Data Processing Addendum

Effective date: 2026-10-05 · Version: 2026-10-05

This Addendum forms part of the Terms of Service between Devo Productions LLC ("Processor") and the School ("Controller"). It applies to personal data that the Processor handles on the School's behalf in providing Scriptorium.

1. Scope and roles

• Subject matter and duration: operating the Service for the term of the Terms and the deletion period that follows.
• Nature and purpose: hosting, storing, securing and displaying School Content and account data so the School's Users can plan curriculum.
• Data subjects: the School's staff and other Users. Types of data: names, work emails, roles, credentials (hashed), activity logs, and any personal data the School chooses to include in its content.
• Student data: not intended to be processed. If the School elects to process it, the parties will first agree in writing to supplementary terms, including any required school-official or service-provider designations under FERPA and applicable state student-privacy laws.

2. Processor obligations

The Processor will:

1. process personal data only on the School's documented instructions (these Terms, the Addendum and the School's use of the Service), unless law requires otherwise;
2. ensure personnel with access are bound by confidentiality;
3. implement the security measures in Annex A;
4. assist the School, taking account of the nature of processing, in responding to data-subject requests and in meeting its security, breach-notification and impact-assessment duties;
5. notify the School without undue delay, and within 72 hours where feasible, after confirming a personal-data breach affecting School data, with the information then available;
6. at the School's choice delete or return personal data at the end of the services (see Terms §10), and delete remaining copies within the stated period unless law requires retention;
7. make available information reasonably necessary to demonstrate compliance and allow for audits on reasonable notice no more than once a year (unless a breach requires otherwise), at the School's cost, subject to confidentiality.

3. Subprocessors

The School gives general authorization for the Processor to use the subprocessors listed at /legal/subprocessors. The Processor will give at least 30 days' notice of additions or replacements, during which the School may object on reasonable data-protection grounds. The Processor remains responsible for its subprocessors' performance and will bind them to terms no less protective than this Addendum.

4. International transfers

Data is hosted in the [United States]. Where personal data from the EEA, UK or Switzerland is transferred, the parties incorporate the applicable Standard Contractual Clauses (and UK Addendum), with Module Two (controller to processor), and the details in this Addendum serve as their annexes. [Counsel to confirm.]

5. Liability

Liability under this Addendum is subject to the limitations in the Terms.

Annex A: Security measures

• Isolation: each School's data is separated by database row-level security enforced for the application's database role.
• Access control: role-based permissions; least privilege; administrators can deactivate users immediately; sessions expire after inactivity.
• Authentication: salted memory-hard password hashing (Argon2id), account lockout, rate limiting, optional time-based one-time-password two-step sign-in.
• Encryption: TLS in transit; encrypted backups; [disk/volume encryption at rest on the host].
• Application security: input validation, output sanitization, CSRF protection, strict content security policy, dependency vulnerability monitoring.
• Logging: immutable audit log of security-relevant actions available to School administrators.
• Resilience: automated encrypted backups with periodic restore testing.
• Incident response: documented process for triage, containment, notification and review.
• Assurance status: [Independent penetration test: not yet completed. SOC 2 / ISO 27001: not held.] (Update this line as assurance work is completed; do not overstate.)