Data Processing Agreement
Draft update: business positions approved September 7 for implementation. Staffing, insurance, verified data disposal, vendor evidence and customer-specific terms remain prerequisites; this summary is not an executed agreement or proof of current capability.
Processing scope
RostrOps processes workforce and operational data to provide the platform: site presence, authority verification, access-control support, attendance and absence workflows, labor-hour support, reporting, billing, notifications, audit, and support.
Self-scan processing also includes a supervisor-reviewed selfie and a single phone-location reading at scan-in. Precise location and leave-related free text need jurisdiction-specific sensitive-data review.
Security measures
- Tenant-scoped authorization and role-based access controls.
- Hashed passwords, peppered PIN hashing, short-lived access tokens, and rotating refresh tokens.
- Production TLS and database SSL verification.
- Secrets stored outside source control through Azure Key Vault.
- Append-only audit logging, with selected audit records hash-chained for tamper evidence.
- Worker photos stored outside public static paths and served through authenticated tenant-scoped endpoints.
Authorized subprocessors
Current subprocessors and service providers include Microsoft Azure (including Application Insights diagnostics), Resend, Expo, Anthropic for optional customer-enabled AI features, and site-location/weather services, including conditional Tomorrow.io, US National Weather Service, Open-Meteo, Nominatim and timeapi.io. The final DPA should confirm the exact list and notice process for changes. The inspected API/database are in Central US and file storage is in East US; other provider processing locations remain to be verified. Optional AI tokenization does not guarantee anonymous text.
The approved draft uses notice without undue delay and within 24 hours after awareness of a personal-data breach, requiring verified after-hours escalation. Exit terms: export requested within 30 days, delivery within 14 days of request, retrieval for 30 days and day-90 active disposal with documented exceptions. Subprocessor notice and objection is 30 days; ordinary annual audits use 30-day notice without limiting necessary legal, regulator or material-incident inspections.
Counsel items before signature
- Verify 24-hour incident routing and customer/regulator notice responsibility.
- Preserve necessary inspection rights; documentation-first review is not an absolute substitute.
- Approve and rehearse full-tenant deletion/return before promising a deadline; a complete manual export service is not yet verified.
- Verify the bounded DPA schedule: no blanket indefinite audit or named-worker billing retention.
- Confirm remaining vendor processing geography and retention of previous file versions. Azure encryption and 14-day database backup and Blob soft-delete settings were verified September 7; versioning is enabled.