Data Processing Addendum
Effective date: July 9, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between Union Street Ventures, Inc. d/b/a Coast ("Coast", the "Processor") and the customer that has accepted the Agreement ("Customer", the "Controller"), and governs Coast's processing of Personal Data contained in Customer Data. It applies to the extent data-protection laws — including the GDPR, UK GDPR, and CCPA/CPRA ("Data Protection Laws") — apply to that processing. Capitalized terms not defined here have the meanings in those laws or the Agreement.
1. Roles and scope
Customer is the Controller (or a processor acting for its own controllers) of Personal Data in Customer Data; Coast is a Processor acting on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration of the Service are Customer's complete instructions. For CCPA purposes, Coast is a "service provider": it will not sell or share Personal Data, retain, use, or disclose it other than to provide the Service, or combine it with data from other sources except as the CCPA permits, and it certifies that it understands these restrictions.
2. Processing details
The subject matter, nature, purpose, and duration of processing, and the categories of Personal Data and data subjects, are set out in Annex A.
3. Coast's obligations
- Instructions. Process Personal Data only on Customer's documented instructions (unless required by law, in which case Coast informs Customer unless legally prohibited), and inform Customer if an instruction appears to violate Data Protection Laws.
- Confidentiality. Ensure persons authorized to process Personal Data are bound by confidentiality obligations.
- Security. Implement and maintain the technical and organizational measures in Annex B (which satisfy GDPR Article 32), reviewed and updated as the state of the art evolves without materially reducing protection.
- Breach notice. Notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data, with the information reasonably needed for Customer's own notifications.
- Assistance. Taking into account the nature of the processing, assist Customer with data-subject requests (Articles 12–23), security, breach notification, DPIAs, and prior consultation (Articles 32–36). If a data subject contacts Coast directly, Coast will redirect the request to Customer.
- Deletion and return. On termination of the Service (or on request), delete Personal Data as described in the Agreement (permanent deletion from production within 30 days; encrypted backups age out on a fixed schedule), or export Customer Data to Customer, unless retention is required by law.
- Audit. Make available information reasonably necessary to demonstrate compliance with this DPA (documentation, security summaries, third-party attestations of its sub-processors), and allow audits by Customer or its mandated auditor no more than once per year on 30 days' notice, at Customer's expense, under confidentiality, and without access to other customers' data.
4. Sub-processors
Customer generally authorizes the sub-processors in Annex C. Coast will (a) bind each sub-processor to data-protection obligations no less protective than this DPA, (b) remain liable for their performance, and (c) give at least 15 days' notice (email or in-app) before adding or replacing a sub-processor, during which Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.
5. International transfers
Coast processes Personal Data in the United States. To the extent Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Module 2: Controller→Processor) and the UK Addendum by reference, with Customer as data exporter, Coast as data importer, and Annexes A–C supplying the required appendix information.
6. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations of liability in the Agreement. If this DPA conflicts with the Agreement regarding Personal Data, this DPA controls.
Annex A — Processing details
| Subject matter | Provision of the Coast cash-reporting service. |
|---|---|
| Duration | The term of the Agreement plus the deletion window. |
| Nature & purpose | Hosting, retrieval of read-only account balances, computation of reports, and delivery to Customer-configured channels (Slack, email, SMS). |
| Categories of data subjects | Customer's authorized users; recipients Customer designates for report delivery. |
| Categories of Personal Data | Names and business contact details (email, phone); authentication data; financial account metadata and balances of Customer's business accounts; delivery and audit logs. No banking credentials. No special categories of data are intended to be processed. |
| Frequency | Continuous, per Customer's schedules. |
Annex B — Technical and organizational measures
- Encryption in transit (TLS 1.2+) and at rest; application-layer envelope encryption for financial provider tokens with key-rotation support.
- Tenant isolation enforced in the database itself via PostgreSQL Row-Level Security; the application connects as a least-privilege role that cannot bypass it, verified at every boot.
- Authentication: passwordless magic-link login, TOTP two-factor authentication with step-up for sensitive areas, hashed session and device tokens, sliding session expiry.
- Access control: role-based admin tiers, time-boxed read-only support access with persistent banner, and an append-only audit log of administrative actions.
- Network and application hardening: strict security headers and CSP, request rate limiting, CSRF protection on all mutations, input validation at delivery boundaries.
- Secure development: mandatory code review including adversarial security review of sensitive changes, dependency vulnerability scanning in CI, secrets kept in the host platform's secret store.
- Hosting on SOC 2 Type II–attested infrastructure providers (Supabase, Render); provider attestations available on request.
- Data deletion within 30 days of termination; backups encrypted and aged out on a fixed schedule.
Annex C — Authorized sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database hosting & authentication | United States |
| Render Services, Inc. | Application hosting | United States |
| Plaid Inc. | Read-only financial account connectivity | United States |
| Stripe, Inc. | Payments & billing | United States |
| Resend (Plus Five Five, Inc.) | Email delivery | United States |
| Telnyx LLC | SMS delivery (if enabled) | United States |
| Slack Technologies, LLC | Report delivery to Customer workspaces | United States |
Execution
This DPA is deemed executed upon Customer's acceptance of the Agreement. Customers who require a countersigned copy may request one at support@coastflow.io.