Legal Center
Data Processing Addendum
The customer controls the personal data in its leases, invoices and books. Komod processes it on the customer's instructions. This addendum states those instructions, the safeguards, and what happens when the agreement ends.
Last updated
Scope and roles
This Data Processing Addendum (the DPA) is part of the Terms of Service between Komod.ai, Inc., a Delaware corporation (Komod) and the customer organization that accepts them (the Customer). It applies whenever Komod processes Personal Data — information relating to an identified or identifiable person — that is contained in Customer Data.
For that Personal Data the Customer is the Controller (or, where the Customer processes on behalf of its own clients, a processor) and Komod is the Processor. Where the California Consumer Privacy Act applies, Komod is the Customer's service provider and does not sell or share Personal Data. Words defined in the Terms have the same meaning here; Data Protection Law means every law that applies to the processing of Personal Data under this DPA, including the General Data Protection Regulation, the United Kingdom's data protection law, and the California Consumer Privacy Act.
The subject matter, duration, nature and purpose of the processing, the kinds of Personal Data and the kinds of person concerned are described in Annex I.
Instructions
Komod processes Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Customer's configuration of the Service, the connectors its administrator authorizes, and the actions its Users take in the product are those instructions. Komod will not process Personal Data for any other purpose, and will tell the Customer if, in its opinion, an instruction breaks Data Protection Law, unless the law prevents it.
If Komod is required by law to process Personal Data otherwise, it will tell the Customer before it does, unless the law forbids the notice on important grounds of public interest.
Confidentiality
Komod limits access to Personal Data to the people who need it to provide the Service and binds each of them to confidentiality. Komod's own operator console never reads a Customer's documents, figures or conversations, and it has no way to sign in as a User.
Security
Komod maintains the technical and organisational measures in Annex II, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, and the risk to the persons concerned. Komod may update a measure as technology and threats change, and will not reduce the overall protection during the term.
Sub-processors
The Customer gives Komod general authorization to engage the sub-processors in Annex III. Komod requires a written agreement imposing data-protection obligations no less protective than this DPA before a sub-processor handles Personal Data, and remains responsible to the Customer for each sub-processor's performance.
Before a new sub-processor handles the Customer's Personal Data, Komod updates Annex III and the Trust Center and gives the Customer 30 days' notice through the product or by e-mail. The Customer may object on data-protection grounds. If the objection cannot be resolved, the Customer may end the affected part of the Service, and Komod refunds the unused prepaid fees for that part. This is a right to object, not a right to approve Komod's vendors.
International transfers
Komod and the sub-processors in Annex III process Personal Data in the United States. Some Personal Data is protected by European Union, European Economic Area, Swiss or United Kingdom law. Where such data is transferred to a country that the relevant authority has not found adequate, the parties rely on the European Commission's Standard Contractual Clauses of 4 June 2021. Module two (controller to processor) applies, or module three where the Customer is itself a processor. For United Kingdom transfers the parties also rely on the United Kingdom Information Commissioner's International Data Transfer Addendum to those clauses.
The clauses are incorporated by reference and are completed with the information in Annexes I to III. The optional docking clause does not apply. General written authorization applies to sub-processors, with the notice period in this DPA. The governing law and forum of the clauses are those of the European Union member state where the Customer is established, or Ireland if the Customer has none. That forum applies to the clauses only; every other dispute is brought in the courts of Delaware.
If a transfer mechanism the parties rely on is invalidated, the parties will co-operate in good faith to put an alternative lawful mechanism in place.
Assistance to the Customer
Taking into account the nature of the processing, Komod helps the Customer meet its obligations under Data Protection Law. A person may ask to access, correct, delete, restrict, port or object to the processing of their Personal Data. Komod passes such a request to the Customer without undue delay and helps the Customer respond through the product.
Komod also provides the information reasonably needed for the Customer's data protection impact assessments and for any prior consultation with a supervisory authority. It keeps the audit trail and the records the Customer needs to demonstrate compliance.
Komod will not answer a person's request about Customer Data directly except on the Customer's instruction or where the law requires.
Personal data breach
A Personal Data Breach is a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data that Komod processes for the Customer. Komod tells the Customer of a Personal Data Breach affecting the Customer's data within 72 hours after Komod confirms it.
This is a notice from Komod to the Customer under this agreement. It does not by itself make any statement about, or change, any notification the Customer or Komod may owe to a regulator or to the persons concerned under Data Protection Law. Those notifications remain each party's own responsibility.
The notice describes what Komod knows at the time: the nature of the breach, the kinds and approximate number of persons and records concerned, the likely consequences, the measures Komod has taken or proposes to take, and a point of contact. Komod supplements the notice as it learns more, takes the steps within its control to contain and remedy the breach, and gives the Customer the information and help it reasonably needs to meet its own obligations. A notice is not an admission of fault.
Security reports and questions go to [email protected].
Return and deletion
When the Terms end, the Customer may export its data from the product or ask Komod for a copy for 30 days. After those 30 days Komod deletes the Customer's live Personal Data. Backup sets expire on the normal rotation of seven daily, four weekly and three monthly sets, and Komod keeps no separate archive. Komod confirms deletion in writing on request. Where the law requires Komod to keep specific Personal Data longer, Komod keeps only that data, only for that purpose, and protects it as this DPA requires.
Audits and records
Komod makes available the information reasonably needed to demonstrate its compliance with this DPA. That information is the Trust Center, this DPA and its annexes, the Customer's own audit trail in the product, and written answers to the Customer's reasonable security questions.
Once in any twelve months the Customer may send Komod written questions about the security measures published in Annex II and on the Trust Center, at the Customer's cost, and Komod answers in writing. No audit takes place in person, and no other customer's data is disclosed. A supervisory authority's audit under Data Protection Law is not limited by this section.
Liability
Each party's liability arising out of or relating to this DPA, including the Standard Contractual Clauses, is subject to the limitations and exclusions of liability in the Terms of Service, to the extent the law allows. Where the Standard Contractual Clauses apply, nothing in this paragraph limits a party's liability to a person concerned under those clauses.
Precedence, governing law and changes
If this DPA conflicts with the Terms, this DPA governs for the processing of Personal Data. If the Standard Contractual Clauses conflict with this DPA, the clauses govern. Otherwise this DPA is governed by the law that governs the Terms — the laws of the State of Delaware — and disputes are resolved as the Governing law and disputes section of the Terms provides. Komod may update this DPA to reflect a change in Data Protection Law or in the Service; a change that is an Adverse Change under the Terms follows the notice, termination and refund rule there. Written notice under this DPA is given as the Terms provide.
Annex I — Details of the processing
| Item | Description |
|---|---|
| Data exporter (Controller) | The Customer, at the address and contact it gives in its Order or in the product. |
| Data importer (Processor) | Komod.ai, Inc., a Delaware corporation; registered agent Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958; contact [email protected]. |
| Subject matter | The commercial-real-estate documents, bank activity and accounting records the Customer brings into the Service, and the Service's reading, matching, drafting and reporting of them for the Customer's people to approve. |
| Duration | The term of the Terms of Service, plus the 30 days export window and the backup rotation described in the Return and deletion section. |
| Nature of the processing | Hosting, storage, reading by a foundation model, classification, matching, calculation, drafting, display to the Customer's Users, export, and, on a User's approval, transmission to the Customer's accounting system. |
| Purpose | To provide the Service to the Customer: a reviewed, auditable monthly close and owner report. |
| Kinds of Personal Data | Names, business contact details and signatures of tenants, guarantors, landlords, vendors and their staff as they appear in leases, invoices, correspondence and bank descriptions; payment amounts and dates tied to those names; the names, e-mail addresses, roles and actions of the Customer's Users. |
| Special categories | None are expected. The Customer will not bring special-category data into the Service. |
| Kinds of person | The Customer's tenants, guarantors, vendors and their staff; the Customer's own staff and Users; the owners and investors who read the portal. |
| Frequency | Continuous during the term: when a User uploads, when the close runs, when a connector is read, when a User acts in the product. |
| Retention | For the term; then the 30 days export window; then deletion of the live data, with backups expiring on the rotation of seven daily, four weekly and three monthly sets. |
| Competent supervisory authority | For the transfer clauses: the authority of the European Union member state in which the Customer is established, or, for a Customer with no such establishment, the supervisory authority of Ireland. |
Annex II — Technical and organisational measures
The measures below are the ones Komod maintains today and describes on its Trust Center. Each is a fact of the running platform.
| Measure | What Komod does |
|---|---|
| Encryption in transit | Every connection to the service is over HTTPS. The public edge terminates TLS, sends HTTP Strict Transport Security, and forwards to services that listen on the loopback interface only — the application, the database, the object store and the queue publish no public port. |
| Encryption at rest for connector secrets | The credentials that link a customer's QuickBooks, mailbox and bank to the service are stored under AES-256-GCM authenticated encryption with a fresh random nonce per value and a key ring that supports rotation; a re-encryption sweep moves every stored secret to the current key without downtime. Backups are encrypted with a public-key tool when a recipient is configured. |
| Access control and roles | Access is by organization membership and role. The accountant role runs the close and administers the organization; the approver role decides the approvals put in front of it; the viewer and owner roles read the portal only and are refused on every other route. Only the accountant role can confirm an entry into the customer's books. Sessions are signed tokens that expire after twelve hours, and passwords are stored as bcrypt hashes. |
| Tenancy isolation | Every record is scoped to the organization that owns it, and every read and write carries that scope. A record that belongs to another organization is answered as not found, never as forbidden, so nothing about it is disclosed. Komod's own operator console creates organizations, invites the first accountant and manages plans; it never reads a customer's documents, figures or conversations and has no way to sign in as a customer. |
| Human approval on every posting | The service drafts. Every entry it proposes is put in front of a person to review, and only that person's click, in the accountant role, writes to the customer's books. No message typed into the chat can approve, post or pay. |
| Model governance | Every model the platform may call is developed by a company headquartered in the United States or the European Union and served from an enterprise cloud there; the rule is enforced in code and no other model is used. Document text is sent to the model as data to read, never as instructions to follow. |
| Logging and audit | Every act on the books, every approval, every connection and every sign-in writes one row to an audit trail that the platform only appends to. Conversation transcripts are kept whole and are never trimmed by the platform. Every response carries a request id so an event can be traced end to end. Logs redact credentials and encrypted values. |
| Backups and continuity | A nightly job writes a complete set — the database and every stored document — with a manifest of checksums, encrypts the set before it leaves the server, copies it off-site to the storage named in the sub-processor table, keeps seven daily, four weekly and three monthly sets, and records its last successful run. The scheduled host health check reads that record, fails its unit when the last success is more than 36 hours old, and notifies executive leadership the same way every other failed unit does. Every scheduled operations unit on the host carries an automated on-failure hook, and a failed run sends a notification to executive leadership. A restore drill script restores a set from the server's local copy into a scratch database and a throwaway bucket and compares counts, so a restore is rehearsed, not assumed. |
| Secure configuration | The production configuration is checked at start and refuses to run with a plaintext origin, a bare IP address or a wildcard cross-origin rule. The health endpoint says only whether the service is up and discloses no version. Browser pages carry a per-request Content Security Policy nonce, so an injected script does not run. |
| Analytics minimisation | Product analytics run only in the signed-in product and identify a user by an opaque id, the organization id and the role — never a name or an e-mail address — and carry no amount, document or typed value. Session replays are masked in the browser before they leave: every text node, input and attribute is replaced, so a replay shows layout and navigation and nothing legible. The public pages set no analytics cookie. |
Annex III — Sub-processors
The sub-processors that process the Customer's Personal Data, their location, what they do and what they receive. The same list is published on the Trust Center.
| Sub-processor | Location | Purpose | Data it receives | When |
|---|---|---|---|---|
| OpenRouter, Inc. | United States | The gateway through which every model request travels | Prompts, document text sent as data to read, and the records the assistant reads to answer | Every model call |
| OpenAI | United States | The developer of the models that read documents, classify, draft reports and answer in chat | The prompts and document text the gateway forwards | Every model call |
| Microsoft Corporation (Azure) | United States | An approved cloud that may serve those same models | The prompts and document text the gateway forwards | When the gateway routes a call to Azure |
| Intuit Inc. (QuickBooks Online) | United States | The customer's accounting system of record | Chart of accounts, journal entries and vendors — entries are written only after a person approves them | When the customer connects QuickBooks Online |
| Plaid Inc. | United States | Bank feeds | Transactions and balances, read only | When the customer connects a bank account |
| Google LLC (Gmail API) | United States | A mailbox connector | Invoices and lease documents that arrive in the customer's own mailbox | When the customer connects a Gmail mailbox |
| Microsoft Corporation (Microsoft 365) | United States | A mailbox connector | Invoices and lease documents that arrive in the customer's own mailbox | When the customer connects a Microsoft 365 mailbox |
| PostHog, Inc. | United States | Product analytics and masked session replay | Usage events tagged with the organization id and the user's role; replays with every text, input and attribute masked in the browser before it leaves | When analytics are configured |
| Amazon Web Services, Inc. | United States | Encrypted off-site storage for the nightly backup set (S3, us-east-2) | The nightly backup set as ciphertext only — encrypted on Komod's server with the age public-key tool (X25519 / ChaCha20-Poly1305) before upload; the private key is kept off the server, so the storage holds no key and no readable byte | Every night since 2026-09-25 |
The database, the document store and the job queue run inside Komod's own deployment and are components of the Service, not sub-processors. Transactional e-mail leaves through an e-mail relay Komod configures, carrying the address, the link and the message and never a document. Payments are not live; a payment processor will be added to this Annex, with notice, before it receives any data.