Skip to content
TrueNorth Data ShieldMicrosoft 365 sharing review
Draft pending attorney review. Do not rely on this text until it is finalized.

Data Processing Addendum (DPA)

This DPA forms part of the Terms of Service between TrueNorth Data Shield LLC ("Processor" / "Service Provider") and Customer ("Controller" / "Business").

  1. Scope. Processor processes Customer Personal Data only to provide TrueNorth Exposure Scan and related support, on Customer's documented instructions (the Terms, the order form, and Customer's settings). A "review" means a read-only assessment of your Microsoft 365 tenant performed by the Service; earlier documents and authorizations may call this a "scan," and both terms mean the same thing.
  2. Data processed. Categories of individuals: Customer's employees, contractors, guests, and administrators. Data types: names, work email addresses, user principal names, guest account dates, admin role membership, and the names and paths of files and sites along with their sharing metadata. No special-category data is intentionally processed. File names may incidentally reveal sensitive topics, so Processor treats all review data as confidential.
  3. U.S. state privacy laws. Processor will act as a "service provider" or "processor" under the CCPA/CPRA and similar state laws. It will not sell or share Customer Personal Data; will not retain, use or disclose it outside the direct business relationship or for any purpose other than the Service; will not combine it with other data except as those laws permit; will notify Customer if it can no longer meet its obligations; and will allow Customer to take reasonable steps to stop unauthorized use.
  4. Confidentiality. Everyone with access is bound by confidentiality and has had security training.
  5. Security measures (Annex A). These include read-only Microsoft Graph permissions with admin consent; review tool runtime credentials held in Azure Key Vault; other credentials stored outside Key Vault; multi-factor authentication required on all administrator accounts; least privilege; separation of each tenant's data; a record of each Customer authorization and each review (tenant and time), with Processor's platform providers keeping their own logs for limited periods; vulnerability patching within 30 days (critical issues within 7); encrypted backups; and an annual review of these controls. Data is encrypted in transit using TLS 1.2 or higher. Data stored in our Azure environment and with our database provider is encrypted at rest. Review findings and personal details in our review database get an extra layer of application-level encryption.
  6. Subprocessors. Customer authorizes the subprocessors listed in Annex B and at truenorthdatashield.com/subprocessors as of signing. Processor gives 30 days' notice of new subprocessors, and Customer may object on reasonable grounds. Processor passes equivalent obligations on to subprocessors and remains liable for them.
  7. Breach notification. Processor will notify Customer promptly, and in any event within 72 hours of discovery of a Security Incident affecting Customer Personal Data. The notice will include the facts known, the likely impact, and the remediation steps. Processor will help Customer meet its own notification duties, such as HRS Chapter 487N.
  8. Assistance. Processor will help Customer respond to individuals' privacy requests and with reasonable security or assessment requests.
  9. Retention and deletion. Review data is kept for 90 days by default and deleted by a daily purge. After services end, or when the Customer asks in writing, Processor deletes Customer Personal Data from its active systems within 30 days and confirms the deletion in writing on request. Processor keeps a minimal record of the Customer's authorization to review, showing dates, scope and a one-way hashed tenant identifier with no personal details, for 7 years after the services end, as proof of authorization. Backups expire within 14 days after deletion. This does not apply to data Processor must keep by law.
  10. Audits. On request, once a year, Processor will provide its security documentation and answer a reasonable questionnaire. If a SOC 2 or penetration-test summary exists, Processor will provide it under NDA.
  11. Location. Data is processed and stored in the United States.
  12. Precedence. For data-protection matters, this DPA controls over the Terms.

Signed: TrueNorth Data Shield LLC __ Customer __ Date ______