Legal

Data Processing Agreement

Effective Date: April 1, 2026 · Last Updated: July 14, 2026

Who this applies to: This DPA applies to organizations that are subject to the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), or other data protection regulations that require a formal data processing agreement with software vendors.

1. Definitions

"Controller" means the Subscriber who determines the purposes and means of processing personal data through MAS Pilot. "Processor" means MAS Pilot LLC, which processes personal data on behalf of the Controller. "Personal Data" means any data uploaded to or processed by MAS Pilot that relates to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.

2. Scope and Purpose

MAS Pilot LLC processes Personal Data on behalf of the Controller solely for the purpose of providing the MAS Pilot compliance platform as described in the Terms of Service. Processing is limited to: checking TDR submission data, storing compliance records, generating compliance reports, and providing platform functionality.

3. Controller Obligations

The Controller represents and warrants that it has a lawful basis for processing any Personal Data submitted to MAS Pilot, has obtained any required consents from data subjects, and has the authority to enter into this DPA.

4. Processor Obligations

MAS Pilot LLC as Processor will:

Process Personal Data only on documented instructions from the Controller (i.e., through use of the platform)
Ensure that authorized personnel are committed to confidentiality
Implement appropriate technical and organizational security measures as described in our Security page
Not engage sub-processors without informing the Controller
Assist the Controller in fulfilling data subject rights requests (access, erasure, portability) upon written request
Delete or return all Personal Data upon termination of the agreement
Provide all information necessary to demonstrate compliance with this DPA

5. Transactional Pricing Data

Transactional pricing data uploaded for TDR checking is designed to be processed in-memory only and not persisted to any database. It is deleted at the end of each checking session and is not used for any purpose other than the requested checking. MAS Pilot is pre-launch; independent attestation (SOC 2 Type II) of these controls is planned before general availability. Enterprise evaluators may request current readiness status under NDA.

6. Data Transfers

MAS Pilot stores and processes all data within the United States. No Personal Data is transferred outside the United States. If you require data processing agreements under GDPR that include Standard Contractual Clauses (SCCs), please contact us at [email protected].

7. Security Measures

MAS Pilot implements the following technical and organizational measures:

Encryption of Personal Data in transit (TLS 1.3) and at rest (AES-256)
Access controls with principle of least privilege
Multi-factor authentication for administrative access
Audit logging of all access to Personal Data
Regular security reviews and vulnerability assessments

8. Sub-Processors

MAS Pilot uses the following categories of sub-processors, all hosting data in the United States: cloud infrastructure and database providers (for hosting and data storage), payment processors (for subscription billing only — no contract data is shared), and email delivery services (for transactional notifications only). A current list of named sub-processors is available upon written request. MAS Pilot is not FedRAMP authorized; FedRAMP authorization is a roadmap target, not a current representation about MAS Pilot or its sub-processors.

9. Data Breach Notification

In the event of a Personal Data breach affecting your data, MAS Pilot will notify you without undue delay and no later than 72 hours after becoming aware of the breach, where feasible. Notification will include the nature of the breach, categories and approximate number of data subjects affected, and measures taken or proposed to address the breach.

10. Data Subject Rights

Upon written request, MAS Pilot will assist the Controller in responding to data subject requests for access, rectification, erasure, restriction, portability, or objection. Requests should be submitted to [email protected] with subject line "Data Subject Request." Requests related to privacy may also be sent to [email protected].

11. CCPA Addendum

For California residents: MAS Pilot does not sell Personal Data. MAS Pilot processes Personal Data as a Service Provider under the CCPA/CPRA, solely for the purposes specified in this DPA and the Terms of Service. MAS Pilot will not retain, use, or disclose Personal Data for any commercial purpose outside of providing the contracted services.

12. Term and Termination

This DPA is effective for the duration of the subscription and terminates upon expiration or termination of the Terms of Service. Upon termination, MAS Pilot will delete all Personal Data within 90 days unless retention is required by law.

13. Governing Law

This DPA is governed by the laws of the State of Maryland. For EU/EEA Controllers, this DPA shall be interpreted in accordance with GDPR to the extent applicable. Disputes shall follow the Governing Law & Dispute Resolution section of the Terms of Service.

14. Executing this DPA

This DPA is incorporated by reference into the Terms of Service and takes effect automatically upon your acceptance of the Terms. If you require a separately executed DPA for your organization's records, contact [email protected].