Data Processing Addendum

DATA PROCESSING ADDENDUM

The undersigned customer ("Customer") and ("Tied LLC"), a Delaware corporation ("Tied" or "Provider") (each a "Party," together the "Parties"), enter into this Data Processing Addendum (including its Annexes, this "DPA") as of the date signed by both Parties. This DPA forms part of the agreement between the Parties governing Customer's access to and use of the Services, including any order form, online subscription terms, or master services agreement (as amended, the "Agreement").

1. Definitions

Capitalized terms not defined here have the meanings in the Agreement.

• "Affiliate," "Controller," "Processor," "Data Subject," "EEA," "FADP," "FDPIC," "GDPR," "Restricted Transfer," "SCCs," "State Privacy Laws," "Supervisory Authority," and "UK Transfer Addendum" have the meanings customary under Applicable Data Protection Laws and as used in the standard definitions set out in Annex 6 (Standard Definitions), which mirror the market-standard formulations.

• "Applicable Data Protection Laws" means the privacy, data protection, and data security laws applicable to Tied's Processing of Personal Data under the Agreement, including, as applicable, the State Privacy Laws and the GDPR.

• "Channels" means the communication channels through which the Services send, receive, or process communications, including messaging channels (Apple Messages for Business, Google RCS, WhatsApp, Instagram, Facebook Messenger, SMS/MMS, email, web chat), voice channels (telephony, call audio, recordings, and transcripts), and any video or other channels Tied later supports.

• "Connected Systems" means third-party systems, applications, or services that Customer connects to the Services (e.g., payment, commerce, authentication, ticketing, CRM, or communication systems), whether via Tied's integration layer or Customer-supplied credentials.

• "Conversation Data" means the contents and metadata of communications processed through the Services on Customer's behalf across any Channel, including message content, attachments, call audio and transcripts, and interaction events.

• "Customer Data" means information provided or made available by or on behalf of Customer to Tied for Processing on Customer's behalf to perform the Services, including Conversation Data.

• "Customer LLM Provider" means a large-language-model or other AI-model provider with which Customer maintains its own commercial relationship and whose services the Customer directs Tied to use via Customer-supplied credentials or keys ("BYOK").

• "De-identified Data" means data derived from Customer Data that (i) cannot reasonably be used to identify or be linked to any Data Subject, Customer, or Customer's end users; (ii) satisfies the de-identification standards of applicable State Privacy Laws (including Cal. Civ. Code §1798.140(m)); and (iii) Tied maintains and uses subject to the no-re-identification commitments in this DPA.

• "Information Security Incident" means a breach of Tied's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Tied's possession, custody, or control. It excludes unsuccessful attempts or activities that do not compromise Personal Data (e.g., unsuccessful log-in attempts, pings, port scans, denial-of-service attacks not resulting in compromise).

• "Personal Data" means Customer Data that constitutes "personal data," "personal information," or similar terms defined in Applicable Data Protection Laws; it excludes information pertaining to Customer's business contacts who are Customer personnel acting in their business capacity to administer the Agreement, and information Tied collects or generates independently of the Services.

• "Process/Processing," "Subprocessors": customary meanings; Subprocessors means Tied's Affiliates and third parties Tied engages to Process Personal Data in relation to the Services — subject to the BYOK carve-out in Section 8(e).

2. Duration, Scope, and Roles

(a) This DPA remains in effect so long as Tied Processes Personal Data, notwithstanding expiration or termination of the Agreement.

(b) Processing subject to the GDPR is additionally governed by Annex 2 (European Annex). Processing subject to State Privacy Laws is additionally governed by Annex 3 (State Privacy Laws Annex).

(c) Roles. For Personal Data Processed to provide the Services, Customer is the Controller (or a Processor on behalf of a third-party Controller) and Tied is a Processor. Notwithstanding the foregoing, the Parties acknowledge that Tied acts as an independent Controller of: (i) account, billing, and administrative data of Customer's personnel; (ii) usage, telemetry, and security data about the operation of the Services; and (iii) De-identified Data, including De-identified Data used for model improvement under Section 10.

3. Customer Instructions

Tied will Process Personal Data only in accordance with Customer's documented instructions, including this DPA, the Agreement, applicable order forms, Customer's configuration of the Services (including approval thresholds, routing rules, retention settings, and flow and agent configurations), and other written instructions consistent with the Agreement. Instructions outside the scope of the Services require a mutually executed amendment. By entering into this DPA, Customer instructs Tied to Process Personal Data to provide the Services — including to operate AI agents, execute Authorized Agent Actions (Section 7), transmit communications across Channels, and perform Tied's other obligations and rights under the Agreement. Processing details are described in Annex 1.

4. Security

(a) Tied Security Measures. Tied will implement and maintain the technical and organizational measures described in Annex 4 ("Security Measures"), taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of Processing and risks to Data Subjects. Tied may update the Security Measures so long as updates do not materially decrease overall protection.

(b) Personnel. Tied ensures personnel authorized to access Personal Data are bound by appropriate confidentiality obligations.

(c) Information Security Incidents. Tied will notify Customer without undue delay after becoming aware of an Information Security Incident, describing (to the extent then known) its nature, the categories and approximate volume of affected Personal Data, mitigation steps taken, and recommended Customer actions, and will supplement as information develops. Notification is not an admission of fault. Tied will reasonably cooperate in Customer's investigation. Customer is responsible for its own legal notification obligations; if a Customer notification refers to or identifies Tied, Customer will (where legally permitted) notify Tied in advance and consider Tied's reasonable corrections.

(d) Customer Security Responsibilities. Customer is responsible for: appropriate use and configuration of the Services (including approval thresholds and access controls); securing its own credentials, systems, and devices, including credentials for Connected Systems; and backing up Personal Data where appropriate. Customer confirms it has evaluated the Services and Security Measures and found them adequate for the risk presented by its intended Processing.

5. Data Subject Rights

(a) Tied will provide Customer assistance reasonably necessary and technically feasible for Customer to fulfill Data Subject requests (access, deletion, correction, portability, objection, and similar) with respect to Personal Data in Tied's possession or control, including through self-service tooling where available. Assistance requiring work beyond the Services is chargeable at Tied's then-current professional services rates, with a good-faith estimate on request.

(b) If Tied receives a Data Subject request directly, it will promptly notify Customer (unless legally prohibited) and direct the Data Subject to Customer. Customer is solely responsible for responding unless applicable law requires otherwise.

6. Customer Responsibilities

(a) Notices and consents generally. Customer will ensure it has provided all notices and obtained all consents and rights required under Applicable Data Protection Laws for Tied to Process Personal Data as contemplated by the Agreement, and that a valid legal basis exists throughout the term (including under GDPR Articles 6, 9(2), and 10 where applicable).

(b) Channel consents — outbound messaging. As between the Parties, Customer is solely responsible for obtaining, recording, and maintaining evidence of all consents and authorizations required for communications initiated to Data Subjects through the Services — including business-initiated and proactive outbound messages across SMS/MMS, RCS, Apple Messages for Business, WhatsApp, or any other Channel — as required by the Telephone Consumer Protection Act (TCPA), state telemarketing and mini-TCPA laws, CAN-SPAM, CASL (where applicable), CTIA and carrier requirements (including A2P 10DLC registration), and the platform terms and messaging policies of Apple, Google, Meta, and applicable carriers. Customer will honor opt-outs promptly and will not instruct Tied to message Data Subjects for whom required consent does not exist. Tied provides tooling for consent capture, opt-out handling, and message logging, but does not determine whether legally sufficient consent exists for any given recipient.

(c) Channel consents — voice. Where voice Channels are used, Customer is solely responsible for obtaining any consents and providing any notices required for call recording, monitoring, or transcription under federal and state wiretap and communications-privacy laws (including all-party-consent states) and for AI participation in calls where disclosure is required.

(d) AI disclosure. Customer will comply with laws requiring disclosure that Data Subjects are interacting with an automated or AI system (including, where applicable, the California bot-disclosure law and EU AI Act transparency obligations) and will not disable or obscure AI-identification features of the Services where such laws apply.

(e) Restricted Data. Customer represents and warrants that Customer Data will not contain: Social Security numbers or other government-issued identification numbers; protected health information subject to HIPAA or other detailed medical or health-insurance information; biometric identifiers; passwords or credentials for third-party accounts (other than credentials supplied through the Services' designated secure connection mechanisms for Connected Systems); financial-account credentials; tax return data; cardholder data subject to PCI DSS (payment flows in the Services are executed by payment processors and payment platforms — e.g., Stripe, Apple Pay — such that full card numbers are not submitted to or stored by Tied); personal data of children under 16; or other special categories of data ("Restricted Data"), in each case unless and until the Parties execute a written addendum expressly permitting the relevant category. Tied does not currently offer a HIPAA Business Associate Agreement, and nothing in this DPA constitutes one.

7. Authorized Agent Actions

(a) The Services include AI agents that, per Customer's configuration, may execute actions in Connected Systems on Customer's behalf — for example, issuing refunds, modifying subscriptions or orders, unlocking or updating user accounts, or creating records — using OAuth grants, API keys, or other credentials supplied or authorized by Customer ("Authorized Agent Actions").

(b) Customer instructs and authorizes Tied to execute Authorized Agent Actions in accordance with Customer's configuration, including any approval thresholds, pre-action confirmation windows, approval chains, and blocked-action rules Customer configures. Tied will log Authorized Agent Actions, including the triggering conversation, the authorization relied upon, and the action taken, and will make such logs (including signed action receipts, where offered) available to Customer.

(c) Customer is responsible for the accuracy and appropriateness of its configurations, policies, and Connected System permissions (including least-privilege scoping of credentials). This Section addresses the data-processing dimension of Authorized Agent Actions; allocation of commercial liability for erroneous actions is addressed in the Agreement.

8. Subprocessors

(a) Authorization. Customer authorizes engagement of Tied's Affiliates as Subprocessors and generally authorizes Tied to engage third-party Subprocessors per this Section 8.

(b) Subprocessor list. Current Subprocessors, their functions, and locations are listed in Annex 5 and at [CONFIRM: tied.com/legal/subprocessors — page must be created] (the "Subprocessor Site").

(c) Flow-down. Tied will bind each Subprocessor by written contract to data protection obligations no less protective than this DPA (to the extent applicable to the Subprocessor's services), including the model-training restrictions in Section 10(f), and remains liable for Subprocessors' acts and omissions to the same extent as for its own.

(d) Changes; objection. Tied will give Customer at least 15 days' notice of new Subprocessor engagements (via the Subprocessor Site plus written notice, including email, to Customer's designated contact). If Customer objects within 15 days on reasonable data-protection grounds, the Parties will work in good faith toward resolution; failing resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement upon written notice and pay amounts due and owing through termination.

(e) BYOK carve-out. Where Customer elects BYOK and directs Tied to route inference or other AI processing to a Customer LLM Provider using Customer-supplied keys, that Customer LLM Provider is not a Subprocessor of Tied. It acts under Customer's own agreement with that provider, its Processing is Customer's own documented instruction, and Customer is responsible for the adequacy of its contract with that provider (including any transfer mechanism). Tied's responsibility in BYOK mode is limited to transmitting data to the Customer LLM Provider as instructed and safeguarding Customer's keys per the Security Measures. Where Customer instead uses Tied-contracted model providers, those providers are Subprocessors and are listed in Annex 5.

(f) Channel platforms. Apple, Google, Meta, telecommunications carriers, and equivalent communication platforms are independent services necessary to deliver communications over their networks, acting under their own terms; they are not Subprocessors of Tied except to the extent Applicable Data Protection Laws treat any Tied-engaged messaging service provider as one, in which case it is listed in Annex 5.

9. Audits

Customer may audit Tied's compliance with this DPA up to once per year (plus as required by Applicable Data Protection Laws or a competent Supervisory Authority, on written request with reasonable detail). Tied will contribute reasonably necessary information and assistance. Third-party auditors must be independent, must not be Tied competitors, and must execute a customary NDA. Customer must submit a proposed audit plan at least two weeks in advance; the Parties will agree a final plan; audits occur during business hours, subject to Tied's safety and security policies, without unreasonable interference. If the controls at issue are addressed in a then-current SOC 2, ISO 27001, or similar third-party audit report obtained by Tied within the prior 12 months (if and when Tied holds such reports), Customer agrees to accept such report in lieu of auditing those controls, absent known material changes. Customer bears audit costs and will reimburse Tied's reasonable, documented internal time at then-current professional services rates. Customer will share resulting audit reports with Tied (unless legally prohibited) and use them only for compliance purposes.

10. Artificial Intelligence, Model Training, and Automated Processing

(a) Baseline prohibition. Tied will not use Personal Data to train, fine-tune, develop, or improve any artificial-intelligence or machine-learning model, whether Tied's or a third party's, except (i) as reasonably necessary to provide the Services per Customer's documented instructions (e.g., in-context inference, retrieval, per-tenant knowledge-base learning that remains within Customer's environment), and (ii) as expressly permitted by this Section 10.

(b) Tenant-scoped learning. The Services include per-tenant learning (e.g., knowledge-base entries generated from resolved conversations, resolution-pattern memory scoped to Customer). Such learning uses identifiable Customer Data only within Customer's environment and for Customer's benefit, and is deleted or returned per Section 11 upon termination.

(c) Cross-tenant model improvement — Self-Serve Plans. For Customers on self-serve plans [CONFIRM: define plan names — e.g., Starter, Business, Advanced], Customer grants Tied a non-exclusive, worldwide, royalty-free license to use Conversation Data to develop, train, fine-tune, and improve Tied's models and the Services, subject to all of the following conditions: (i) no Conversation Data enters any cross-tenant training corpus, evaluation set, or derived model unless it has first been converted to De-identified Data (with pseudonymization applied as an interim safeguard during processing); (ii) raw, identifiable Conversation Data remains scoped to Customer's tenant at all times; (iii) Tied will not attempt to re-identify De-identified Data and will contractually prohibit recipients from doing so; (iv) Tied will not use Restricted Data for these purposes in any form; and (v) Conversation Data of Data Subjects located in the European Economic Area, the United Kingdom, or Switzerland is excluded from any cross-tenant training corpus, evaluation set, or derived model unless and until the Parties agree otherwise in writing following Tied's completion of a European-law compliance review.

(d) Cross-tenant model improvement — Enterprise Plans. For Customers on enterprise plans, no Conversation Data will be used under Section 10(c) unless Customer expressly opts in in writing (including via order form). [CONFIRM: enterprise default and whether an isolated/fine-tune-only tier will be offered — Legal Review Checklist, Item 1.]

(e) Forward-looking effect of choices; no un-training. Where Customer opts out (where available), terminates, or its plan otherwise ceases to permit use under this Section, Tied will stop incorporating Customer's Conversation Data into training going forward. Customer acknowledges that trained models cannot be reversed or "un-trained": opt-out and deletion obligations apply prospectively and do not require Tied to delete, retrain, or degrade models already trained using De-identified Data, nor to delete De-identified Data itself. Tied will not represent to Data Subjects or Customer that deletion propagates into previously trained models.

(f) Subprocessor and provider restriction. Tied prohibits its Subprocessors — including Tied-contracted AI model providers — from using Personal Data or Conversation Data for their own model training, fine-tuning, development, or improvement, except as expressly authorized by Customer in writing. In BYOK mode, the Customer LLM Provider's training practices are governed by Customer's own agreement with that provider, and Customer is responsible for configuring them.

(g) Automated decision-making. If the Services involve automated decision-making producing legal or similarly significant effects on Data Subjects, Tied will disclose its existence to Customer, provide meaningful information about the logic involved to the extent reasonably available (without disclosing trade secrets), and reasonably cooperate with Customer as required by Applicable Data Protection Laws to enable Data Subjects to exercise related rights.

11. Return, Deletion, and Retention

(a) Upon cessation of Services involving Processing of Personal Data ("Cessation Date"), Tied will promptly cease Processing except for storage and Processing needed to effect return, deletion, or anonymization, or as otherwise permitted or required by this DPA or law.

(b) Within 30 days after the Cessation Date (the "Post-cessation Storage Period"), Customer may request in writing, and Tied will within a commercially reasonable period (to the extent technically feasible): (i) return a complete copy of Personal Data by secure transfer and then delete or anonymize remaining copies; or (ii) delete or anonymize all Personal Data in Tied's possession. Absent instruction, Tied will delete or anonymize Personal Data within a commercially reasonable time after the Post-cessation Storage Period.

(c) In-service retention. During the term, Conversation Data is retained on a two-tier schedule: 12 months in active storage, followed by 24 months in archive storage, after which it is deleted or anonymized — except that Customer may configure a shorter retention window for its tenant, down to a minimum of 90 days, in which case Conversation Data is deleted or anonymized at the configured window. Account, billing, and audit records are retained as required for legal, tax, and security purposes.

(d) Carve-outs. Tied may retain Personal Data as required or permitted by law (confidentially, protected per the Security Measures, only for the legally specified purpose, and deleted when no longer required). For clarity, deletion obligations do not apply to De-identified Data or to models trained in accordance with Section 10, per Section 10(e).

12. Data Residency

By default, the Services are hosted and Personal Data is Processed in the United States [CONFIRM: hosting provider and region(s)]. Where Customer purchases a regional deployment option (if and when offered — e.g., EU or APAC processing regions or Customer-VPC deployment), Tied will Process Personal Data in the contracted region except as necessary to deliver communications over Channels, as directed by Customer (including BYOK routing), or as otherwise agreed.

13. Miscellaneous

Except as modified here, the Agreement remains in full force. Tied's access to Personal Data is not part of the consideration exchanged under the Agreement. Notices under this DPA may be given per the Agreement's notice clause, to Customer's Annex 1 data-protection contact, to Tied's primary points of contact with Customer, or to any email Customer designates for Services communications; Customer is responsible for keeping such addresses valid. Tied will cooperate in good faith on amendments reasonably necessary for compliance with Applicable Data Protection Laws and may, on written notice, vary this DPA solely to the extent necessary to maintain such compliance (including varying or replacing the SCCs per Annex 2), provided variations do not materially reduce protections or materially increase Customer's obligations without Customer's written agreement. To the extent permitted by Applicable Data Protection Laws and the SCCs, each Party's total aggregate liability under or in connection with this DPA and the SCCs is subject to the limitations, caps, and exclusions in the Agreement (without affecting liability to Data Subjects under the SCCs' third-party beneficiary provisions). In case of conflict: this DPA prevails over the Agreement; the SCCs prevail over both as to the Restricted Transfers they govern.

Signature blocks: [Customer] / [Tied entity] — By / Name / Title / Date.

Annex 1 — Data Processing Details

Provider / Data Importer: [CONFIRM: Tied legal entity]; address [CONFIRM]; data-protection contact [CONFIRM: role + privacy@tied.com]. Activities: provision of a customer-communication and AI-orchestration platform enabling businesses to deploy AI agents across messaging, voice, and other Channels, execute Authorized Agent Actions in Connected Systems, and manage related knowledge bases, flows, and analytics. Role: Processor (or Subprocessor, as applicable), and independent Controller solely as described in Section 2(c).

Customer / Data Exporter: the counterparty to the Agreement; address and data-protection contact as designated by Customer. Activities: use and receipt of the Services in its business operations. Role: Controller or Processor (as applicable).

Categories of Data Subjects: Customer's end users, customers, and prospects who communicate with or are contacted through the Services; Customer's personnel (employees and contractors), including personnel using internal-facing agent features (e.g., "Tied for Teams"); delivery, logistics, vendor, and other third-party participants in multi-party conversations; and Customer's other business contacts.

Categories of Personal Data: personal details and contact information; channel identifiers (phone numbers, messaging handles, email addresses); authentication and identity-attestation details (e.g., platform-attested identity signals); Conversation Data across all Channels, including message content, attachments, call audio, recordings, and transcripts; transaction and order details processed in conversations (excluding full cardholder data); records and content retrieved from or written to Connected Systems in the course of Authorized Agent Actions; technological details (IP addresses, device identifiers, approximate location); and interaction and engagement data.

Sensitive data: None permitted — Restricted Data must not be submitted absent a written addendum (Section 6(e)). Additional safeguards: N/A.

Frequency: ongoing, as initiated by Customer's use of the Services. Nature and purpose: operations required to provide the Services and perform Tied's obligations per the Agreement, this DPA, and Customer's instructions, including the AI processing described in Section 10. Duration/retention: per the Agreement and Sections 10–11. Transfers to Subprocessors: per Annex 5 / the Subprocessor Site.

Annex 2 — European Annex

1. Processing. Tied will inform Customer if, in its reasonable opinion, an instruction infringes the GDPR. Customer's instructions must comply with the GDPR and applicable law.

2. DPIAs and prior consultation. Tied will provide reasonable assistance (at Customer's cost, at then-current professional services rates) with data protection impact assessments and Supervisory Authority consultations under GDPR Articles 35–36, solely regarding Tied's Processing.

3. Restricted Transfers. For EU Restricted Transfers, the Parties comply with the SCCs, deemed populated per Attachment 1 Part 1 and incorporated by reference. For UK Restricted Transfers, the SCCs as varied by the UK Transfer Addendum, populated per Part 2, apply. For Swiss Restricted Transfers, the SCCs as varied per Part 3 (GDPR read as FADP; supervisory authority read as FDPIC; Swiss Data Subjects retain rights to proceed in Switzerland) apply. Tied may, on notice, replace the SCCs with successor clauses or another valid transfer mechanism that does not materially diminish safeguards. On documented request from a Supervisory Authority, Data Subject, or onward Controller, Tied will provide executed full-form SCCs. Operational clarifications: Customer will protect Tied's confidential information when meeting SCC transparency obligations; Customer is responsible for notifications to third-party controllers and Data Subjects under SCC Clauses 10(a) and 15.1(a); Section 8 governs Subprocessor engagement and Section 9 governs audits under the SCCs; deletion certifications are provided on written request.

Attachment 1 (population of the SCCs): Module Two applies where Customer is a Controller; Module Three where Customer is a Processor. Clause 7 (docking) not used; Clause 9 Option 2 (general written authorization, 15-day notice); Clause 11 optional language not used; Clause 13 all text retained; Clause 17 Option 1 — law of Ireland; Clause 18 — courts of Ireland. Annex I populated from Annex 1 (Customer = exporter; Tied = importer); competent Supervisory Authority determined per the standard cascade (Member State of establishment; else of the Article 27 representative; else notified by Customer). Annex II populated by reference to Section 4 and Annex 4. UK Transfer Addendum: Tables 1–3 deemed populated from Annex 1 and this Attachment; Table 4 "Importer" ticked; Mandatory Clauses apply.

Annex 3 — State Privacy Laws Annex

Terms have the meanings in the applicable State Privacy Laws. The Parties intend that Tied is a service provider, contractor, and/or processor. Tied: (a) acknowledges personal information is disclosed only for the limited and specified purposes in the Agreement; (b) will comply with applicable State Privacy Law obligations and provide the same level of privacy protection they require; (c) grants Customer the right to take reasonable and appropriate steps to ensure Tied's Processing is consistent with Customer's obligations; (d) will notify Customer if it determines it can no longer meet its obligations; and (e) grants Customer the right, on notice, to take reasonable steps to stop and remediate unauthorized use.

Tied will not: sell or share personal information; retain, use, or disclose it other than to provide the Services or as otherwise permitted by the State Privacy Laws; retain, use, or disclose it outside the direct business relationship; or combine it with personal information from other sources except as permitted by the State Privacy Laws and necessary to provide the Services. For clarity, Tied's use of De-identified Data as described in Section 10 is use of data that has been de-identified in accordance with the State Privacy Laws' standards and is accompanied by Tied's public commitment not to re-identify it; such data is not "personal information" under those laws. Notice of Subprocessor engagements per Section 8 satisfies notice-and-objection requirements; audits per Section 9. Tied certifies it understands and will comply with these obligations.

Annex 4 — Security Measures

Tied maintains an information security program including, at minimum:

1. Governance: assigned security ownership; documented policies; periodic risk assessment; personnel confidentiality obligations and security training.

2. Encryption: industry-standard encryption for Personal Data in transit over public networks and at rest.

3. Tenant isolation: logical segregation of Customer Data; per-tenant scoping of credentials, tools, and agent runtime access, including a per-tenant gateway through which agent tool calls to Connected Systems are routed.

4. Access control: role-based, least-privilege access on a need-to-know basis; unique IDs; multi-factor authentication for administrative access; prompt revocation on role change or termination; password controls consistent with industry standards (hashed and salted storage, complexity, reuse prevention).

5. Credential and key custody: secrets management for Customer-supplied credentials and BYOK keys, encrypted at rest, access-logged, and never written to plaintext logs.

6. Logging and traceability: event logging of user access and system activity; logging of Authorized Agent Actions including triggering context and authorization relied upon, with tamper-evident action receipts where offered.

7. Application and change management: secure development practices; testing and approval of material changes; separation of environments.

8. Network security: firewalls, segmentation, and intrusion detection/prevention appropriate to the architecture.

9. Vulnerability management: scanning, patching, and threat monitoring; [CONFIRM: penetration testing cadence — noted as a current gap; once the first pen test is complete, reference "at least annual third-party penetration testing"].

10. Physical/environmental security: provided through Tied's cloud infrastructure provider(s) [CONFIRM: provider], which maintain industry-standard physical controls.

11. Incident management: documented procedures to investigate, respond to, mitigate, and notify per Section 4(c).

12. Resilience: backup, business continuity, and disaster recovery procedures.

Annex 5 — Subprocessors

Customer approves the following Subprocessors: [CONFIRM entire table — names, locations, and whether each is engaged for all customers or only specific features. Working list assembled from internal documentation; verify before publication.]

Customer LLM Providers used in BYOK mode are not Subprocessors (Section 8(e)). Apple, Google, Meta, and telecommunications carriers act as independent communication platforms (Section 8(f)).

Annex 6 — Standard Definitions

[Retain the market-standard definitions from the source template for: Affiliate; Controller; Processor; Data Subject; EEA; FADP; FDPIC; GDPR (EU and UK); Restricted Transfer (EU/UK/Swiss); SCCs (Decision (EU) 2021/914); State Privacy Laws; Supervisory Authority; UK Transfer Addendum. Reproduced from template without substantive change — counsel to confirm currency of instruments cited.]