Legal
Data processing agreement
Draft for legal review. This page is a plain-language starting point and will be replaced by a counsel-approved version before any customer signs up. Questions: info@alineds.com.
Roles
The customer controls its data and decides how it is used. ALINEDS processes it only to provide the govconagents.ai service and only on the customer's documented instructions, which are the customer agreement, these terms and the customer's settings and approved playbooks.
What data is processed
- Supplier names, contacts, emails and quotes handled for the customer.
- Awards, purchase orders, invoices, registrations and performance records the customer sends to its agents.
- Messages in the one shared mailbox the customer connects, and Teams messages that mention an agent.
- Names and work emails of the customer's staff who use Teams or the dashboard.
- Public government data such as DIBBS and SAM.gov solicitations, awards, entity and NSN data.
What must never be processed
Controlled Unclassified Information, classified information, export-controlled (ITAR or EAR) technical data, and drawings marked with Distribution B to F. The agent refuses and flags files that carry these markings, and the customer agrees not to send them.
Security measures
- One isolated environment per customer: separate server, agent, database, secrets and backups.
- Dashboard sign-in through Cloudflare Access with a one-time code, limited to the customer's email domain.
- Microsoft 365 access through apps created in the customer's own tenant and limited to one shared mailbox; the customer can revoke them at any time.
- Nightly backups encrypted with a key unique to the customer.
- Every agent action recorded with its reason in an activity log the customer can see.
- The 15 basic safeguards of FAR 52.204-21 applied to our own systems.
Subprocessors
We use the following subprocessors. We will give customers 30 days' notice before adding or replacing one.
| Subprocessor | What it does | Location |
|---|---|---|
| Microsoft Azure | Hosts each customer's server, agent and database | United States |
| Cloudflare | Secure tunnel and staff sign-in for the dashboard, encrypted backup storage, website | United States and Cloudflare's global network |
| OpenAI (API, business terms) | AI model that reads and writes on the agent's behalf; no training on customer data | United States |
| Stripe | Subscription billing and payments (billing contacts only) | United States |
| Microsoft 365 (ALINEDS) | Support and account email with customers | United States |
People
Only ALINEDS staff and contractors who need access to run the service can reach customer environments, and they are bound by confidentiality.
Security incidents
We will tell the customer without undue delay, and within 72 hours of confirming it, if customer data is accessed without authorisation, and we will help the customer meet its own reporting duties.
Location
Customer environments run in United States data centers. On the Managed plan the AI model also processes data in the United States only.
End of service
When the service ends we export the customer's data and then delete the environment and its backups, and confirm the deletion in writing on request.
Audits
On reasonable notice we will answer the customer's security questionnaires and share our security documentation, including our SOC 2 report once it exists.