Data processing agreement

Version 0.1 · Effective October 31, 2026 · Draft pending counsel review

This agreement is between TrustBox LLC of Chicago, Illinois ("TrustBox", "we") and the customer named in the order ("you"). It's part of our terms of service and covers the personal data we process for you when we run your trust center. If it and the terms disagree about personal data, this agreement wins. Questions: privacy@trustbox.dev.

Roles

• You decide what your trust center shares and who gets access. For the personal data of the agency users who sign in to it or call its API, you're the controller (or business) and we're your processor (or service provider).
• For the personal data we collect to run your own account (your staff's sign-in, billing and the sign-up form), we decide how it's used, and our privacy policy covers it.
• The details of the processing are in the annex at the end.

What we do with your agency users' data

• We process it only to run your trust center as the terms describe, and on your other documented instructions. Your use of the service, including your settings, is an instruction. We'll tell you if we think an instruction breaks the law.
• We don't sell or share it, use it for our own purposes, or combine it with other data, except as the law allows a processor to.
• Everyone at TrustBox who can reach it is bound to keep it confidential.

Records FedRAMP's rules require

FedRAMP's rules ask your trust center to keep an inventory and history of agency access (CDS-TRC-AAI) and access logs with 6-month summaries (CDS-TRC-ACL). We keep those records for you for the retention periods in the privacy policy, even if an agency user asks us to delete them, and we give them to you, or to FedRAMP when you tell us to.

Security

We protect the data with the measures in the annex, and we keep them at least as strong while this agreement lasts.

Subprocessors

• You authorize the subprocessors on our subprocessors page. Each one is bound by terms that protect the data at least as well as this agreement does, and we're responsible for what they do.
• We'll email you at least 30 days before a new subprocessor starts processing your data. If you object for a reasonable data-protection reason and we can't address it, you can end the affected service and get a refund of fees prepaid for the time after it ends.

Helping you

• If an agency user asks us directly to see, correct or delete their data, we'll pass the request to you and won't answer it ourselves unless you ask us to.
• We'll help you, as far as the service reasonably allows, to answer such requests, carry out a data protection assessment, or meet your own obligations, including to FedRAMP.

If there's a breach

We'll tell you without undue delay, and within 72 hours, after we confirm a breach of security that affects your personal data. We'll say what we know (what happened, what data and how many people, what we're doing) and keep you updated as we learn more.

When the service ends

You have 30 days to export your data. After that we delete it, except the records FedRAMP's rules require, which we keep for their retention period and then delete, and copies the law requires us to keep. Backups expire on their normal schedule.

Audits

We'll answer your reasonable written questions about how we protect your data. If that isn't enough to show we meet this agreement, you can audit us once a year, with 30 days' notice, during business hours, at your cost, through an independent auditor bound to confidentiality.

Where the data is

We store the data in the United States. Requests to your trust center may be handled in the nearest data center of our hosting provider's global network, as the subprocessors page says. If the law where you are requires a transfer mechanism for that, the one the law sets (such as the European Commission's standard contractual clauses) is part of this agreement.

Liability and term

The limits of liability in the terms apply to this agreement. It lasts as long as we process personal data for you.

Annex: details of the processing

• People: your agency users (federal employees and contractors who sign in to your trust center or call its API).
• Personal data: email addresses and agency; the access granted and its history; the API clients they create; access logs (what was opened, when, IP address and user agent); and sign-in records.
• Special categories: none.
• What we do: store it, use it to sign people in and decide what they can see, log their access, count it, and give the records to you.
• How long: as long as the service runs for you, then as the section "When the service ends" says.
• Security measures: encryption in transit and at rest; the service runs on infrastructure separate from your offering; sign-in links, sessions and API tokens are stored only as hashes and expire (links after 15 minutes, sessions after 8 hours); sign-in is rate limited; every access to certification data is logged; changes to accounts and access are recorded in an audit trail that can't be edited; and each customer's users can reach only that customer's data.