Data Processing Addendum

1How this fits together

This addendum applies between Silo Data Technology Ltd (“processor”, “we”) and the customer named on the account (“controller”, “you”) whenever we process personal data on your behalf in providing Silo. It forms part of the Terms of Service and needs no separate signature, though we will sign a counterpart on request.

“UK GDPR”, “EU GDPR”, “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” carry the meanings given in the applicable data protection law. “Customer Personal Data” means personal data we process on your behalf under the Terms.

Where this addendum conflicts with the Terms on the handling of personal data, this addendum prevails.

2What we process, and how little of it there is

Silo queries the systems you connect, where they sit, and is designed not to take a copy. Results pass through memory with a time to live and expire; they are not written to disk. So for most of what Silo does, the processing is transient by construction rather than by policy.

The processing is described as follows.

• Subject matter. Providing Silo: federated query, governed writes and the records that accompany them.
• Duration. The term of the Terms of Service, plus the retention periods in clause 10.
• Nature and purpose. Compiling questions into query plans; executing them against your systems; returning bounded results; compiling, previewing and executing writes you approve; keeping the audit record of both.
• Types of personal data. Whatever your connected systems hold and your questions reach. Typically contact and account records, transaction and case records, and employment records. Plus the account data of your users: name, work email, role and authentication data.
• Categories of data subject. Your customers, suppliers, employees, contractors, and anybody else recorded in the systems you connect.
• Special category data. Only if your connected systems hold it and your questions reach it. You decide that; we do not select it.

3What each of us is responsible for

You are the controller. You decide which systems to connect, what questions get asked, what gets written back, and on what lawful basis. You are responsible for having that basis, for the accuracy of the data in your systems, and for giving data subjects whatever notice the law requires.

We are the processor. We process Customer Personal Data only on your documented instructions, which are the Terms, this addendum and your use of the product’s features. If we believe an instruction breaches data protection law we will tell you and may pause that processing until it is resolved.

We will not process Customer Personal Data for our own purposes. We do not sell it, we do not use it to train models, and we do not use it to build our own products. Model calls run under a zero-retention arrangement with our provider.

4Confidentiality of our people

Everybody we allow near Customer Personal Data is bound by a written duty of confidence that survives the end of their engagement, is trained on their obligations, and is granted only the access their role needs. Access to production is authenticated with a second factor and is logged.

5Security

We apply the technical and organisational measures set out below, and will not reduce them during the term.

• Zero persistence by default. Query results are bounded, held in memory with a time to live, and expired. The optional storage subsystem is off unless you enable it, and is absent from the sovereign build.
• Credential sealing. Each credential is encrypted under its own data key, wrapped by a master key held in a managed key service that never enters our application process. Production refuses to start without it. Only the last few characters are stored in readable form, and every decryption is logged with a stated reason.
• Encryption. In transit with TLS 1.3 and, for the agent, mutual authentication. At rest for everything the control plane holds.
• Access control in the compiler. Roles and field policies are applied when a query is compiled, so a field a user may not see never enters the plan that runs. Row level security is enforced in the database as well.
• Outbound-only agent. Where deployed in your network, it opens an outbound connection to us and needs no inbound firewall rule.
• Auditability. Every write records intent, plan, approver and result. Every returned figure carries lineage to its source field and connector version.
• Resilience. Backups of the control plane, encrypted, with restoration tested.

6Sub-processors

You give general authorisation for us to appoint sub-processors. Each is engaged under a written contract imposing obligations no less protective than these, and we remain liable to you for what they do.

The current categories are:

• cloud infrastructure and managed database hosting;
• the model provider that compiles questions, under zero retention;
• payment processing;
• transactional and service email delivery;
• error and performance monitoring;
• website analytics, on the marketing site only, and only for visitors who accepted the banner. It processes no Customer Personal Data: nobody signed in to Silo is measured by it, because the product carries no analytics tag.

The current list names each provider, what it does and where it processes. We will give you at least 30 days’ notice before adding or replacing one. If you reasonably object on data protection grounds within that period, tell us and we will work to offer an alternative; if we cannot, you may end the affected part of the service and we will refund the unused part of your term.

7International transfers

Silo runs in the United Kingdom by default, with European Union and North American regions available. A UK sovereign deployment runs on UK infrastructure, administered by UK staff, with the storage subsystem removed from the build.

Where Customer Personal Data leaves the UK or the EEA, we rely on an adequacy decision where one exists. Where none does, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the Clauses themselves, which are incorporated here by reference with us as data importer, and we carry out a transfer risk assessment before the transfer begins.

8Helping you with data subjects and regulators

Because Silo queries your systems rather than copying them, a data subject request is usually answered from those systems and not from us. Where a request reaches us, we will not respond to it directly. We will tell you without undue delay and pass it on, unless the law requires otherwise.

We will give you reasonable assistance, taking into account what we can see, in responding to requests for access, correction, deletion, restriction, portability and objection, and in carrying out a data protection impact assessment or a prior consultation with a supervisory authority.

9Breach notification

We will tell you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data. We will describe what happened, the categories and approximate number of records and people affected, the likely consequences, what we are doing about it and what we suggest you do.

Where we do not have all of that at first, we will give you what we have and follow up rather than wait. We will not require you to agree the wording of your own notification to a regulator or to affected people, and we will not treat our report to you as an admission of fault.

10Deletion and return

On request during the term, and automatically when the Terms end, we will delete or return Customer Personal Data at your choice.

• Query results. Nothing to delete. They expired when their time to live elapsed.
• Siloes. Available for you to export for 30 days after the end of the term, then deleted within a further 30 days.
• Credentials. Deleted within 7 days of the end of the term. You should also revoke them at source, which we recommend doing first.
• Account and configuration data. Deleted within 30 days of the end of the term.
• Audit and approval records. Retained for six years. They exist so somebody can prove who approved a change, and that purpose survives the account. They are held under the same security as everything else and are not used for any other purpose.
• Backups. Deleted on their ordinary rotation, within 90 days.

11Audit

We will make available the information reasonably needed to show we meet this addendum, including our current security documentation and any third-party certification or report we hold.

Where that is genuinely not enough for your regulator or your own obligations, you may audit us, or appoint an independent auditor who is not our competitor, once in any 12 months, on 30 days’ notice, during working hours, without unreasonable disruption, and subject to confidentiality. You bear the cost unless the audit finds material non-compliance, in which case we do. We may audit more often where a regulator requires it or following a personal data breach.

12Liability, and where this is governed

Each party’s liability under this addendum is subject to the limitations and exclusions in clause 14 of the Terms of Service, except where the law does not permit that.

This addendum is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, save that where the EU Standard Contractual Clauses apply, their own governing law and jurisdiction clauses apply to them.

Our details for notices under this addendum: Silo Data Technology Ltd, Cell Block Studios, College Road, H M Naval Base, Portsmouth, Hampshire, England, PO1 3LJ, company number 16676782, hello@silohq.io.