Aurian Data Processing Addendum

This Addendum is published at aurian.app/dpa and is incorporated into every Order Form. It reflects the Data (Use and Access) Act 2025 as in force at 5 October 2026.

1. Definitions and roles#

1.1 Terms defined in the Customer Agreement have the same meaning here. Data Protection Law means UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies, the EU GDPR, each as amended, including by the Data (Use and Access) Act 2025. Controller, processor, data subject, personal data, personal data breach and processing have the meanings in Data Protection Law.

1.2 For personal data inside Customer Data (your clients and prospective clients, their representatives, your staff, contractors and suppliers, and on the Developer tier, investors and buyers), the Customer is the controller and Aurian is the processor.

1.3 For personal data about the Customer's own users that Aurian needs to run the account (login details, billing contacts, support messages, usage logs), Aurian is an independent controller and the Aurian Privacy and Cookies Notice applies.

1.4 Where the Customer is itself a processor for another controller, the Customer confirms that it has the controller's authority to appoint Aurian as a sub-processor on these terms.

2. Details of processing#

3. Aurian's obligations#

Aurian will:

3.1 Process personal data only on the Customer's documented instructions, which are the Customer Agreement, this Addendum and the Customer's configuration and use of the Service, unless required by law, in which case Aurian will tell the Customer first where the law allows. Aurian will tell the Customer if it believes an instruction breaches Data Protection Law.

3.2 Ensure that everyone with access to personal data is bound by a duty of confidentiality and receives appropriate training.

3.3 Implement and maintain the technical and organisational measures in Annex 1, and at least those required by Article 32 UK GDPR, and review them at least annually.

3.4 Engage sub-processors only under clause 5.

3.5 Taking into account the nature of the processing, help the Customer by appropriate technical and organisational measures to respond to data subject requests (access, rectification, erasure, restriction, portability, objection and automated decision-making rights), and help with data protection impact assessments and prior consultation with the Information Commissioner's Office (ICO). The Service includes export and deletion tools for this purpose. Aurian may charge reasonable costs for help that goes materially beyond those tools.

3.6 Tell the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to Aurian about the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken, and update that information as it becomes available. Aurian will not tell data subjects or regulators about a breach affecting Customer Data without the Customer's agreement unless the law requires it.

3.7 At the end of the Customer Agreement, export or delete personal data as set out in clause 16.3 of the Customer Agreement, unless the law requires retention, and confirm deletion in writing on request.

3.8 Make available the information reasonably needed to show compliance with this Addendum, and allow and contribute to audits, including inspections, by the Customer or an auditor it appoints who is bound by confidentiality, on at least 30 days notice, during Business Days, no more than once a year unless required by a regulator or following a personal data breach. Aurian may first offer its most recent security documentation or third-party assessment in satisfaction of the request.

3.9 Never use personal data in Customer Data to train, tune or improve the Service for any other customer, and never sell it.

3.10 Where a data subject contacts Aurian directly about Customer Data, pass the request to the Customer without undue delay and not respond except to say the request has been passed on, unless the law requires otherwise.

4. Customer's obligations#

4.1 The Customer is responsible for the lawfulness of the personal data it puts into the Service, for its lawful basis for the processing, for its own privacy notices to clients, staff, contractors, investors and buyers, for responding to data subjects, and for the instructions it gives Aurian.

4.2 The Customer will not instruct Aurian to process personal data in a way that breaches Data Protection Law, and will configure the Service (roles, portal access, connected services, retention) in a way appropriate to the data it holds.

5. Sub-processors#

5.1 The Customer gives general authorisation for Aurian to engage the sub-processors in Annex 2 and those listed at aurian.app/dpa. Aurian will give at least 30 days notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; Aurian will work with the Customer in good faith to resolve the objection, and if it cannot be resolved within 30 days, the Customer may end the Customer Agreement for the affected part of the Service on written notice, with a refund of fees paid in advance for that part for the period after the end date.

5.2 Aurian remains fully responsible to the Customer for its sub-processors and will impose on each of them, in writing, data protection obligations no less protective than this Addendum.

5.3 Connected Services that the Customer elects to link (for example Google, Microsoft, Xero, Slack and Telegram) are not Aurian's sub-processors. The Customer engages them directly under their own terms, and Aurian transmits data to them only on the Customer's instructions.

6. International transfers#

6.1 Customer Data is stored at rest in the European Union (Ireland, AWS eu-west-1).

6.2 Where Aurian or a sub-processor processes personal data outside the United Kingdom, Aurian will ensure that the transfer is covered by adequacy regulations under section 17A of the Data Protection Act 2018, by the ICO's International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, or by another mechanism valid under Data Protection Law, and that the standard of protection is not materially lower than in the United Kingdom. Where the EU GDPR applies to the Customer, the EU Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor) apply to transfers from the EEA, with Aurian as data importer and the Customer as data exporter, and are incorporated by reference.

6.3 Aurian will give the Customer the information it reasonably needs to assess a transfer.

7. Liability and precedence#

7.1 Liability under this Addendum is subject to clause 19 of the Customer Agreement, including the higher cap in clause 19.3(a).

7.2 This Addendum takes priority over the Customer Agreement on anything about personal data. If Data Protection Law changes so that this Addendum no longer meets its requirements, the parties will agree the changes needed in good faith, and Aurian may publish an updated Addendum under clause 22 of the Customer Agreement.

Annex 1: Technical and organisational security measures#

Tenant isolation. Row-level security enforced in the database, enabled and forced on every tenant table, under a least-privilege application role that cannot bypass it. A dedicated automated isolation test suite runs on every code change and blocks release on failure.

Encryption. TLS 1.2 or higher for all connections. Encryption at rest provided by the hosting and database platforms. Secrets held in the hosting platform's secret store, never in code.

Portal access. Client, investor and buyer portals opened by unguessable, high-entropy tokens; no client passwords; tokens can be rotated and revoked inside the Service; portal activity is logged.

Integrations. Google, Microsoft, Xero, Slack and Telegram connected through each provider's official OAuth or bot authorisation with the minimum scopes needed; Aurian holds no passwords for those services. Inbound webhooks are signature-verified.

Access control. Role-based access within a tenant (owner, admin, staff, guest). Multi-factor authentication is on the roadmap for the first quarter of 2027 and will be required for owners and admins when released. Audit log of significant actions retained for 12 months.

Staff and production access. Production access restricted to named individuals on a need-to-know basis, with multi-factor authentication on every provider account, reviewed quarterly and removed on the day a person leaves. Privileged database access separated from application access and used only for migrations and audited operations.

Backups and resilience. Automated daily backups retained for at least 7 days, stored encrypted, with restoration tested at least every six months. Point-in-time recovery is not currently enabled.

Development. Code review before merge; dependency vulnerability scanning; separate staging and production environments; no production personal data in development or test.

AI providers. AI model calls made over encrypted connections under API terms that exclude use of inputs and outputs for training; the shortest retention option offered by each provider selected, with provider retention limited to abuse monitoring for up to 30 days; no Customer Data used in prompts to any model for any other customer.

Incident response. Documented incident response procedure with named owner, severity levels, 72-hour customer notification, and post-incident review.

Business continuity. Hosting and database platforms with published availability commitments; recovery point objective 24 hours; recovery time objective 8 hours.

Annex 2: Sub-processors#

This Annex is the published sub-processor list (aurian.app/dpa). Confirm each entry, the service used, the region and the training-exclusion terms before issue. Customers receive 30 days notice by email of any addition or replacement (clause 5); to receive notices, email hello@aurian.app with the subject "Sub-processor notices". We use a sub-processor only where it is needed to run the Service, under a written contract that binds it to data protection obligations at least as strong as our own, with the minimum data needed, and after checking its security practices and location.

Connected Services elected by the Customer (not sub-processors): Google LLC, Microsoft Corporation, Xero Limited, Slack Technologies, Telegram FZ-LLC.