Data Processing Addendum
Effective August 24, 2026
This Addendum forms part of the Terms of Service between SOAR CRM LLC ("SOAR", "Processor") and the customer ("Customer", "Controller"). Where it conflicts with the Terms, this Addendum wins for personal data.
If you need a countersigned copy for your records, email hello@soar-crm.com and we will sign it.
1. Roles
Customer is the controller (or "business", under US state privacy law) of the personal data it puts into SOAR. SOAR is the processor (or "service provider") and processes that data only on Customer's documented instructions.
Where Customer is itself a processor for someone else, SOAR is a subprocessor and this Addendum applies accordingly.
Using the service is an instruction. Configuring an automation, connecting a mailbox, uploading a spreadsheet, or asking us to build something are all documented instructions for the purposes of this Addendum.
SOAR will tell Customer if, in its opinion, an instruction breaches applicable data protection law.
2. What we will not do with your data
SOAR will not:
- Sell personal data, or share it for cross-context behavioural advertising.
- Retain, use or disclose personal data for any purpose other than performing the service, or outside the direct business relationship between us.
- Combine personal data received from Customer with data from another source, except as needed to perform the service for that same Customer.
- Use personal data to train artificial intelligence models, or permit any subprocessor to do so.
SOAR certifies that it understands these restrictions and will comply with them.
3. Confidentiality
Everyone at SOAR with access to personal data is bound by a duty of confidentiality and is granted access only where it is needed to do their job.
Staff access to a Customer workspace is time-limited, requires a written reason, and is logged. The log is retained for three years and is available to Customer on request. This is described plainly in §3 of the Terms of Service and §3 of the Privacy Notice.
4. Security
SOAR will implement appropriate technical and organisational measures, described in Annex II. Those measures reflect what the system actually does; SOAR will not weaken them materially during the term.
5. Subprocessors
Customer gives general authorisation for SOAR to engage subprocessors. The current list is at Subprocessors.
SOAR will give at least 30 days' notice before adding a subprocessor that will handle Customer personal data. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected service without penalty and with a pro-rata refund of prepaid fees.
SOAR imposes data protection obligations on each subprocessor that are no less protective than this Addendum, and remains liable for their performance.
6. Data subject requests
If a person contacts SOAR directly about data belonging to a Customer workspace, SOAR will not respond substantively; it will pass the request to Customer promptly.
SOAR will provide reasonable assistance — through the application's own export, correction and deletion tools, and by hand where those tools do not reach — so that Customer can meet its own deadlines for access, correction, deletion, portability and objection requests.
7. Personal data breach
SOAR will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer's data.
That notice will describe, as far as known: what happened, the categories and approximate number of records affected, the likely consequences, and the steps taken or proposed. Where the full picture is not yet available, SOAR will send what it has and follow up rather than wait.
SOAR will assist Customer with its own notification obligations to regulators and to affected individuals.
8. Deletion and return
On termination, Customer may export its data using the application's tools, and SOAR will assist where those tools do not cover something.
SOAR deletes Customer's workspace within 90 days of termination, having given Customer 30 days to export first. Deleted records inside a live workspace remain recoverable for 90 days, then are destroyed. Backups age out on their own cycle, described in the Privacy Notice.
SOAR may retain personal data where the law requires it — invoicing and tax records for seven years — and will keep it protected under this Addendum for as long as it holds it.
9. Audit
SOAR will make available the information reasonably needed to demonstrate compliance with this Addendum, and will respond to a reasonable security questionnaire once in any twelve-month period.
SOAR holds no third-party security certification today — see Security, which says so plainly rather than implying otherwise. Where Customer's own obligations require an on-site or third-party audit, the parties will agree scope, timing and cost in advance; audits are limited to once a year unless a regulator or a breach requires otherwise, and are subject to confidentiality.
10. International transfers
SOAR processes personal data in the United States. Its subprocessors are listed with their locations in Subprocessors.
If Customer transfers personal data subject to UK or EU data protection law into SOAR, the parties will put an appropriate transfer mechanism in place — the European Commission's Standard Contractual Clauses, with the UK Addendum where applicable — which on execution are incorporated here by reference, with SOAR as data importer and Module Two (controller to processor) applying.
Customer should not assume this is already in place. Ask for it.
11. Liability
Each party's liability under this Addendum is subject to the limitations in §12 of the Terms of Service.
12. Term
This Addendum lasts as long as SOAR processes personal data for Customer.
Annex I — Details of processing
Subject matter. Provision of the SOAR application, API and custom automation services.
Duration. The term of the Terms of Service, plus the retention periods in §8.
Nature and purpose. Hosting and storing business records; triaging inbound messages; drafting replies and documents for human approval; coding expense and statement lines; producing quotes, invoices and summaries; supporting and configuring the Customer's agents.
Types of personal data.
| Category | Examples |
|---|---|
| Customer's own users | Name, work email, role, authentication data, sign-in records |
| Customer's contacts | Name, email, phone, employer, job and ticket history, correspondence |
| Message content | Inbound and outbound mail, chat transcripts, attachments |
| Financial records | Invoices, time entries, bank and card transaction lines, uploaded spreadsheets |
| Technical data | IP addresses, timestamps, diagnostic logs |
Categories of data subject. Customer's employees and contractors; Customer's clients and their staff; anyone who writes to a connected mailbox; visitors who use the website assistant.
Special category data. Not intended, not required, and not to be uploaded — see §2 of the Acceptable Use Policy. Where it arrives anyway inside free-text correspondence, it is processed as ordinary message content and is subject to the same protections.
Frequency. Continuous, for as long as the service is in use.
Annex II — Technical and organisational measures
Every item below describes something the system does today. Nothing here is aspirational, and no certification is claimed.
Access control
- Multi-factor authentication (TOTP) is mandatory for every account.
- Passwords are hashed with bcrypt; they are never stored or logged in reversible form.
- Sessions expire after 24 hours, can be revoked individually, and can be invalidated everywhere at once.
- Repeated failed sign-ins lock the account against further attempts.
- Role-based permissions govern what a signed-in user can reach.
Tenant isolation
- Every query is scoped to the organisation that owns the record.
- Cross-tenant access is covered by an automated adversarial test suite that runs before each release; a failure there blocks the release.
Encryption
- Traffic to the API is served over HTTPS.
- Connector credentials and OAuth tokens are encrypted at rest and are never echoed back by the API.
Application hardening
- Security headers, a Content Security Policy, and validated redirect targets.
- Outbound connection targets are validated against an SSRF guard, so a configured host cannot be pointed at internal infrastructure.
- The desktop application runs sandboxed with context isolation on and Node integration off; in-app navigation and embedded frames are blocked.
Logging and audit
- Staff access to a customer workspace is logged with actor, reason and timestamp, and retained for three years.
- Authentication events and agent actions are recorded.
Resilience
- Automated database backups.
- A 90-day recoverable hold on deletions, so that a mistake is reversible.
Organisational
- Access to production is limited to personnel who need it.
- Confidentiality obligations apply to everyone with access.
- Change is reviewed before release, with an automated test suite gating it.
Annex III — Subprocessors
The current list, with what each one does and where it operates, is maintained at Subprocessors and forms part of this Annex.
Signature
Customer does not need to sign this to rely on it — it applies automatically as part of the Terms of Service. If your procurement process needs a countersigned copy, email hello@soar-crm.com.
SOAR CRM LLC 100 Holly Park Court, Holly Springs, GA 30115 hello@soar-crm.com