This addendum supplements the terms of service for firms that need a formal data processing agreement to satisfy their own regulatory or client obligations. It applies automatically to every account; a signed, firm-specific copy is available on request at hello@cohesio.ai.
Roles
Your firm is the data controller for the client personal data you collect and manage through Cohesio. Cohesio acts as data processor, handling that data only on your firm's documented instructions and only to provide the service.
Scope of processing
Processing covers client contact details, uploaded documents, AI-extracted facts, submission and review records, and the audit trail generated by using the product. Cohesio does not process the sensitive categories explicitly excluded from scope: bank credentials, payment card security codes, medical records, KYC data or payroll administration.
Subprocessors
Cohesio uses a limited set of infrastructure subprocessors — cloud hosting and storage in US regions, transactional email delivery, and product analytics. The current list is published on the trust & security page and updated whenever a subprocessor changes.
Security measures
Measures include encryption in transit and at rest, client and engagement isolation, role-based access control, quarantine and malware scanning on every upload, and an immutable audit trail on every consequential action. Our SOC 2 Type II audit is underway; see the trust & security page for current status.
Data subject rights
We support your firm in responding to data subject access, correction and deletion requests from your clients. Contact support@cohesio.ai to initiate a request on behalf of your firm.
International transfers
Client and engagement data is hosted in US regions with no cross-region replication outside that boundary. If your firm requires additional transfer safeguards for regulatory reasons, contact hello@cohesio.ai.
Requesting a signed copy
Firms that need a signed, firm-specific DPA — for example to satisfy a client's vendor-review process — can request one at hello@cohesio.ai.