# Data Processing Addendum (Template) — OriginProof, Inc.
*For institutional customers (universities, firms, publishers). Attach to MSA/Order Form.*

## 1. Roles
Customer is Controller; OriginProof is Processor (GDPR Art. 28) and School Official under FERPA where applicable.

## 2. Subject matter & data
Processing of drafting-process telemetry (timestamps, edit classes, length deltas, digests; full-playback snapshots only where Customer enables) for certification, verification, and grade passback. No special-category data is solicited; drafts' contents are never processed in blind mode.

## 3. Processor obligations
- Process only on documented instructions; prompt notice if an instruction violates law.
- Confidentiality commitments for all personnel; least-privilege access; MFA enforced.
- Sub-processors (current): cloud hosting, Stripe (billing), email delivery — listed at originproofs.com/subprocessors; 30-day notice of changes with termination right.
- Assist with data-subject requests, DPIAs, and breach response.

## 4. Security (Art. 32)
TLS 1.3 / AES-256 / HSM signing / append-only evidence store / annual pen test / SOC 2 Type II (in progress — matrix shared under NDA). Breach notification without undue delay, ≤72h.

## 5. International transfers
SCCs (2021/914, Module 2) incorporated by reference for EEA→US transfers; UK Addendum where applicable.

## 6. Retention & deletion
Per retention schedule (default frames 13 months / registry hashes 10 years); Customer-configured purge; deletion/anonymization within 30 days of termination, certification on request.

## 7. Audit
Annual SOC 2 report + pen-test summary provided; reasonable on-site audit with 30 days' notice, once yearly.

## 8. Term
Coterminous with the Agreement. Signatures: ________________ (Customer) / ________________ (OriginProof).