Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between TruthSource ("Processor") and the Customer ("Controller") using TruthSource services. This DPA supplements the TruthSource Terms of Service.

2. Subject Matter & Duration

TruthSource processes personal data on behalf of the Controller for the purpose of providing cryptographic verification, C2PA manifest generation, and blockchain notarization services. Processing continues for the duration of the service agreement.

3. Nature of Processing

TruthSource processes: email addresses (account management), file metadata (hashing and notarization), IP addresses (security logging). TruthSource does NOT store the content of uploaded files after hashing.

4. Data Subject Rights

TruthSource will assist Controllers in fulfilling data subject requests (access, erasure, portability) within 30 days. Note: blockchain-anchored hashes are immutable by design and cannot be deleted.

5. Security Measures

TruthSource implements: AES-256 encryption at rest, TLS 1.3 in transit, access controls and audit logging, regular security assessments, and EU-based data storage (AWS Frankfurt).

6. Sub-processors

Current sub-processors: AWS (EU-West-1, hosting), Stripe (payment processing, USA with SCCs), Resend (transactional email, USA with SCCs), Polygon Network (blockchain anchoring, decentralized). We provide 30 days' notice of sub-processor changes.

7. Data Transfers

Transfers outside the EEA are governed by Standard Contractual Clauses (SCCs) per GDPR Article 46. All primary data storage is within the EU.

8. Contact

Data Protection enquiries: legal@truthsource.pro General: support@truthsource.pro

Enterprise customers can request a countersigned DPA for their compliance records.