Data Processing Addendum (DPA)

1. Scope & Roles of the Parties

This Data Processing Addendum (“DPA”) supplements the InboundCheck Terms of Service and applies to the processing of personal data in connection with the deliverability governance and DNS monitoring services:

• Merchant as Data Controller: The merchant acts as the Data Controller with respect to all customer email addresses, store metadata, and transactional recipient logs.
• InboundCheck as Data Processor: InboundCheck acts as the Data Processor, processing transactional telemetry solely under the documented instructions of the merchant.

2. Technical & Organizational Safeguards

InboundCheck implements industry-standard security measures to protect Customer Data against unauthorized access, loss, or alteration:

• Zero-PII Hashing: Email identifiers are hashed via SHA-256 for deliverability telemetry with zero raw PII persisted in storage logs.
• Encryption in Transit & At Rest: TLS 1.3 encryption across all public endpoints and AES-256 / Fernet encryption for DNS provider credentials.
• Logical Tenant Isolation: Supabase PostgreSQL Row-Level Security ensuring strict multi-tenant cryptographic boundary enforcement.

3. Authorized Sub-Processors

Merchants authorize InboundCheck to engage the following trusted infrastructure sub-processors:

4. Data Deletion & Incident Response

Upon termination of services or merchant request, InboundCheck will delete all tenant telemetry, audit logs, and associated provider credentials within 30 days. In the event of a confirmed security incident affecting merchant data, InboundCheck will notify affected merchants within 48 hours.