overall level of protection is not materially reduced during the term.

6. Security Incidents

Proserus will notify Customer without undue delay, and no later than 72 hours after confirming, any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data (a “Security Incident”). The notice will describe the nature of the incident, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed. Proserus will provide updates as information becomes available and will cooperate reasonably with Customer's investigation and any notifications Customer must make. Notification is not an acknowledgment of fault.

7. Data Subject Requests

Proserus will promptly forward to Customer any request it receives from a data subject relating to Customer Data and will not respond except to direct the person to Customer, unless required by law. The Service provides self-service tools for Customer to access, correct, export, and delete records; where a request cannot be fulfilled with those tools, Proserus will provide reasonable assistance at no additional charge.

8. Audit Rights

On written request no more than once per 12 months (or following a Security Incident), Proserus will make available the information reasonably necessary to demonstrate compliance with this DPA, including its most recent third-party audit report or penetration-test summary once available, and responses to a reasonable security questionnaire. If that information is insufficient to satisfy a requirement of Data Protection Laws, Customer or an independent auditor bound by confidentiality may conduct an audit of Proserus's relevant controls during business hours, on at least 30 days' notice, in a manner that does not disrupt Proserus's operations or expose other customers' data. Customer bears the cost of any such audit.

9. Data Location and Transfers

Proserus processes and stores Customer Data only in the United States, using the Subprocessors listed. Proserus will not transfer Customer Data outside the United States without Customer's prior written consent. If Customer submits Personal Data that is subject to the GDPR or UK GDPR, the parties will execute the applicable standard contractual clauses or UK addendum on request; those clauses will prevail over this DPA in the event of conflict for that data.

10. Return and Deletion

During the term, Customer may export Customer Data through the Service. For 30 days after termination or expiry of the Agreement, Proserus will make Customer Data available for export in a commonly used, machine-readable format. After that period, Proserus will delete Customer Data from production systems within 90 days and from backups within a further 30 days, unless retention is required by law, and will certify deletion in writing on request. Documents stored in Customer's Microsoft 365 tenant are not affected by termination.

11. Liability and Precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. In the event of conflict, this DPA prevails over the Agreement with respect to the processing of Personal Data, and any executed standard contractual clauses prevail over this DPA. This DPA is governed by the law governing the Agreement (the laws of the State of [STATE]).

Annex 1 – Details of Processing

Annex 2 – Technical and Organizational Measures

The measures below summarize the controls described in more detail on the Security page, which is incorporated by reference.

• Access control: Microsoft Entra ID single sign-on only; no Proserus-managed passwords; role-based permissions enforced server-side on every request; suspended accounts refused at the authentication layer.
• Tenant isolation: PostgreSQL row-level security policies that fail closed, enforced through a restricted database role; tenant-scoped data-access layer in application code; documents remain in each Customer's own Microsoft 365 tenant.
• Encryption: TLS for all data in transit; provider-managed encryption at rest for database and storage; AES-256-GCM envelope encryption for Customer-supplied API credentials.
• Logging and monitoring: per-tenant audit log; permanent AI request metadata trail; append-only trust ledger; separate audited log of all Proserus operator actions; error monitoring with request bodies and cookies excluded.
• Operator access: allowlisted Proserus staff restricted to Proserus's own identity tenant; read-only, time-limited, audited support access.
• Platform hardening: database-backed rate limiting; signature or shared-secret verification of all inbound webhooks; private networking and dedicated secrets for internal services; upload size limits.
• AI processing: single gateway for all model calls; no-training provider terms and zero-data-retention where available as configured in provider agreements; configurable content retention (default 365 days, minimum 30); hard-coded human-approval ceilings for high-risk actions.
• Resilience: provider-managed database backups; stateless application instances; liveness and readiness health checks.
• Incident response: notification to Customer within 72 hours of confirming a Security Incident; vulnerability-disclosure channel at security@proserus.com.
• Assurance roadmap: SOC 2 Type I in progress; annual third-party penetration testing.

Contact

Proserus, Inc.
Privacy: privacy@proserus.com
Legal: legal@proserus.com