SuccessionStackLegal

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Controller”) and The Productive (“Processor”) for the use of SuccessionStack. It governs the Processor’s processing of personal data on the Controller’s behalf.

1. Roles and scope

The Controller determines the purposes and means of processing workforce personal data; the Processor processes it only on documented instructions, which include the agreement, this DPA, and the in-product configuration the Controller chooses.

2. Nature and duration

  • Subject matter: provision of the SuccessionStack service.
  • Categories of data subjects: the Controller’s employees and succession candidates.
  • Categories of data: identification and contact details, role and organizational data, performance and potential assessments, retention-risk indicators, and development notes.
  • Duration: for the term of the agreement, plus the deletion window below.

3. Processor obligations

  • Process personal data only on the Controller’s documented instructions.
  • Ensure personnel authorized to process data are bound by confidentiality.
  • Implement appropriate technical and organizational security measures (Section 4).
  • Assist the Controller in responding to data-subject requests and regulators.
  • Make available information needed to demonstrate compliance.

4. Security measures

  • Encryption of data in transit and at rest.
  • Per-tenant row-level security and role-based access control.
  • An immutable audit trail of privileged actions.
  • Least-privilege operator access and secret management.
  • Rate limiting, a strict Content-Security-Policy, and application error monitoring.

5. Subprocessors

The Controller authorizes the Processor to engage the subprocessors below. The Processor remains responsible for their performance and will give notice of intended changes, allowing the Controller to object.

  • Supabase — Managed Postgres database, authentication, file storage, and authentication email (invitations, password reset).
  • Vercel — Application hosting, edge network, and serverless compute.
  • Anthropic (Claude) — AI assistance features (when enabled by the customer).
  • Voyage AI — Text embeddings powering semantic search (when AI is enabled).
  • PostHog — Product analytics (PII-redacted event stream).
  • Sentry — Application error monitoring (when configured).
  • Nango — Brokering optional third-party HRIS / communication integrations.
  • Upstash — Distributed rate-limit counters (opaque keys — user IDs and hashed email digests, no candidate data).

6. Data-subject rights

The Processor provides functionality enabling the Controller to access, export, correct, and erase personal data, and will assist with requests the Controller cannot fulfill through the product alone.

7. Personal-data breach

The Processor will notify the Controller without undue delay, and in any event no later than 72 hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information reasonably available at that time to support the Controller’s own notification obligations. Where full details are not yet available, the Processor will provide information in phases as it is established rather than delay the initial notification.

8. Return and deletion

On termination, the Controller may export their data, after which the Processor deletes it per the Data Retention & Erasure Policy, save where retention is required by law.

9. International transfers

Personal data is hosted in the United States. Where personal data originating in the EEA, the UK, or Switzerland is transferred to the United States, the parties will rely on a lawful transfer mechanism — the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) — together with the supplementary measures described in the Privacy Policy. Customers with a data-residency requirement in another region should contact us before onboarding; residency is configured per deployment.

10. Audit

The Processor will make available compliance information and contribute to audits the Controller reasonably requests, subject to confidentiality and reasonable notice.

This template is provided for negotiation and must be reviewed and executed by both parties with legal counsel. It is not, by itself, a binding agreement.