Our standard data processing addendum.

1. Scope

This Data Processing Addendum ("DPA") supplements the ThirdNexa Terms of Service between ThirdNexa LLC ("ThirdNexa") and the subscribing firm ("Customer"). It applies to Customer Data that ThirdNexa processes to provide the service, which may include nonpublic personal information and confidential business information.

Customer may be subject to the Gramm-Leach-Bliley Act, SEC Regulation S-P, and FINRA and state requirements. ThirdNexa acts as a service provider and supports, but does not perform, Customer's own compliance determinations.

2. Ownership and permitted use

• Customer owns all Customer Data, including vendor records, questionnaire responses, contracts, uploaded evidence and decision history.
• ThirdNexa processes Customer Data only to provide, secure and support the service, as instructed by Customer, or as required by law.
• ThirdNexa does not sell Customer Data or disclose individual firm data to other customers.
• Customer Data is not used to train or fine-tune any artificial intelligence model.

3. Safeguards

• Encryption in transit and at rest, including backups and uploaded files.
• Database-enforced separation between firms on every read and write.
• Mandatory multi-factor authentication and server-enforced roles.
• Least-privilege, recorded ThirdNexa staff access limited to support and operations.
• Append-only records of decisions and finding history.

4. Subprocessors

Customer authorizes the subprocessors listed in ThirdNexa's published register on the Security and Due Diligence pages. ThirdNexa requires each subprocessor to protect Customer Data at a level no less protective than this DPA and remains responsible for their performance.

ThirdNexa will give at least 30 days' notice by email or in-app notice before adding a subprocessor that processes Customer Data. Customer may object on reasonable security grounds within 14 days, and the parties will work in good faith to resolve the objection.

5. Security incidents and Regulation S-P notice

ThirdNexa will notify Customer as soon as possible, and no later than 72 hours after becoming aware, of a breach in security resulting in unauthorized access to Customer Data maintained by ThirdNexa or its subprocessors.

The notice will include, as known at the time, what happened, when, the types of data and records involved, containment and remediation steps, and a contact. ThirdNexa will provide updates and reasonable cooperation so Customer can meet its own notification obligations to customers and regulators.

6. Diligence and audit support

• ThirdNexa maintains a public due diligence package and security brief.
• On request, ThirdNexa will complete Customer's vendor questionnaire at no charge, at least annually and after any security incident.
• When ThirdNexa completes an independent SOC 2 report or penetration test, it will make the report or summary available under a nondisclosure agreement. No such report exists today.

7. Return and deletion

• Customer may download a Full Data Export at any time during the subscription without charge.
• On departure, Customer keeps view-and-export access for its chosen retention window (30 to 365 days, default 90).
• After the window ends, ThirdNexa permanently removes Customer Data from the service and keeps a minimal deletion record. Removed data then ages out of encrypted backups on the platform's backup cycle.

8. General

If this DPA conflicts with the Terms of Service on the processing of Customer Data, this DPA controls. It ends when the Terms end and Customer Data has been returned or deleted.

To request a countersigned copy, email sales@thirdnexa.com. Firms should have their own counsel review this DPA; it is not legal advice.