Data processing addendum
How Finic processes personal information in the data you send to Grayson.
The Data Processing Addendum is part of the Master Services Agreement. It applies to personal information in the context and questions you send to Grayson, and covers:
- roles: your organization is the controller (or business), and Finic is the processor (or service provider);
- zero data retention: requests are processed in memory and not stored, as described in Zero data retention;
- obligations under the CCPA and the Gramm-Leach-Bliley Act;
- subprocessors, with 30 days' notice before a new one is added;
- security measures, and notice of a security incident within 72 hours;
- audits, regulatory examinations and international transfers.