Data Processing Addendum

Standard DPA · GDPR Art. 28 aligned.

Roles

Tenant is Controller. Falcon Heights is Processor. Sub-processors are listed on the sub-processors page.

Processing scope

Only the personal data required to operate the ECP, PIP, gamification, and audit surfaces. Data is stored in the customer's chosen region (EU, US).

Security measures

• RLS enforced at every read/write with SECURITY DEFINER helpers.
• Hash-chained append-only audit log with periodic anchor export.
• Step-up re-auth and 4-eyes separation of duties for destructive actions.
• SAML/OIDC SSO, SCIM 2.0, MFA policy per tenant.

Sub-processing

30 days' prior notice for any change of sub-processor.

Sign-off

To counter-sign a DPA on your paper, contact legal@falconveritas.com.