Effective date: October 18, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Vision2Stars LLC, doing business as Steadproof ("Steadproof"), and the customer that accepted them ("Customer"). If the two conflict on the processing of personal information, this DPA controls.
1. Scope and roles
This DPA applies to personal information in Customer Data that Steadproof processes to provide the service, such as names, contact details, tax ID numbers, insurance and license details, and background check results about Customer's vendors and their people ("Customer Personal Information"). Customer decides why and how that information is processed (a "controller" or "business"); Steadproof processes it only on Customer's behalf (a "processor" or "service provider").
- Subject matter and duration: providing Steadproof for as long as Customer's account exists, plus the export and deletion period in section 8.
- Nature and purpose: storing documents, reading them with AI, checking them against Customer's requirements, screening against public government lists when Customer turns it on, sending reminders, expert reviews when Customer asks, reporting and support.
- People concerned: Customer's users, and Customer's vendors, their staff, principals and insurance agents.
2. Our commitments
- We process Customer Personal Information only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of the service, unless the law requires otherwise (in which case we'll tell Customer first unless the law forbids it).
- We don't sell or share Customer Personal Information, use it for advertising, or combine it with information from other sources except as needed to provide the service (for example, screening against public lists).
- We don't use Customer Data to train AI models, and our AI provider may not either.
- Everyone who can access Customer Personal Information is bound by confidentiality.
3. Security
We maintain the technical and organizational measures described on our Security page, including encryption in transit (TLS 1.2 or 1.3) and at rest (AES-256 with keys in AWS KMS), database-level isolation between customers, role-based access, two-step sign-in, malware scanning of uploads, a tamper-evident audit log and encrypted backups. We may improve these measures but won't materially reduce them.
4. Subprocessors
Customer authorizes the subprocessors listed on our Security page: Amazon Web Services (hosting, storage, email, malware scanning), Anthropic (AI reading of documents) and Stripe (billing). Each is bound by a written contract with protections at least as strong as this DPA. We'll give account owners at least 30 days' notice by email before adding or replacing one. If Customer objects on reasonable data protection grounds and we can't address the objection, Customer may cancel and receive a pro-rated refund of prepaid fees for the unused term. Integrations Customer turns on, such as Procore or QuickBooks Online, are Customer's own providers, not our subprocessors.
5. Requests and assistance
If a person asks us to access, correct or delete their information in Customer Data, we'll pass the request to Customer and won't answer it ourselves unless Customer asks us to. Customer can export, correct and delete most data in the app. We'll give Customer reasonable help with requests, privacy impact assessments and regulator inquiries about the service.
6. Security incidents
If we become aware of unauthorized access to, or loss of, Customer Personal Information, we'll notify Customer without undue delay and in any case within 72 hours, describe what happened and what we're doing about it, and help Customer meet its own notification duties. We keep a register of incidents.
7. Where data is processed
Customer Data is stored in the United States (AWS, Ohio region). Our subprocessors process it in the United States. For customers in Canada, section 11 also applies.
8. Return and deletion
After the account is closed, Customer can export its data for 30 days. We then delete Customer Data from active systems within 30 days, and from backups as they expire, except where the law requires us to keep it (such as billing records).
9. Audits
On request, once a year, we'll answer Customer's reasonable security questionnaire and share a summary of our controls. Once we complete an independent audit such as SOC 2, we'll make the report available under a confidentiality agreement. Customer can also check the integrity of its own audit trail at any time with the Proof Ledger.
10. US state privacy laws
Where the California Consumer Privacy Act or a similar state law applies, Steadproof is a service provider or processor. We will not sell or share Customer Personal Information, retain, use or disclose it outside our direct business relationship with Customer or for any purpose other than providing the service, or combine it with other information except as the law allows. We'll tell Customer if we can no longer meet these obligations, and Customer may take reasonable steps to stop unauthorized use.
11. Canada
For personal information about people in Canada, we protect it as PIPEDA and, for Quebec, Law 25 require of a service provider: we use it only to provide the service, protect it with safeguards suited to its sensitivity, tell Customer about incidents, and help Customer meet its own obligations, including transparency about storage outside Canada. Our privacy officer can be reached at privacy@steadproof.com.
12. General
This DPA lasts as long as we process Customer Personal Information. The limits of liability in the Terms apply to it. Customers who need a countersigned copy, or a version in their own format, can email privacy@steadproof.com.