Data processing addendum

This Data Processing Addendum (the "DPA") forms part of the Master Services Agreement (the "Agreement") between Finic Technologies Inc. ("Finic") and Customer. It sets out how Finic handles Customer Data, including the data retention setting and Zero Data Retention in Section 3, and what Scores keep in Section 3.9. Capitalized terms not defined here have the meanings in the Agreement. If this DPA conflicts with the Agreement on the processing of Customer Data, this DPA controls.

1. Definitions

"Customer Personal Data" means personal information contained in Customer Data that Finic processes on Customer's behalf.

"Data Protection Laws" means the privacy and data protection Laws that apply to the processing of Customer Personal Data, which may include the Gramm-Leach-Bliley Act and its implementing regulations ("GLBA"), the California Consumer Privacy Act as amended ("CCPA"), other US state privacy laws, and, where applicable, the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

"Nonpublic Personal Information" has the meaning given in GLBA.

"Retention Period" means the period, chosen for an organization under Section 3.1, for which Finic keeps Stored Requests.

"Saved Requests" means requests that an Authorized User chooses to save in the playground.

"Score Records" means the records a Score keeps for each example and each record it scores, as described in Section 3.9.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data processed by Finic.

"Stored Requests" means the requests and responses Finic keeps for an organization that has chosen a Retention Period, as described in Section 3.3.

"Subprocessor" means a third party that Finic engages to process Customer Personal Data.

"Zero Data Retention" means the setting under which Finic keeps no Input or Output after answering each request, other than what Scores keep under Section 3.9, as described in Section 3.2.

Terms such as "controller," "processor," "business," "service provider," "data subject" and "processing" have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. Customer is the controller of Customer Personal Data (and, under the CCPA, the business). Finic is Customer's processor (and, under the CCPA, its service provider). Where Customer acts as a processor for another controller, Finic is Customer's subprocessor.

2.2 Scope. Annex 1 describes the processing. Personal information Finic collects about Customer's Authorized Users to run their accounts, such as names, email addresses and sign-in records, is governed by Finic's Privacy Policy, not this DPA.

2.3 Compliance. Each party will comply with the Data Protection Laws that apply to it. Customer is responsible for the lawfulness of the Customer Personal Data it submits, including providing notices and obtaining consents or opt-outs required by GLBA and other Data Protection Laws.

3. Data retention

3.1 Retention setting. Customer chooses, for each of its organizations, whether Finic keeps Input and Output after answering a request: Zero Data Retention, or a Retention Period of seven (7), thirty (30), ninety (90) or three hundred sixty-five (365) days. The Authorized User who creates an organization chooses its setting when creating it (for the organization created at sign-up, right after first accepting these terms); if they make no choice, the Retention Period is thirty (30) days. Admins of the organization can change the setting in the Portal at any time. Each Authorized User may also choose, in the Portal or through the MCP servers, a shorter Retention Period or Zero Data Retention for their own requests: those they run in the playground and those sent with API Keys or sign-ins they created, in each of Customer's organizations. The stricter setting applies: the shorter Retention Period, or Zero Data Retention if either chooses it. An Authorized User's setting can never lengthen retention. The settings apply equally to requests sent to the API and to requests run in the playground, and to each request according to the settings in effect when Finic receives it.

3.2 Zero Data Retention. This Section 3.2 applies only to requests received while Zero Data Retention applies to them under Section 3.1. Finic processes their Input and Output in memory for the duration of each request and does not write them to databases, files, logs or backups, so Finic personnel cannot review them afterward. This covers:

• the data and context;
• the questions, including their instructions, choices and levels; and
• the answers and probabilities the Services return.

Scores keep the information described in Section 3.9 whatever the setting.

3.3 Stored Requests. While a Retention Period applies to a request under Section 3.1, Finic keeps the request (as sent) and the response it returned in Finic's encrypted database, so that the organization's Authorized Users can inspect them in the Portal. Finic deletes each Stored Request within one hour after the Retention Period that applies to it ends; immediately when an admin, or the Authorized User whose request it is, chooses a shorter Retention Period (for Stored Requests older than the new period) or Zero Data Retention (for all of them); when that Authorized User's account is deleted; and as described in Section 9. Deleted Stored Requests remain in Finic's encrypted database backups for up to seven (7) days. Finic personnel do not access Stored Requests except at Customer's request to provide support, or where Laws require it, and Finic uses them only to provide the Services to Customer.

3.4 Subprocessors. Whatever the setting, Finic requires each Subprocessor that handles Input or Output to process it only to answer the request and not to retain it, except Finic's hosting provider, which holds Finic's encrypted database (including Stored Requests, Saved Requests and Scores) on Finic's behalf.

3.5 What is recorded. For each request, whatever the setting, Finic records Usage Data:

• the time of the request;
• the organization, and the API Key or, for playground runs, the Authorized User who sent it;
• whether the request came from the API or the playground;
• the endpoint (such as decide or score) and, for requests to a Score, which Score;
• the model;
• the HTTP status and, for errors, the error type (such as invalid_request), but not the error message;
• the number of questions;
• the number of input tokens, and the credit the request used;
• the latency; and
• the request ID returned in the X-Request-Id header, and the response's decision ID.

Finic also records when each API Key was last used. Finic uses Usage Data to show usage in the Portal, charge requests against Customer's credit, enforce rate limits, keep the Services secure and reliable, and answer support requests. Usage Data is part of Finic's billing records: Finic keeps it while Customer's account is open and for seven (7) years after it closes, then deletes it.

3.6 Saved Requests. If an Authorized User saves a request in the playground, Finic stores its context and questions within Customer's organization, visible only to that user, so the user can run it again. Answers are not stored; the Portal keeps them only in the user's browser tab. Finic deletes a Saved Request when the user deletes it, when the user is removed from Customer's organization, or as described in Section 9. Deleted Saved Requests remain in Finic's encrypted database backups for up to seven (7) days.

3.7 Content sent to Finic. If Customer includes Input or Output in a support email or attachment, Finic keeps that message as described in the Privacy Policy.

3.8 Legal orders. If a court or regulator lawfully orders Finic to preserve Input or Output, the order can apply only to Stored Requests and Scores that exist when Finic receives it and to requests received after it, since other content no longer exists. Finic will notify Customer unless Laws prohibit it.

3.9 Scores. When Customer creates a Score, Finic builds it from the examples Customer sends, and keeps what the Score needs to work, whatever the retention setting:

• Examples. Finic processes the examples in memory while it builds the Score, which usually takes minutes, and does not write them to databases, files, logs or backups. To design the Score, Finic sends the Score's description, the names and types of the examples' fields, and up to ten of the examples, shortened and with their outcomes, to a Claude model from Anthropic that runs on Amazon Bedrock (Annex 3). Amazon Bedrock processes them only to respond and does not retain them or share them with Anthropic.
• What a Score keeps. Until the Score is deleted, Finic keeps its description; the names and types of the fields in its examples, but not their values; its internal parameters; and a Score Record for each example and each record it scores: the score ID (Customer's identifier, or one Finic assigns to an example), the score, the intermediate values the Score computed for it (numbers only), the time, and any outcome Customer sends to calibrate the Score. Score Records hold no other content of the examples or records.
• Scoring. Finic processes each record sent to a Score in memory to compute its score, as under Zero Data Retention, and does not keep it. Requests to create, call or calibrate a Score are never Stored Requests.
• Calibration. Outcomes Customer sends to calibrate a Score are kept in the Score Records they match. Calibration uses the Score Records, the description and the field names and types, and no other Customer Data. When calibration redesigns part of a Score, the model in Annex 3 receives the description and the field names and types, but no examples or records.
• Use. Finic uses each Score, its examples and its Score Records only to provide that Score to Customer, and not for any other customer or model.
• Deletion. Finic deletes a Score, with its Score Records, when an admin of Customer's organization deletes it in the Portal, and as described in Section 9. Deleted Scores remain in Finic's encrypted database backups for up to seven (7) days.

Customer should use score IDs that do not by themselves identify an individual, such as internal transaction or case numbers rather than names or email addresses.

3.10 No training. Finic will not use Customer Data to train, fine-tune or evaluate any model, except to build, calibrate and run Customer's Scores as described in Section 3.9. Because other Input and Output is not kept, it cannot be used later.

4. Processing

4.1 Instructions. Finic will process Customer Personal Data only to provide the Services and in accordance with Customer's documented instructions. The Agreement, this DPA and Customer's configuration and use of the Services are Customer's complete instructions. Finic will tell Customer if it believes an instruction violates Data Protection Laws, and if Laws require processing that is not instructed, unless Laws prohibit telling Customer.

4.2 Personnel. Finic will limit access to Customer Personal Data to personnel who need it to provide the Services and who are bound by confidentiality obligations.

5. US privacy laws

5.1 CCPA. Finic will not (a) sell or share Customer Personal Data, as those terms are defined in the CCPA; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Services; (c) retain, use or disclose it outside the direct business relationship between Customer and Finic; or (d) combine it with personal information Finic receives from or on behalf of anyone else, except as the CCPA permits. Finic will notify Customer if it can no longer meet its obligations under the CCPA. Customer may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data. Finic certifies that it understands and will comply with these restrictions.

5.2 GLBA. To the extent Customer Personal Data includes Nonpublic Personal Information, Finic will (a) use and disclose it only to perform the Services, consistent with the limits on reuse and redisclosure in 12 C.F.R. § 1016.11; and (b) maintain an information security program with administrative, technical and physical safeguards designed to ensure its security and confidentiality, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer, as described in Annex 2.

6. Subprocessors

6.1 Authorization. Customer authorizes Finic to engage the Subprocessors listed in Annex 3. Finic will impose on each Subprocessor data protection obligations at least as protective as those in this DPA, to the extent applicable to the services it provides, and remains responsible for each Subprocessor's performance.

6.2 Changes. Finic will give Customer at least thirty (30) days' notice before a new Subprocessor processes Customer Personal Data. Customer may object on reasonable data protection grounds within that period. The parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected Services and receive a refund of unused purchased credit and any Fees prepaid for the remainder of their term.

7. Security

7.1 Measures. Finic will implement and maintain the technical and organizational measures in Annex 2. Finic may update them, provided updates do not materially reduce the overall protection of Customer Personal Data.

7.2 Security Incidents. Finic will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate volume of data affected, the likely consequences and the measures taken or proposed. Finic will take reasonable steps to contain, investigate and remediate the incident, and will provide information Customer reasonably needs to meet its own notification obligations.

7.3 Service incidents affecting banking organizations. If Customer is a banking organization subject to the federal computer-security incident notification rules, Finic will notify Customer's designated contact as soon as possible after determining that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the Services provided to Customer for four or more hours.

8. Assistance and audits

8.1 Data subject requests. If Finic receives a request from an individual to exercise rights over Customer Personal Data, Finic will promptly forward it to Customer and will not respond except to direct the individual to Customer. Finic holds Customer Personal Data only in Saved Requests, Scores and, where Customer has chosen a Retention Period, Stored Requests, which Customer can inspect or delete in the Portal. Finic will provide reasonable assistance for Customer to respond, including deleting Saved Requests, Stored Requests or Scores at Customer's request.

8.2 Assessments. Finic will provide reasonable information and assistance for Customer's data protection impact assessments, vendor risk assessments and consultations with regulators, taking into account the nature of the processing and the information available to Finic.

8.3 Information. On written request, Finic will provide Customer with information reasonably necessary to demonstrate compliance with this DPA, such as responses to security questionnaires and, when available, third-party audit reports under confidentiality.

8.4 Audits. If that information is not sufficient to demonstrate compliance, or if a regulator or a Security Incident requires it, Customer may audit Finic's compliance with this DPA no more than once in any twelve-month period (except after a Security Incident or at a regulator's direction), on at least thirty (30) days' notice, during business hours, at Customer's expense, and under a mutually agreed scope and confidentiality terms. Customer may use a third-party auditor that is not a Finic competitor and is bound by confidentiality obligations.

8.5 Regulators. Finic acknowledges that the Services it performs for Customer may be subject to examination by Customer's regulators, including under the Bank Service Company Act, and will cooperate with such examinations to the extent Laws require.

9. Deletion

When the Agreement ends, or earlier when Customer asks Finic at support@finic.ai to close its account, Finic will within thirty (30) days delete Customer's Saved Requests, Stored Requests, Scores (with their Score Records), API Keys, invitations and organization records, and the accounts of Authorized Users who belong to no other organization, except where Laws require Finic to keep them. Finic keeps no other Input or Output, so there is no other Customer Personal Data to return or delete. Finic keeps Usage Data and billing records as described in Section 3.5.

10. International transfers

Finic stores and processes Customer Personal Data in the United States. Encrypted connections to the Services are received at the nearest Amazon CloudFront location and carried to the United States. To the extent the GDPR or UK GDPR applies to a transfer of Customer Personal Data to Finic, the parties agree to the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, and the UK International Data Transfer Addendum, each incorporated by reference and completed with the details in Annexes 1 to 3, with the governing law and forum of Ireland for the Clauses and of England and Wales for the UK Addendum. Customer will tell Finic before submitting personal data subject to these laws.

11. Changes

Finic will update this DPA only as provided in the Agreement, and will give at least thirty (30) days' notice before any change that reduces the protection of Customer Data, including the commitments in Section 3. A change never applies to requests sent before it takes effect.

12. Liability

Each party's liability under this DPA is subject to the limitations in the Agreement.

Annex 1: Description of processing

Subject matter and purpose. Automated evaluation of the data, context and questions Customer submits, and of the records Customer sends to its Scores, to return probability estimates and scores that support Customer's fraud, risk and compliance decisions; and building and calibrating Scores from the examples and outcomes Customer provides.

Nature of processing. Receiving, analyzing and returning data through the API and the Portal. Processing is in memory for the duration of each request, and for building a Score, for the minutes it takes.

Categories of data subjects. Determined by Customer. Typically Customer's customers and applicants, their counterparties and payees, principals of merchants and business customers, and other individuals named in Customer's records.

Categories of personal data. Determined by Customer. Typically identifiers and contact details, account and transaction records, device, network and session data, identity verification results, and case notes. The Acceptable Use Policy prohibits card numbers, authentication secrets, health information and biometric identifiers.

Sensitive data. Customer should not submit sensitive data unless necessary for its questions. Government identification numbers may be submitted only as the Acceptable Use Policy permits.

Frequency. Continuous, as Customer sends requests.

Retention. Input and Output: under Zero Data Retention, not retained after each request is answered (Section 3.2); otherwise kept as Stored Requests for the Retention Period Customer chooses (Section 3.3). Saved Requests: as described in Sections 3.6 and 9. Scores and their Score Records: until deleted, as described in Sections 3.9 and 9; the examples sent to create a Score are not retained.

Subprocessors. As listed in Annex 3, for hosting, model inference and designing Scores.

Annex 2: Technical and organizational measures

Data retention by design. Under Zero Data Retention, request content is processed in memory and is not written to databases, logs or backups (Section 3.2). Stored Requests are kept only in Finic's encrypted database, for the Retention Period (Section 3.3). Examples sent to create a Score are processed in memory while it is built and are not written to databases, logs or backups; a Score keeps only the information in Section 3.9. Service logs record request metadata only.

Encryption. Connections to the Services over the internet use TLS 1.2 or higher. Between Amazon CloudFront and Finic's servers, traffic stays within Amazon Web Services' private network. Connections from Finic's servers to its database and to Subprocessors use TLS. Databases, server disks and backups are encrypted at rest with AES-256.

Credentials. API Keys are shown once and stored only as SHA-256 hashes, with a short prefix kept so they can be identified. Portal passwords are stored as salted PBKDF2-SHA256 hashes. Sign-in with a password requires a one-time code sent by email. Sessions are stored as hashes, bound to anti-forgery tokens, and expire.

Access control. Finic's servers and database have no public network addresses. Administrative access is limited to authorized Finic personnel, goes through Amazon Web Services' identity and systems management services rather than SSH or other open ports, and is recorded in AWS CloudTrail. Customer organizations are logically isolated, and administrative actions in the Portal are recorded in an audit log.

Network and infrastructure. The Services are hosted in Amazon Web Services' US West (Oregon) region. Only Amazon CloudFront can reach Finic's servers, and only Finic's servers can reach its database. Authentication and API traffic are rate limited, and the Portal uses a strict content security policy.

Secure development. Changes are tested automatically, and dependencies are checked for known vulnerabilities before each release. Releases are versioned, and a release that fails its health checks is rolled back automatically.

Monitoring and incident management. Finic is alerted automatically when the Services become unreachable or return server errors. Finic keeps service logs, which contain no request content, for thirty (30) days, remediates vulnerabilities according to severity, and maintains an incident response process that includes the notifications in Section 7.

Business continuity. The database is backed up automatically, with point-in-time recovery for seven (7) days. Finic's servers restart automatically after a failure.

Personnel. Finic personnel are bound by confidentiality obligations and have access removed promptly when their role ends.

Annex 3: Subprocessors

• Amazon Web Services, Inc.: content delivery (Amazon CloudFront), compute, database and backups for the API and the Portal; and Amazon Bedrock, which runs the Claude model from Anthropic that Finic uses to design Scores (Section 3.9), without retaining data or sharing it with Anthropic. Location: United States.
• Runpod, Inc.: GPU compute for model inference. Location: United States.