This addendum (“DPA”) supplements the terms of service between your firm (“Customer”) and Cohesio (“Processor”), for firms that need a formal data processing agreement to satisfy their own regulatory or client-vendor-review obligations. It applies automatically to every account that processes personal data through Cohesio; a signed, firm-specific PDF copy incorporating the same terms is available on request at hello@cohesio.ai.
Postal address: Cohesio, 9th Floor, Tower D, Unitech Cyber Park, Sector 39, Gurugram, Haryana 122001, India.
1. Roles
Customer is the data controller (or, where applicable local law uses different terminology, the business) for the client personal data it collects and manages through Cohesio. Cohesio acts as data processor (or service provider), processing that data only on Customer’s documented instructions and only to provide the service described in the terms of service, except where otherwise required by law.
2. Processing instructions and scope
Customer instructs Cohesio to process personal data as necessary to: host and display client, engagement and document records; run AI extraction and automations Customer has configured; send notifications and reminders on Customer’s behalf; generate exports and signed decision manifests; and maintain the audit trail the product generates automatically. Processing covers client contact details, uploaded documents, AI-extracted facts, submission and review records, and related audit-trail metadata. Cohesio does not process the sensitive categories explicitly excluded from scope: bank credentials, payment card security codes, medical records, government identity/KYC data, or payroll administration data. Any instruction outside this scope requires a separate written agreement. Cohesio processes personal data on servers located in the United States and does not sell or share client personal data with third parties for their own advertising or marketing purposes.
3. Duration
Processing continues for the duration of Customer’s active subscription, and for the 30-day post-cancellation export window described in the terms of service, after which data is deleted per Section 8 below. Encrypted backups created during the subscription term are retained on a rolling schedule and age out of the backup set within 35 days of the corresponding production deletion; backups are restored only to recover from a verified system failure, never to reinstate an individual customer’s deleted records on request.
4. Subprocessors
Cohesio uses a limited set of infrastructure subprocessors: cloud hosting and storage on Microsoft Azure (US regions), transactional email delivery through Resend, and product analytics through PostHog. Each subprocessor is bound by a written agreement imposing data protection obligations substantially similar to those in this DPA. Cohesio will provide notice of any new subprocessor by updating the published list on the trust & security page at least 10 days before the change takes effect; Customer may object on reasonable data-protection grounds by contacting hello@cohesio.ai within that window.
5. Security measures
Cohesio maintains technical and organizational measures including:
- Encryption of data in transit (TLS) and at rest.
- Logical isolation of each client and engagement’s data within the product.
- Role-based access control for all staff-facing functionality.
- Quarantine and automated malware scanning on every uploaded file before it reaches a reviewer.
- An immutable audit trail recording every consequential action — submission, acceptance, correction request, waiver and close.
- Independent SOC 2 Type II audit currently underway; current status is published on the trust & security page.
- Background checks and signed confidentiality agreements for employees and contractors with access to production data.
- Vulnerability scanning and periodic third-party penetration testing of production systems.
6. Breach notification
Cohesio will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data processed on Customer’s behalf. Notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected (to the extent known), and the measures taken or proposed to address it, and will be updated as further information becomes available.
7. Data subject rights
Cohesio will assist Customer in responding to a verified data subject access, correction, deletion or portability request, to the extent Customer cannot fulfill it directly using the product’s own export and deletion tools. Requests can be initiated by contacting hello@cohesio.ai.
8. Assistance with impact assessments
Where Customer is required by applicable law to carry out a data protection impact assessment, or to consult with a supervisory authority, covering its use of Cohesio, Cohesio will provide the information reasonably necessary to complete it — including the categories of data processed, the subprocessors involved, and the security measures listed in Section 5 — on request at hello@cohesio.ai.
9. Deletion and return of data
Upon termination of the subscription, and after the 30-day export window described in the terms of service, Cohesio will delete Customer’s personal data from production systems in the ordinary course of account cleanup, except to the extent retention is required by law. Customer is responsible for exporting any data it wishes to retain before that window closes.
10. Audits
On reasonable prior written notice, and no more than once per 12-month period absent a specific security concern, Cohesio will make available its then-current SOC 2 report (once available) and respond to a reasonable written security questionnaire in lieu of an on-site audit. Cohesio will reasonably cooperate with a regulator-mandated audit where Customer is legally required to facilitate one.
11. International transfers
Client and engagement data is hosted in US regions with no cross-region replication outside that boundary. Where Customer or its clients are located in the European Economic Area, United Kingdom, or another jurisdiction with its own transfer-restriction regime, the parties agree that Standard Contractual Clauses (or an equivalent transfer mechanism recognized under applicable law) apply to any transfer of personal data to the United States, incorporated into this DPA by reference and available in full on request at hello@cohesio.ai.
12. Liability
Liability under this DPA is subject to the limitations of liability set out in the terms of service, applied separately to each party as if fully restated here.
13. Requesting a signed copy
Firms that need a signed, firm-specific DPA document — for example, to satisfy a client’s own vendor-review process — can request one at hello@cohesio.ai.