This Data Processing Addendum ("DPA") is part of the agreement between Zeros and Ones LLC ("Processor", "we") and the customer ("Customer") for the ezGRC Service (the ezGRC Terms of Service, an order form, or a cloud-marketplace contract, the "Agreement"). It applies when we process Customer Personal Data on Customer's behalf. It is pre-signed by us and takes effect when Customer accepts it (for example at checkout) or signs the Agreement. If it conflicts with the Agreement on data protection, this DPA controls.
1. Definitions
- Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws such as the CCPA/CPRA, each as applicable.
- Customer Personal Data: personal data in Customer Data (as defined in the Agreement) that we process on Customer's behalf.
- Subprocessor: a third party we engage to process Customer Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
- "Controller", "processor", "data subject", "personal data", "processing", "service provider", and "business" have the meanings in Data Protection Laws.
2. Roles and instructions
2.1 Customer is the controller (or a processor acting for its own controller), and we are the processor (and, under the CCPA/CPRA, a service provider) of Customer Personal Data.
2.2 We process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. We will tell Customer if we believe an instruction violates Data Protection Laws.
2.3 CCPA/CPRA. We will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, or combine it with personal data from other sources except as Data Protection Laws allow.
2.4 AI. We will not use Customer Personal Data to train or improve AI models made available to other customers.
3. Details of processing
- Subject matter and duration: providing the Service for the term of the Agreement plus the post-termination period in Section 9.
- Nature and purpose: hosting, storing, analyzing, and displaying compliance evidence, policies, risk records, vendor information, and related content; collecting configuration and audit data from systems Customer connects; generating reports and AI-assisted output; providing support.
- Categories of data subjects: Customer's employees, contractors, and Users; Customer's vendors' contacts; auditors; and other individuals whose data Customer chooses to include in Customer Data.
- Categories of personal data: names, work contact details, job titles, user IDs, IAM and identity-provider attributes, access and activity logs from connected systems, training and attestation records, and any other personal data Customer chooses to upload.
- Special categories: none are required to use the Service. Customer should not upload special-category data unless necessary and should configure access appropriately.
4. Confidentiality and personnel
We ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate training.
5. Security
We implement and maintain the technical and organizational measures in Annex 2, designed to protect Customer Personal Data. We may update them as long as the overall level of protection is not reduced.
6. Subprocessors
6.1 Customer authorizes us to use the Subprocessors listed at https://ezgrc.app/legal/subprocessors/ as of the effective date.
6.2 We will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible for their performance.
6.3 We will give at least 30 days' notice before adding or replacing a Subprocessor (by updating the list and emailing customers who subscribe to updates). Customer may object on reasonable data-protection grounds within that period. If we can't reasonably address the objection, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
7. Data subject requests and assistance
Taking into account the nature of the processing, we will help Customer respond to data subject requests, mainly through the Service's features. If we receive a request directly, we will forward it to Customer and won't respond except as Customer instructs or the law requires. We will reasonably assist Customer with data protection impact assessments and consultations with supervisory authorities related to the Service.
8. Security Incidents
We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe the incident, likely consequences, and measures taken or proposed, as far as known, and we will provide updates as information becomes available. [ALIGN this timeframe with the commitment published on the Trust Center (#116).]
9. Return and deletion
During the term and for 30 days after it ends, Customer can export Customer Personal Data using the Service. After that, we delete it from production systems, and from backups within 35 days, unless the law requires us to keep it, in which case we keep it protected and only for that purpose.
10. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA, including our Trust Center materials, completed security questionnaires, and, once available, third-party audit reports (such as a SOC 2 report) under NDA. If that is not sufficient for Customer to meet a legal obligation, Customer may conduct an audit no more than once a year, with at least 30 days' notice, during business hours, at Customer's expense, through an independent auditor bound by confidentiality, in a way that does not compromise other customers' data.
11. International transfers
11.1 We process Customer Personal Data in the United States (AWS US East, N. Virginia).
11.2 For transfers of personal data from the EEA, the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) and, where Customer is a processor, Module Three, with: Clause 7 (docking) included; Clause 9 option 2 (general authorization, 30 days' notice); Clause 11 optional language omitted; Clause 17 governed by the law of Ireland; Clause 18 courts of Ireland. Annex 1 is Section 3 of this DPA and Annex 3 below; Annex 2 is below.
11.3 For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies. For transfers from Switzerland, the SCCs apply with references read as references to the Swiss FADP, and the FDPIC as the competent authority.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Agreement.
Annex 1 — Parties
- Data exporter: Customer, as identified in the Agreement or account. Contact: the account owner. Role: controller (or processor).
- Data importer: Zeros and Ones LLC, 2875 S Orange Ave, STE 500 #6340, Orlando, FL 32806, USA. Contact: Ron McCorkle, privacy@zerosandones.us. Role: processor.
Annex 2 — Technical and organizational measures
- Encryption: TLS 1.2+ for data in transit; AES-256 encryption at rest using AWS KMS-managed keys.
- Hosting: Amazon Web Services, US East (N. Virginia, us-east-1), in logically isolated per-tenant data partitions.
- Access control: production access limited to authorized personnel, with SSO and MFA, least privilege, and logged access. Customer SSO (OIDC/SAML), SCIM, and role-based access in the Service.
- Connected-system access: the recommended AWS integration uses a customer-deployed, read-only IAM role with a per-tenant external ID; no write permissions; revocable by the customer at any time.
- Logging and monitoring: centralized logs and alerting on security-relevant events.
- Vulnerability management: dependency scanning, static analysis, and timely patching.
- Secure development: code review before merge, separate environments, secrets management, and infrastructure as code.
- Backups and resilience: automated, encrypted daily database backups with point-in-time recovery.
- Incident response: documented process, 72-hour customer notification.
- Personnel: confidentiality agreements and security training.
- Subprocessor management: due diligence and contractual data-protection terms.
- Data minimization and deletion: deletion on request and 30 days after termination.
Annex 3 — Subprocessors
The current list is maintained at https://ezgrc.app/legal/subprocessors/. As of the effective date: Amazon Web Services, Inc. (hosting, database, storage, backups and transactional email via Amazon SES; United States) and Stripe, Inc. (payments for direct purchases; United States).
AI features use the AI provider Customer connects (for example Anthropic or OpenAI). Prompts go to that provider under Customer's own account and agreement with it; that provider is not our Subprocessor. If we host a model for Customer as an optional service, it runs on our infrastructure listed above.
Zeros and Ones LLC By: Ron McCorkle, Managing Member Date: October 22, 2026