Legal record / effective August 12, 2026
Data processing addendum
Invarent data-processing roles, documented instructions, security measures, subprocessors, assistance, incidents, transfers, return, and deletion.
When a customer order incorporates this addendum, the customer is controller and Cognautic is processor for customer personal data handled by Invarent, except where Cognautic independently processes limited account, billing, security, or legal records as controller. Signed terms control if they differ from this public version.
Instructions and scope
Processing is limited to providing, securing, supporting, metering, recovering, and improving the contracted service under the order and documented customer instructions. The subject matter, duration, data categories, and data subjects follow the customer configuration and order.
Confidentiality and security
Authorized personnel are bound by confidentiality. Measures include identity verification, MFA for sensitive roles, least privilege, tenant context, database controls, encryption in transit, secret isolation, logging, monitoring, vulnerability management, durable workflows, backup, restoration tests, and incident procedures.
Subprocessors and transfers
Cognautic may engage the listed subprocessors for defined service purposes, remains responsible for their processing under applicable terms, and will provide notice of material additions through the published list or contracted channel. Required transfer safeguards are applied based on processing location and law.
Assistance and incidents
Taking account of the service and information available, Cognautic assists with data-subject requests, security assessments, breach obligations, impact assessments, and regulator consultation. Confirmed personal-data incidents are communicated without undue delay under the applicable agreement and law.
Return, deletion, and audit information
At service end, customer data is returned or deleted as the order requires, subject to legal retention and backup aging. Cognautic supplies information reasonably necessary to demonstrate processor obligations; intrusive audits require appropriate scope, confidentiality, timing, and cost controls.
Next action