Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Silo and the customer (“Customer”) governing Customer’s use of the Silo platform (the “Agreement”), as set out in our Terms of Use and Privacy Policy. By using the Service, Customer agrees to this DPA. Where Customer requires a counter-signed copy for its records, Customer may request one by contacting team@siloag.com.

This DPA reflects the parties’ agreement on the processing of Personal Data in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), the EU General Data Protection Regulation (“GDPR”) and the UK GDPR where applicable, and other applicable data protection laws.

1. Definitions

Capitalised terms used but not defined in this DPA have the meanings given in the Agreement. For the purposes of this DPA:

• Customer Personal Data means any Personal Data that Silo processes on behalf of Customer in providing the Service.
• Personal Data, Data Subject, Processing, Controller, Processor, Sub-processor, and Personal Data Breach have the meanings given in the GDPR (and equivalent terms under the Privacy Act).
• Service means the Silo data warehouse and analytics platform.
• Standard Contractual Clauses or SCCs means the standard contractual clauses adopted by the European Commission (Decision 2021/914) and, where applicable, the UK International Data Transfer Addendum.

2. Roles of the Parties

Customer is the Controller of Customer Personal Data. Silo acts as the Processor and processes Customer Personal Data only on Customer’s documented instructions, including with regard to transfers of Personal Data, unless required to do so by law.

Customer’s use of the Service in accordance with the Agreement constitutes Customer’s documented instructions to Silo. Silo will inform Customer if, in its opinion, an instruction infringes applicable data protection law.

3. Subject Matter and Duration

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are set out in Schedule 1. Processing continues for the term of the Agreement and any additional period during which Silo is required to retain Customer Personal Data under Section 12.

4. Silo’s Obligations

Silo will:

• process Customer Personal Data only on Customer’s documented instructions;
• ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations and have received security awareness training, in accordance with Silo’s Personnel Security Policy (available on request);
• implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as set out in Schedule 3;
• assist Customer in responding to Data Subject requests and in meeting Customer’s obligations under applicable data protection law, including in relation to security, breach notification, data protection impact assessments, and prior consultation;
• make available to Customer all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as described in Section 11; and
• at the choice of Customer, return or delete all Customer Personal Data after the end of the provision of the Service, in accordance with Section 12.

5. Customer’s Obligations

Customer warrants and represents that:

• it has all necessary rights, lawful bases, and consents to enable Silo to process Customer Personal Data as contemplated by the Agreement;
• its instructions to Silo comply with applicable data protection law; and
• it is responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired it.

6. Security

Silo implements and maintains the technical and organisational measures described in Schedule 3, which include encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256), tenant isolation at the database level, multi-factor authentication on all administrative access, role-based access control, continuous vulnerability monitoring, and audit logging.

These measures are designed to ensure a level of security appropriate to the risk and to comply with the requirements of the GDPR (Art. 32), APP 11, and other applicable data protection laws. Silo will review and update its security measures as the threat landscape evolves; updates will not materially diminish the level of protection.

7. Sub-processors

Customer authorises Silo to engage Sub-processors to process Customer Personal Data, subject to the conditions in this Section. The current list of Sub-processors is published at /subprocessors and forms part of Schedule 2.

Before engaging a new Sub-processor with access to Customer Personal Data, Silo will:

• provide at least 30 days’ prior notice by updating the sub-processor list and, where Customer has subscribed, by email; and
• impose data protection obligations on the Sub-processor that are no less protective than those set out in this DPA.

Customer may object to a new Sub-processor on reasonable data protection grounds within the notice period by emailing team@siloag.com. If the parties cannot agree on a resolution, Customer may terminate the Agreement on written notice and receive a pro-rata refund of any prepaid fees for the unused portion of the term.

Silo remains liable for the acts and omissions of its Sub-processors to the same extent as for its own.

8. International Data Transfers and Data Residency

Customer selects the region in which its dedicated warehouse database is provisioned at the time of warehouse creation. Silo offers warehouse regions in the United States, the European Union (Germany), and Australia (Sydney). Customer warehouse data is stored exclusively in the selected region.

Where Customer selects an Australian warehouse region, Customer warehouse data (including Personal Data synchronised from connected integrations) is stored at rest in Australia. Operational metadata (authentication tokens, audit logs, application telemetry) and processing performed by certain Sub-processors may occur outside the selected region; the locations of such processing are disclosed in the sub-processor list.

Where transfers of Personal Data outside the EEA, UK, or Switzerland are necessary, Silo will rely on an appropriate transfer mechanism, including the Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. The SCCs are incorporated by reference into this DPA, with Module 2 (Controller-to-Processor) applying.

9. Personal Data Breaches

Silo will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will be made by direct email to Customer’s nominated account owner and will include, to the extent then known:

• a description of the nature of the breach;
• the categories and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its adverse effects; and
• contact details for further information about the incident.

Where information is not available at the time of the initial notification, Silo will provide it in subsequent updates as the investigation progresses. Silo will provide reasonable assistance to Customer in meeting Customer’s own breach notification obligations, including under the Notifiable Data Breaches scheme, GDPR Articles 33 and 34, and any contractual obligations Customer owes to its Data Subjects.

Silo’s incident response process is documented in its Incident Response Policy, a summary of which is available on request.

10. Data Subject Rights and Assistance

Taking into account the nature of the processing, Silo will assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer’s obligations to respond to requests from Data Subjects exercising their rights under applicable data protection law (including rights of access, rectification, erasure, restriction, portability, and objection).

If Silo receives a request from a Data Subject directly, Silo will, unless prohibited by law, redirect the Data Subject to Customer and notify Customer without undue delay. Silo will not respond to the request directly except on Customer’s instructions or as required by law.

Silo will assist Customer in carrying out data protection impact assessments and prior consultations with supervisory authorities where required by applicable data protection law, taking into account the nature of the processing and the information available to Silo.

11. Audit and Information Rights

Silo will make available to Customer, on reasonable request, the information necessary to demonstrate compliance with this DPA. This includes:

• Silo’s published security documentation at /security;
• summaries of relevant Silo policies, including the Information Security Policy, Incident Response Policy, Access Control Policy, Encryption Policy, Data Classification Policy, and Vendor Risk Management Policy;
• SOC 2 Type II reports of Silo’s critical Sub-processors, subject to those Sub-processors’ confidentiality requirements.

Where Customer reasonably believes that the information made available is insufficient to demonstrate compliance, Customer may request an audit no more than once in any twelve (12) month period (or more frequently if required by a supervisory authority or following a Personal Data Breach). The audit will be conducted at Customer’s expense by Customer or a mutually agreed independent auditor bound by appropriate confidentiality obligations, on reasonable prior notice, during business hours, and in a manner that does not unreasonably interfere with Silo’s operations.

12. Return and Deletion of Customer Personal Data

Upon termination or expiry of the Agreement, Customer may request a full export of Customer warehouse data (SQL dump) within seven (7) days of termination. Silo will provide the export within seven (7) days of receipt of the request via an encrypted channel.

After the export period, or if no export is requested:

• Customer warehouse data is retained for seven (7) days after subscription end, then deleted by dropping the customer’s database schema and allowing backups to expire;
• Platform user account data (profiles, settings, authentication records) is retained for thirty (30) days after account deletion, then permanently removed;
• Application logs containing Personal Data are retained for thirty (30) days, then automatically rotated; and
• Backups expire automatically within their defined retention windows.

Silo may retain Customer Personal Data to the extent required by applicable law, in which case Silo will continue to ensure the confidentiality and security of such data and will not actively process it for any other purpose.

13. AI Processing and Model Training

Silo uses AI providers to power agent-based analytics within the Service. AI model requests are routed through the Vercel AI Gateway, which Silo configures to mandate zero data retention with every downstream provider. Model providers currently include Anthropic (Claude), Google (Gemini), and OpenAI (GPT). The current list is maintained at /subprocessors and updated under the sub-processor change procedure in Section 7.

Customer Personal Data processed by these providers as part of providing the Service is not used to train, improve, or develop AI models. This commitment is contractually enforced with each AI Sub-processor.

AI interactions are ephemeral: Customer queries and the schema or data context provided to support them are processed for the immediate purpose of returning a result and are not retained by the AI provider for training purposes. Silo does not use Customer Personal Data to train its own models.

14. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits or excludes liability that cannot be limited or excluded under applicable law, including under the Privacy Act, the GDPR, or the Competition and Consumer Act 2010 (Cth).

15. General

• Order of precedence. In the event of a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict in matters relating to the processing of Personal Data. The Standard Contractual Clauses prevail over this DPA where applicable.
• Updates. Silo may update this DPA from time to time to reflect changes in law, regulatory guidance, or to Silo’s practices. Material changes will be notified to Customer at least thirty (30) days before they take effect.
• Governing law. This DPA is governed by the laws of New South Wales, Australia, except that, where the Standard Contractual Clauses apply, those Clauses are governed by the law of the EU member state specified therein.
• Severability. If any provision of this DPA is found to be unenforceable, the remaining provisions will continue in effect.

Schedule 1 — Description of Processing

Subject matter of processing

Provision of the Silo data warehouse and analytics platform.

Duration of processing

The term of the Agreement, plus the retention periods set out in Section 12.

Nature and purpose of processing

Synchronising data from Customer’s connected sources to a dedicated warehouse database; storing, querying, and visualising that data; generating analytics and AI-assisted insights; supporting Customer’s use of the Service.

Types of Personal Data

Personal Data contained in Customer’s connected data sources and synchronised to the warehouse, which may include: contact details (names, email addresses, phone numbers, postal addresses); account identifiers; transaction and donation records; behavioural and analytics data; and other categories of Personal Data Customer chooses to import.

Categories of Data Subjects

Customer’s end users, customers, donors, employees, and other individuals whose Personal Data is contained in Customer’s connected data sources.

Special categories of Personal Data

Customer is responsible for determining whether to import special categories of Personal Data (sensitive information under the APPs, or special categories under GDPR Art. 9). Where Customer does so, the same technical and organisational measures apply.

Schedule 2 — Sub-processors

The current list of Sub-processors authorised under Section 7 is maintained at /subprocessors and incorporated by reference into this DPA.

Schedule 3 — Technical and Organisational Measures

Silo implements the following measures to protect Customer Personal Data. Detailed implementation is documented in Silo’s internal security policies, summaries of which are available on request.

Tenant Isolation

• Each Customer organisation receives a dedicated PostgreSQL database with no cross-tenant query capability.
• Per-organisation database roles enforce isolation at the warehouse layer.
• Application-layer authorisation checks enforce organisation scoping on every API request.

Encryption

• TLS 1.2 or higher for all data in transit, with no exceptions.
• AES-256 encryption at rest for all platform and warehouse databases, and for all backups.
• AES-256-CBC application-layer encryption for OAuth tokens and API keys before storage in the database.
• scrypt with per-password salts for password hashing; plaintext storage of credentials is prohibited.

Access Control

• Mandatory multi-factor authentication on all administrative and production accounts.
• Role-based access control with least-privilege provisioning; quarterly access reviews.
• Deprovisioning within 24 hours of an individual’s departure; shared secrets rotated within 48 hours.
• Privileged access logged; production database access requires encrypted channels.
• Customer-facing authentication with CSRF protection, session fixation prevention, rate limiting, and optional MFA and Passkeys.

Application and Network Security

• Three-step authorisation model on every API endpoint: authenticate, authorise, scope to organisation.
• Parameterised SQL queries with tagged template literals — string concatenation prohibited.
• Input validation via Zod schemas on all server actions before processing.
• Continuous dependency vulnerability scanning (Dependabot); security-critical updates applied within 48 hours.
• DDoS protection at the edge (Vercel) covering L3, L4, and L7 attacks.
• OWASP Top 10 controls implemented at each application layer.

Operational Security

• Production deployments via authenticated CI/CD pipeline with automated security checks.
• Real-time application monitoring (Dash0) for errors, performance anomalies, and potential security events.
• Audit logging of critical operations on production systems.
• Personnel screening, security awareness training at onboarding and annually thereafter, and signed confidentiality obligations for all personnel with access to Customer Personal Data.

Resilience

• Encrypted, automated backups with point-in-time recovery on all platform and warehouse databases.
• Backups stored across multiple availability zones in the selected region.
• Documented business continuity and disaster recovery plan with defined RPO and RTO targets, tested annually.

Incident Response

• Documented incident response process aligned with NIST four-phase lifecycle (Preparation, Detection and Analysis, Containment / Eradication / Recovery, Post-Incident Activity).
• Customer notification within 72 hours of confirmation of a Personal Data Breach affecting Customer Personal Data.
• Annual tabletop exercise to validate the incident response process.
• Forensic evidence preserved with documented chain of custody for a minimum of 12 months.

Vendor Risk Management

• Critical-tier Sub-processors are required to maintain SOC 2 Type II or ISO 27001 certification, reviewed annually.
• DPAs executed with all Sub-processors that process Customer Personal Data.
• Sub-processor changes published with at least 30 days’ notice at /subprocessors; Customer right to object.

Contact

Questions about this DPA, or requests for a counter-signed copy, should be sent to:

Email: team@siloag.com
Errinundra Pty Ltd t/a Silo Ag ABN: 29 680 843 814