Legal

Data Processing Agreement

Effective October 18, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Tenmore Inc., a corporation incorporated in Ontario (“Tenmore”) and the customer (“Customer”) for the use of Tenmore’s services (the “Service”), including the terms accepted when Customer created its workspace or signed an order form (the “Agreement”). It applies whenever Tenmore processes Customer Personal Data, and it meets the requirements of Article 28 of the EU and UK GDPR, PIPEDA and Quebec’s Law 25. If the DPA and the Agreement conflict on the protection of personal data, the DPA prevails.

1. Definitions

Data Protection Laws: the laws that apply to the processing of Customer Personal Data under the Agreement, including the EU GDPR (Regulation 2016/679), the UK GDPR and Data Protection Act 2018, PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector, and similar provincial laws.
Customer Personal Data: personal data that Tenmore processes on Customer’s behalf in providing the Service, as described in Annex 1.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data (a “confidentiality incident” under Quebec law).
Subprocessor: a third party Tenmore engages to process Customer Personal Data.
“Controller”, “processor”, “data subject” and “processing” have the meanings given in the GDPR.

2. Roles and instructions

2.1 Customer is the controller of Customer Personal Data and Tenmore is its processor (a service provider under Canadian law). Customer is responsible for having a lawful basis for the processing, including informing its people that the Service records their use of it, as described in Annex 1.

2.2 Tenmore processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s configuration and use of the Service (including its settings for retention, integrations and connected services) are Customer’s complete instructions. Tenmore will tell Customer if it believes an instruction infringes Data Protection Laws, unless the law forbids it.

2.3 Tenmore will not sell Customer Personal Data, use it for advertising, use it to train models, or process it for any purpose other than providing, securing and supporting the Service, unless the law requires it, in which case Tenmore will tell Customer first unless the law forbids it.

2.4 Services that Customer connects to the Service (for example, its own accounts with third-party providers, identity providers or monitoring tools) are chosen and contracted by Customer. They are not Subprocessors of Tenmore, and Customer instructs Tenmore to send them the data needed to use them.

3. Confidentiality

Tenmore ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations and has access only to what their role requires.

4. Security

Tenmore implements and maintains the technical and organizational measures in Annex 2, appropriate to the risk. Tenmore may update them, provided the overall level of protection does not decrease.

5. Subprocessors

5.1 Customer authorizes Tenmore to engage the Subprocessors listed in Annex 3.

5.2 Tenmore will give at least 30 days’ notice before engaging a new Subprocessor, by updating Annex 3 and emailing the owners of Customer’s workspace. Customer may object on reasonable data protection grounds within that period; the parties will then work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.

5.3 Tenmore imposes on each Subprocessor, by written contract, data protection obligations no less protective than this DPA, and remains responsible to Customer for its Subprocessors’ performance.

6. Assistance with requests and assessments

6.1 The Service lets Customer’s administrators view, export and delete the information it records, and remove people from a workspace. If Tenmore receives a request from a data subject about Customer Personal Data, it will pass it to Customer without undue delay and will not answer it except on Customer’s instructions. Taking into account the nature of the processing, Tenmore will help Customer answer requests to exercise data subjects’ rights.

6.2 Tenmore will give Customer reasonable information and help for its data protection impact assessments, Quebec privacy impact assessments and consultations with authorities, as they relate to the Service.

7. Personal data breaches

7.1 Tenmore will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, by emailing the owners of Customer’s workspace.

7.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed. Tenmore will update Customer as more becomes known, take reasonable steps to contain the breach and reduce its effects, and keep a record of it.

7.3 Notifying Customer is not an admission of fault. Customer decides whether to notify authorities and individuals, and Tenmore will help it do so.

8. Location and transfers

8.1 Tenmore stores Customer Personal Data in Canada (Amazon Web Services, Canada (Central) region, Montreal). The European Commission recognizes Canada as providing adequate protection for commercial organizations subject to PIPEDA.

8.2 Where Customer Personal Data is transferred to a Subprocessor in a country without an adequacy decision, Tenmore ensures the transfer is protected by the European Commission’s Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies), or another lawful mechanism. For personal information about people in Quebec, Tenmore assesses each transfer outside Quebec before it happens, as Quebec law requires.

9. Access by Tenmore support

9.1 Tenmore support staff can see or change a workspace only when one of its owners grants access, for a limited time chosen by the owner, or in an emergency, for at most 4 hours, with a written reason and immediate email to the owners. All such access is recorded in the workspace’s audit log. Staff never see stored keys for connected services.

9.2 Help assistant. Tenmore’s in-app help assistant may propose changes to a workspace only while its owners grant support access that allows changes, and never under emergency access. Each change runs only after one of Customer’s owners or administrators approves it in the Service, and never with more permissions than that person has. It is recorded in the audit log as made by Tenmore support through the assistant, with the name of the person who approved it. The assistant never deletes data and never receives stored keys or other secrets.

9.3 AI assistance for support staff. While Customer grants support access, Tenmore’s support staff may use an AI assistant to investigate and answer Customer’s request. The assistant works with the staff member’s own access, under the same limits and audit log as in 9.1, and never receives stored keys or other secrets. Its model provider is listed in Annex 3.

10. Return and deletion

During the term, Customer can export the information the Service records. A workspace whose trial or subscription has ended is kept read-only, so its owners can export it or subscribe again, for 30 days after a trial or 90 days after a subscription, and is then deleted. When the Agreement ends, when such a workspace is deleted, or when an owner deletes a workspace, Tenmore deletes Customer Personal Data within 30 days, and from backups within 35 days, unless the law requires it to keep some of it, in which case Tenmore keeps it confidential and processes it only for that purpose.

11. Audits

Tenmore will make available the information needed to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that is not enough, or an authority requires it, Customer (or an independent auditor bound by confidentiality) may audit Tenmore once a year, on 30 days’ notice, during business hours, at Customer’s cost, in a way that does not compromise the security or confidentiality of other customers’ data.

12. General

12.1 This DPA lasts as long as Tenmore processes Customer Personal Data. Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws do not allow them.

12.2 Tenmore may update this DPA to reflect changes in Data Protection Laws or the Service, provided the update does not reduce the protection of Customer Personal Data; it will tell Customer of material changes in advance. Questions about this DPA: privacy@tenmore.com.

By mail:
Tenmore Inc.
145 1/2 Church Street Office 985
Toronto ON M5B 1Y4
Canada

Annex 1: Details of processing

Subject matter and duration	Providing the Service under the Agreement, for its term and until deletion under section 10.
Nature and purpose	Hosting, transmitting, recording and displaying data so that Customer can control and monitor the use of the Service by its people and software. Providing the assistants Customer configures, including those it makes available to visitors of its websites. Answering questions from Customer’s people with Tenmore’s help assistant, and making the workspace changes they approve. Securing and supporting the Service.
Data subjects	Customer’s members and people it invites (typically its employees and contractors); visitors who chat with assistants Customer makes available on its websites (anonymous to Tenmore); and Tenmore support staff acting in Customer’s workspace.
Categories of data	Identity and contact: name, email address, identity-provider identifiers (for example, Microsoft Entra ID), role and group memberships. Usage records: time, settings used, size, cost, duration and outcome of each request, and which of Customer’s rules acted on it; not its content. Audit and security records: changes made in the workspace, with who made them, IP address and browser. Content Customer chooses to save in the Service (for example, test cases, and documents and their earlier versions), for the period it sets or until it deletes it. Content of requests sent through the Service, processed transiently to reach the services Customer has connected, and not stored. Documents Customer stores to build an assistant’s reference texts: kept as uploaded, with the earlier versions Customer chooses to keep, until Customer deletes them and removes deleted items for good, or the workspace is deleted. The text extracted from a document is kept for at most a year after a build last used it. Documents uploaded for a single build only, without storing them, are deleted within a day. Visitors to Customer’s public assistants: messages, processed transiently and not stored; a random visitor identifier in usage records; IP addresses, used only to limit abuse, hashed with a key that changes daily, in counters that expire within hours. Help assistant: questions from Customer’s people, and the workspace information the assistant reads with the asking person’s permissions to answer them. This includes usage records, groups, reference texts and test cases, but never keys or other secrets. All of it is processed transiently and not stored, except changes waiting for approval, kept for 10 minutes.
Special categories	None intended. Customer can configure the Service to block or redact sensitive information.
Retention	Usage records 30 days to 1 year (90 days by default) and audit records 1 to 2 years (1 year by default), as Customer sets; monthly usage totals 2 years; stored documents and other saved content until Customer deletes them; a workspace whose trial or subscription has ended, 30 days (trial) or 90 days (subscription) read-only, then deleted; backups 35 days.

Annex 2: Security measures

Encryption: TLS for all data in transit; data at rest encrypted by the hosting provider; secrets (keys for connected services, sign-in tokens for connected tools, integration credentials, authenticator secrets) additionally encrypted with AES-256-GCM under keys held separately in a managed secret store.
Authentication: passwords stored as bcrypt hashes; two-step verification; single sign-on with Microsoft Entra ID; account lockout after repeated failures; access keys stored only as hashes and revocable.
Access control: roles and permissions within each workspace; production access limited to authorized staff, through single sign-on with multi-factor authentication and time-limited sessions; customer workspaces closed to staff unless access is granted (section 9).
Logging and monitoring: an audit log of every administrative change in each workspace; tamper-evident logging of all actions on the hosting accounts.
Data minimization: request content not stored; error messages cleaned of quoted text and sensitive values; documents uploaded for a single build deleted within a day, and stored documents kept only until Customer deletes them; visitors’ IP addresses kept only as hashes under a daily key; secret fields removed before the help assistant reads workspace information; records deleted automatically at the end of their retention period.
Resilience: managed infrastructure across multiple availability zones; continuous backups with point-in-time recovery, kept 35 days.
Development: automated tests; container images scanned for known vulnerabilities when they are built.
Incidents: Personal Data Breaches are contained, assessed, recorded and reported as described in section 7.

Annex 3: Subprocessors

Subprocessor	Purpose	Location
Amazon Web Services, Inc. (and Amazon Web Services Canada, Inc.)	Hosting, storage, backups and email delivery for the Service	Canada; content delivery network edge locations in North America and Europe (transit only)
Microsoft Corporation	Tenmore’s own email (support and notices); sign-in with Microsoft when Customer’s people choose it	Canada and the United States
OpenAI, L.L.C.	The AI model Tenmore provides during free trials, and the model behind Tenmore’s help assistant. It processes the requests sent to it to produce answers. For the help assistant, these are the questions Customer’s people ask and the workspace information it reads to answer them, never keys or other secrets. Under OpenAI’s API terms, it does not use them to train its models and may keep them for up to 30 days to detect abuse. The trial model is not used once Customer connects its own services, or after the trial. Customer’s administrators can turn the help assistant off	United States
Anthropic, PBC	The AI model behind the assistant Tenmore’s support staff use, only while Customer grants support access to a workspace. It processes the workspace information support reads to answer Customer’s request (settings, records and texts in the workspace, never keys or other secrets). Under Anthropic’s commercial terms, it does not use them to train its models and keeps them only for a limited time	United States

Payments. Stripe (Stripe Payments Canada, Ltd. and its affiliates) processes the billing contact, billing address, tax number and payment details that Customer provides when it buys a paid plan. Tenmore uses that information to bill Customer, as described in its Privacy Policy; it is not Customer Personal Data that Tenmore processes on Customer’s behalf, so Stripe is not a Subprocessor under this DPA.

Last updated October 18, 2026.