Data processing agreement.

Draft of 13 October 2026.

This data processing agreement (“DPA”) forms part of the agreement between Good Local Gov ([TO CONFIRM: the legal name, form, and state of the entity that operates the Service]), the “Processor,” and the customer organization, the “Controller.” [TO CONFIRM: which engagements a countersigned DPA is offered for]

1. Roles

The Controller decides why and how Customer Content is processed. The Processor processes Customer Content only on the Controller’s documented instructions.

2. Scope of processing

Processing is limited to providing the Service: hosting Customer Content, syncing connected accounts the Controller chooses to connect, running the AI features the Controller turns on, and supporting the Controller.

3. Subprocessors

The Controller authorizes the subprocessors listed on our trust page. [TO CONFIRM: how and how far ahead we give notice of a new subprocessor, and how the Controller objects]

4. Security

The Processor keeps technical and organizational measures in place, including row-level security on every table, a tested separation between organizations, connector credentials sealed with AES-256-GCM, an append-only record of meaningful actions, and a receipt for every AI call. [TO CONFIRM: encryption at rest, backups, and the recovery window]

5. Requests and breach notification

The Processor will help the Controller answer requests from people about their data, and will notify the Controller after becoming aware of a personal data breach. [TO CONFIRM: the notification deadline]

6. Return and deletion

When the agreement ends, the Processor will return or delete Customer Content, as the Controller chooses. [TO CONFIRM: the export window and the deletion timeline]

7. Contact

hello@goodlocalgov.com. [TO CONFIRM: a dedicated legal address]