Data Processing Addendum (DPA)
This Data Processing Addendum (“DPA”) is between Zerobyte Technologies Private Limited (“Shlix”, “we”) and the insurance agency that uses Shlix IBS (the “Agency”). It forms part of our terms of service and applies automatically whenever we process Agency Personal Information, whether or not a separate copy is signed. We countersign a copy on request.
Insurance agencies are financial institutions under the Gramm-Leach-Bliley Act (“GLBA”). For insurance licensees, GLBA's privacy and safeguards requirements are applied by state insurance laws and regulations, and many states (those adopting the NAIC Insurance Data Security Model Law, and New York under 23 NYCRR Part 500) require an agency to oversee the third-party service providers that hold its customers' information. This DPA sets out the commitments we make so the Agency can meet those duties.
1. Definitions
- Agency Personal Information: personal information, including nonpublic personal information under GLBA, that we process for the Agency in providing the service, such as the Agency's customers' names, contact details and policy information, email content, documents and the Agency's users' account details.
- Data Protection Laws: the laws that apply to that processing, including GLBA and the state insurance privacy and data-security laws based on it, the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws to the extent they apply, and India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).
- Security Incident: unauthorized access to, or acquisition, disclosure, alteration, loss or destruction of, Agency Personal Information in our or our sub-processors' systems. Unsuccessful attempts that do not compromise security, such as blocked log-in attempts or port scans, are not Security Incidents.
- Sub-processor: a third party we engage that processes Agency Personal Information.
2. Roles and instructions
2.1 The Agency decides what Agency Personal Information is processed and why. We are its service provider (a “processor” or “service provider” under Data Protection Laws) and process Agency Personal Information only to provide the service described in the terms and the Agency's order, and on its documented instructions. The terms, the order and the Agency's configuration of the service are its complete instructions.
2.2 We tell the Agency if we believe an instruction breaks Data Protection Laws, and may decline to follow it.
2.3 The details of the processing are in Annex 1.
3. Service-provider commitments (CCPA and similar laws)
We will not: sell or share Agency Personal Information (as those terms are defined in the CCPA); retain, use or disclose it for any purpose other than the business purposes in this DPA, including any commercial purpose other than providing the service, or outside our direct business relationship with the Agency; combine it with personal information we receive from anyone else, except as Data Protection Laws allow for a service provider; or use it to train AI models. We comply with the obligations Data Protection Laws place on service providers, give the same level of privacy protection they require, and notify the Agency if we can no longer meet them. The Agency may take reasonable steps to stop and remedy any unauthorized use. We certify that we understand and will comply with these restrictions.
4. Our people
Everyone at Shlix who can access Agency Personal Information is bound by written confidentiality obligations, is trained on these obligations and on handling insurance customer data, and is given access only as far as their role and the task in hand require. Access is removed when it is no longer needed.
5. Security
5.1 We maintain a written information security program with administrative, technical and physical safeguards appropriate to our size, the nature of the service and the sensitivity of Agency Personal Information, designed to protect its security, confidentiality and integrity, to protect against anticipated threats and against unauthorized access or use. The safeguards in place today are listed in Annex 2.
5.2 We review the program at least once a year and when the service changes in a way that affects security, and we may update the safeguards as long as the overall level of protection does not go down.
5.3 The status of each control, including what is still planned and what we do not hold (such as a SOC 2 report), is published in our trust center.
6. Security Incidents
6.1 We notify the Agency of a Security Incident affecting its data without undue delay and in any case within 48 hours of confirming it, by email to the Agency's owner and any security contact it has given us.
6.2 The notice describes, as far as then known, what happened, when, the categories and approximate number of records and people affected, the likely consequences, what we have done and will do, and a contact for questions. We update it as we learn more.
6.3 We take reasonable steps to contain and investigate the incident and reduce its harm, and give the Agency the information and help it reasonably needs to meet its own notification duties to regulators, customers and carriers. We do not notify the Agency's customers or regulators about the Agency's data on its behalf unless it asks us to or the law requires it.
6.4 Our notice is not an admission of fault.
7. Sub-processors
7.1 The Agency authorizes the sub-processors listed on our sub-processor page. Those that handle Agency Personal Information today are: Supabase, Vercel, Anthropic, Resend, Cloudflare.
7.2 Each sub-processor is bound by a written contract with data-protection obligations no less protective than this DPA, as appropriate to its service. We remain responsible for their performance.
7.3 We give the Agency at least 30 days' notice before adding or replacing a sub-processor that handles Agency Personal Information. If the Agency objects on reasonable data-protection grounds, we will discuss it in good faith; if we cannot resolve the objection, the Agency may end the affected service and receive a refund of fees prepaid for the period after it ends.
7.4 Services the Agency itself connects to Shlix IBS under its own contracts, such as its Microsoft 365 tenant, its agency management system or its phone provider, are not our sub-processors.
8. Location and staff access from India
8.1 Agency Personal Information is stored in the United States.
8.2 Shlix is an Indian company. Our engineering, support and operations staff work from India and access Agency Personal Information remotely, under sections 4 and 5, only when a support request, an operations task the Agency has ordered, or keeping the service running and secure needs it. Access is through the service itself or our administrative tools over encrypted connections; we do not keep copies of Agency Personal Information on staff devices beyond what the task in hand requires.
8.3 If the Agency's contracts with carriers or others restrict access from outside the United States, the Agency tells us before it starts, and we will agree with it in writing how the work is handled.
9. Helping the Agency
9.1 Requests from people. If we receive a request from one of the Agency's customers or users to exercise their privacy rights about Agency Personal Information, we pass it to the Agency within 10 business days and do not answer it ourselves unless the Agency asks us to. We help the Agency respond, including by correcting, exporting or deleting records on its written instruction.
9.2 Assessments and regulators. We give reasonable help with the Agency's risk assessments and with questions from its regulators or carriers about our service.
9.3 Questionnaires and audits. We answer the Agency's security questionnaires, and those of its carriers, once a year and when there is a Security Incident or a material change. If the Agency reasonably needs more to meet its legal obligations, we will make relevant records available, or allow an audit by the Agency or an independent auditor bound by confidentiality, once in any 12 months (and after a Security Incident), on at least 30 days' notice, during business hours and without access to other customers' data. Each party bears its own costs.
9.4 Requests from authorities. If a government authority asks us for Agency Personal Information, we tell the Agency (unless the law forbids it), ask the authority to go to the Agency, and disclose only what the law requires.
10. Return and deletion
For 30 days after the service ends, the Agency may ask us to export its data in a commonly used format. We then delete Agency Personal Information within 90 days after the service ends, by a scheduled process that removes the Agency's accounts, tasks, emails, documents, customer records, support tickets and history, unless the law requires us to keep part of it, in which case we keep it protected and only for that purpose. Backups held by our database provider expire on its own schedule and remain protected under this DPA until they do. We confirm deletion in writing on request.
11. Personal email
Email in the connected mailbox that is clearly personal is read in memory and dropped: nothing about it is stored. Email the service cannot classify with confidence is shown only to the Agency's owner, as its sender and subject, and that entry is deleted once the owner decides.
12. Liability, term and precedence
Each party's liability under this DPA is subject to the limits in section 14 of the terms. This DPA lasts for as long as we process Agency Personal Information. If it conflicts with the terms or an order on anything about personal information or security, this DPA applies, unless a signed agreement says otherwise.
Annex 1: Details of the processing
- Subject matter and duration: providing Shlix IBS and, where ordered, Dedicated Operations Support, for the term of the Agency's plan and until deletion under section 10.
- Nature and purpose: reading the connected service mailbox to sort agency work from personal email; creating, routing and tracking tasks; preparing documents and replies for review from the Agency's records; sending what the Agency approves; reporting; support; and administrative back-office work our staff carry out under an order.
- People concerned: the Agency's customers and prospects, certificate holders and other people named in requests, people who email the Agency, and the Agency's users.
- Categories of information: names and contact details; insured, policy, coverage and certificate details; email content and attachments; documents produced; notes and chat on tasks; account and sign-in records. The service is designed for property and casualty service work and is not intended for health information that would require a HIPAA business associate agreement; we do not sign such agreements.
Annex 2: Security measures in place
- Tenant isolation: every table carries the agency it belongs to and is protected by row-level security enforced in the database, so one agency's records cannot be read by another even through an application error.
- Encryption: HTTPS for all traffic, with HSTS; data encrypted at rest by our database provider in the United States; credentials the Agency gives us for its systems (for example an AMS password) sealed with AES-256-GCM before storage, with the key held only by the server.
- Access control: accounts issued only by the Agency's owner, no public sign-up; role-based access (employee, approver, owner) applied to screens, notifications and reports; owners can switch a user off, which ends their sessions; an optional bot check on sign-in. Multi-factor sign-in is planned and not yet available.
- Four-eyes approval: where approval is required, the person who prepared the work cannot approve it.
- Audit trail: assignments, approvals, sends and setting changes are logged with who and when; a database trigger blocks edits and deletes of the log.
- Data minimization: clearly personal email is never stored; the AI receives only the parts of an email and its attachments that a task needs, up to fixed lengths.
- Least access to systems: Microsoft 365 is reached through Microsoft's Graph API with only the permissions the Agency grants, revocable by it at any time.
- Retention: a daily scheduled job deletes agency data 90 days after offboarding and website contact requests after 24 months.
- Secure development: code review, automated tests (including tests of data isolation and the audit trail), dependency vulnerability checks, and secrets kept out of source code.
- Vulnerability reports: a published disclosure process; reports to business@shlixai.io (see our security page).
Signed copy
This DPA applies without signature. If your agency, its carriers or its regulators need a countersigned copy, ask us and we will send one for signature.