# Data Processing Agreement

**Last updated: October 27, 2026**

## TL;DR

When you use Notra to track AI traffic on your website, run a Notra Site or generate content from your connected tools, we process personal data on your behalf. You stay in control of that data and we only use it to provide the Service to you. This agreement sets out the rules required by Article 28 of the GDPR: we follow your instructions, keep the data secure and confidential, announce new sub-processors 14 days before we add one, notify you of a breach within 48 hours, help you answer requests from individuals and delete the data when you leave. Transfers to the United States are covered by the EU Standard Contractual Clauses, with the UK and Swiss adaptations built in.

## 1. Who This Applies To (Scope and Acceptance)

This Data Processing Agreement ("DPA") is between Notra, Inc. ("Notra", "we", "us" or "our") and the customer that has accepted our [Terms of Service](/terms?ntr=wFlqlJXuhxVZV_pn) ("Customer" or "you"). It forms part of the Terms and applies to every plan, including free plans, whenever we process Customer Personal Data in providing the Service.

You accept this DPA when you accept the Terms, and no separate signature is needed. This DPA is concluded in electronic form, which Article 28(9) GDPR expressly allows.

The person accepting this DPA confirms that they are authorised to do so on behalf of the Customer.

## 2. Key Terms (Definitions)

Terms such as "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR. In addition:

- **"Data Protection Laws"** means the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP") and any other data protection law that applies to the processing under this DPA.
- **"Customer Personal Data"** means personal data that we process on your behalf as your processor or sub-processor in providing the Service, as described in Annex I.
- **"Service"** means the Notra products described in the Terms, including GEO AI traffic tracking, Notra Sites, content generation, integrations, Notra Feedback, the API and the MCP server.
- **"Sub-processor"** means any third party we engage to process Customer Personal Data.
- **"SCCs"** means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.
- **"UK Addendum"** means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0.

## 3. Who Does What (Roles of the Parties)

**You are the controller.** For Customer Personal Data, you decide why and how it is processed, and we act as your processor. If you use the Service on behalf of your own clients, for example as an agency, you act as their processor and we act as your sub-processor. In that case you confirm that your clients have authorised our appointment and the terms of this DPA, and you remain our single point of contact for instructions and notices.

**We are the controller of our own business data.** We process some personal data for our own purposes and act as an independent controller for it. This covers account and user profile data needed to run your account, billing and payment records, communications with you, security logs, fraud and abuse prevention, product usage analytics about how your team uses the dashboard and compliance with our legal obligations. Our [Privacy Policy](/privacy?ntr=wFlqlJXuhxVZV_pn) describes that processing, and this DPA does not apply to it.

## 4. What We Do With Your Data (Subject Matter, Nature, Purpose and Duration)

The subject matter of the processing is the provision of the Service to you. The nature and purpose of the processing, the categories of data subjects and personal data, the frequency and the retention periods are set out for each part of the Service in Annex I. The processing lasts for the term of the Terms plus the deletion period in section 16.

You should not send us special categories of personal data under Article 9 GDPR, data about criminal convictions, payment card data, passwords or other authentication secrets, government identifiers or health records. The Service is not designed for that data.

## 5. Following Your Instructions (Documented Instructions)

We process Customer Personal Data only on your documented instructions, including with regard to transfers to third countries. Your instructions are this DPA, the Terms and the way you configure and use the Service, for example which websites you install tracking on, which integrations you connect, which AI engines you select and which retention or privacy settings you enable. Any additional instruction must be agreed in writing and must be consistent with the Terms.

If the law of the EU or an EU Member State requires us to process Customer Personal Data in another way, we will tell you about that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

We will tell you immediately if, in our opinion, an instruction infringes the GDPR or other Data Protection Laws. We may then suspend that processing until you confirm or change the instruction.

## 6. Traffic Insights and Research (Aggregated and Anonymised Data)

You instruct us, through this DPA, to analyse the GEO AI traffic logs we process for you so that we can build and improve the Service and research how AI agents, crawlers and assistants use the web. This covers things like agent and user-agent signatures, crawl patterns, request volumes, the countries requests come from and how accurately we classify them.

Requests made by automated agents and crawlers are generally not personal data. Where a log entry relates to a person, for example a visit referred by an AI assistant, we use it for this purpose only in aggregated or anonymised form, such as counts by country, agent, page or time period, so that no individual visitor can reasonably be identified from the result in line with Recital 26 GDPR. IP addresses are never part of this analysis because we never store them.

Aggregated and anonymised results are not personal data, so this DPA no longer applies to them and we may keep them after you stop using the Service. We do not use Customer Personal Data to train AI models or to build profiles of individuals.

## 7. Your Responsibilities (Controller Obligations)

You are responsible for having a lawful basis for the processing you instruct and for the accuracy of the data you send us. You are also responsible for giving the notices and obtaining any consents your website visitors and users are entitled to. This includes deciding whether your use of AI traffic tracking or Notra Sites visitor analytics requires a consent mechanism under the ePrivacy rules that apply to you, and configuring the consent options we provide for Notra Sites where you need them. You must also make sure you have the right to connect each third-party account and to let us process the data it contains.

## 8. Keeping It Confidential (Confidentiality)

We make sure that everyone we authorise to process Customer Personal Data, including employees and contractors, is bound by an appropriate contractual or statutory duty of confidentiality. Access is limited to those who need it to provide, support or secure the Service.

## 9. Keeping It Safe (Security of Processing)

We implement and maintain the technical and organisational measures described in Annex II to protect Customer Personal Data, as required by Article 32 GDPR. These measures take into account the state of the art and the costs of implementation as well as the nature, scope, context and purposes of the processing and the risks to individuals. We may update the measures over time as long as the overall level of protection does not decrease.

## 10. Our Partners (Sub-processors)

**General authorisation.** You give us a general written authorisation to engage sub-processors. Our current sub-processors are listed at [usenotra.com/subprocessors](/subprocessors?ntr=wFlqlJXuhxVZV_pn), which forms Annex III of this DPA.

**Advance notice.** We will tell you about any intended addition or replacement of a sub-processor at least 14 days before it starts processing Customer Personal Data. We give that notice by updating the sub-processor page, and we also email it to any customer who has asked to be notified by writing to support@usenotra.com. If we must replace a sub-processor urgently to protect the security or continuity of the Service, we may do so with shorter notice, and you keep the same right to object.

**Your right to object.** You may object to a new sub-processor on reasonable data protection grounds by emailing support@usenotra.com within the notice period. We will discuss your concerns in good faith and try to offer a reasonable alternative, such as a configuration that avoids that sub-processor. If we cannot resolve the objection within 30 days, you may terminate the affected part of the Service by written notice, and we will refund any prepaid fees for the period after termination.

**Flow-down and responsibility.** We only use sub-processors that provide sufficient guarantees to protect Customer Personal Data to a standard equivalent to this DPA, and we review their data protection and security terms before we add them. We remain fully liable to you for the performance of each sub-processor's obligations.

**Integrations you enable.** When you connect a third-party service such as GitHub, Linear, Slack or a social publishing account, data flows between Notra and a service that you chose and that you contract with directly. Those services are listed separately on the sub-processor page. Your own agreement with that provider governs how the provider handles your data.

## 11. Helping You With Requests (Data Subject Rights)

Taking into account the nature of the processing, we help you by appropriate technical and organisational measures to respond to requests from individuals exercising their rights under Chapter III GDPR, including access, rectification, erasure, restriction, portability and objection. Many of these can be handled directly in the dashboard or the API. If we receive a request directly from an individual about Customer Personal Data, we will forward it to you without undue delay and will not respond ourselves except to confirm that the request relates to you, unless you authorise us to.

Because we do not store visitor IP addresses and the identifiers we derive from them rotate daily, we often cannot link an individual visitor to the records we hold. Where that is the case, Article 11 GDPR may apply.

## 12. Helping You Comply (Assistance with Articles 32 to 36)

Taking into account the nature of the processing and the information available to us, we help you meet your obligations on security of processing, personal data breach notification, data protection impact assessments and prior consultation with a supervisory authority under Articles 32 to 36 GDPR. This includes giving you the information in this DPA and its Annexes and answering reasonable questions about the Service.

## 13. If Something Goes Wrong (Personal Data Breach)

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it. We will send the notice to the owners and admins of your workspace by email.

The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take to address it and a contact person who can give you more information. Where we cannot provide all of this at once, we will provide it in phases without further undue delay.

We will take reasonable steps to contain and investigate the breach and to reduce its effects, and we will cooperate with you so that you can meet your own notification duties. Our notice of a breach is not an admission of fault or liability.

## 14. Checking Up on Us (Audits and Information)

We make available to you all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and we allow for and contribute to audits, including inspections, by you or an independent auditor you mandate.

To keep this practical for both sides, you agree to first request our current security documentation and, once a year, a completed security questionnaire. You may carry out an on-site or remote audit if that information is not reasonably sufficient to demonstrate compliance, if a supervisory authority requires it or after a personal data breach affecting your data.

An audit requires at least 30 days' written notice, takes place during normal business hours, is limited to the systems and records relevant to the processing of your data and is carried out by persons bound by confidentiality. Audits are limited to once in any 12-month period, except where a supervisory authority requires otherwise or a personal data breach has occurred. You bear the costs of the audit unless it reveals a material breach of this DPA by us. Audits of our sub-processors are carried out through the reports and audit rights those sub-processors make available to us.

## 15. Moving Data Across Borders (International Transfers)

Notra, Inc. is established in the United States, and most of our sub-processors process data in the United States. Annex III shows where each sub-processor processes data.

**15.1 EU Standard Contractual Clauses.** To the extent you transfer Customer Personal Data subject to the GDPR to us, directly or onward, the SCCs are incorporated into this DPA by reference and apply as follows:

- Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor acting for your own clients.
- You are the data exporter and Notra, Inc. is the data importer. Annex I of this DPA completes Annex I of the SCCs, Annex II completes Annex II and Annex III completes Annex III.
- Clause 7 (docking clause) is included.
- Clause 9(a) Option 2 (general written authorisation) applies, with a notice period of 14 days as described in section 10.
- The optional language in Clause 11(a) (independent dispute resolution body) does not apply.
- Clause 13: the competent supervisory authority is determined by Clause 13(a) according to your establishment, as set out in Annex I.C.
- Clause 17: Option 1 applies and the SCCs are governed by the law of the Federal Republic of Germany.
- Clause 18(b): disputes are resolved by the courts of Hamburg, Germany.

Your acceptance of this DPA counts as your signature of the SCCs and of their Annex I. If there is a conflict between the SCCs and this DPA or the Terms, the SCCs prevail.

**15.2 United Kingdom.** For transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. Table 1 of the UK Addendum is completed with the party details in Annex I, Table 2 with the module and clause selections in section 15.1 and Table 3 with Annexes I to III of this DPA. For Table 4, either party may end the UK Addendum as set out in its Section 19.

**15.3 Switzerland.** For transfers subject to the FADP, the SCCs apply with these adaptations: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR are read as references to the FADP where the FADP applies, the term "Member State" does not prevent data subjects in Switzerland from bringing claims where they have their habitual residence and references to the EU and EU law include Switzerland and Swiss law where appropriate.

**15.4 Fallback.** If a transfer mechanism we or our sub-processors rely on is invalidated, suspended or no longer covers a transfer, for example because the Data Privacy Framework adequacy decision is annulled, the SCCs under sections 15.1 to 15.3 apply automatically to that transfer without any further action. If no lawful transfer mechanism is available, we will work with you in good faith on an alternative, and either party may suspend the affected transfer.

**15.5 Article 3(2) GDPR.** Some of our processing may itself be subject to the GDPR under Article 3(2). The European Commission has said it is preparing separate standard contractual clauses for importers in that position, but as of the date of this DPA it has not adopted them. We use the 2021 SCCs in the meantime, and once the new clauses are adopted we will offer them to you and they will replace the SCCs for the transfers they cover.

**15.6 Government access.** Clauses 14 and 15 of the SCCs apply to the laws and practices of the United States. If we receive a legally binding request from a public authority for Customer Personal Data, we will follow Clause 15 of the SCCs. This includes notifying you where we are allowed to, reviewing the legality of the request, challenging it where there are reasonable grounds and disclosing only the minimum information required.

## 16. When You Leave (Deletion and Return)

When the Service ends, or when you delete a workspace, project or site, you can export your data through the dashboard or the API before deletion. Within 30 days after the end of the Service, or after you ask us to delete it, we delete Customer Personal Data from our active systems and instruct our sub-processors to do the same, unless EU or Member State law requires us to keep it. Copies in backups are deleted on the normal backup rotation and remain protected under this DPA until then.

At your request we will confirm the deletion in writing. Aggregated and anonymised data created under section 6 is not personal data and is not affected by deletion.

## 17. Liability (Limitation of Liability)

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA or the Terms limits either party's liability to data subjects under Article 82 GDPR or Clause 12 of the SCCs, or any liability that cannot be limited under applicable law.

## 18. Which Document Wins (Order of Precedence)

For matters of data protection, the documents apply in this order: (1) the SCCs, where they apply; (2) any DPA or order form signed by both parties; (3) this DPA; and (4) the Terms. If you hold a signed DPA or order form with us, its data protection terms prevail over this DPA to the extent they conflict.

## 19. Governing Law and Disputes

This DPA is governed by the law that governs the Terms, which is the law of the Federal Republic of Germany, and disputes about it are resolved as set out in the Terms. Clauses 17 and 18 of the SCCs, which choose German law and the courts of Hamburg, apply to the SCCs and cannot be replaced by the dispute resolution procedure in the Terms. Nothing in this section limits the right of a data subject to bring a claim before the courts of the Member State where they have their habitual residence.

## 20. Changes to This DPA

We may update this DPA to reflect changes in the law, guidance from supervisory authorities or changes to the Service. Changes will not reduce the level of protection for Customer Personal Data. We will tell you about material changes at least 30 days in advance by email or in the dashboard, and the updated DPA applies from the date given in the notice. Changes to the sub-processor list follow section 10 instead.

## 21. Contact

For questions about this DPA, sub-processor objections or audit requests, contact us at:

**Email:** support@usenotra.com

Notra, Inc.<br />
2261 Market Street STE 98632<br />
San Francisco, CA 94114<br />
United States

---

## Annex I: Description of the Processing

### A. List of Parties

**Data exporter:** the Customer, as identified by the name, address and contact email in its Notra workspace and billing details. Role: controller, or processor where the Customer acts for its own clients. Activities: use of the Service as described in section B. Signature and date: by accepting the Terms and this DPA.

**Data importer:** Notra, Inc., 2261 Market Street STE 98632, San Francisco, CA 94114, United States. Contact: support@usenotra.com. Role: processor, or sub-processor where the Customer is a processor. Activities: provision of the Service as described in section B. Signature and date: by making this DPA available and accepting the Customer's acceptance.

### B. Description of the Processing

**Frequency of transfer:** continuous, for as long as the Customer uses the Service.

**Sub-processor transfers:** to the sub-processors listed in Annex III, for the purposes and periods described there.

**Special categories of data:** none intended. See section 4 of this DPA.

#### (a) GEO AI traffic tracking

- **Data subjects:** visitors to the Customer's websites whose requests are sent to Notra through the Notra SDK, a log drain or a Notra Site. Most recorded requests come from automated AI agents and crawlers, but the requests may relate to natural persons, in particular people who open a page from an AI assistant.
- **Categories of personal data:** requested host and path, request method, timestamp, user-agent of AI agents and crawlers (truncated to 200 characters), sanitised referrer, approximate country, preferred language, request ID and the agent, category and purpose we classify from the request. The visitor's IP address is received and used only transiently, in memory, to classify the request and to compute salted journey hashes that rotate daily. It is never stored.
- **Nature of the processing:** receiving request data, classifying the visitor as an AI crawler, an AI assistant referral or an ordinary human visit, grouping requests into journeys, storing and aggregating the recorded events and showing them in dashboards, reports, the API and the MCP server. Ordinary human visits are dropped and not stored. Visitors who arrive through a referral from an AI assistant, such as a link opened from ChatGPT or Perplexity, are recorded as AI referral visits without their user-agent, and are dropped when the visitor has declined consent through the Site's consent mechanism.
- **Purpose:** to show the Customer how AI agents, crawlers and assistants access and refer traffic to its websites, and to keep the tracking secure and free of abuse.
- **Retention:** raw events are kept for 396 days after they are captured and then deleted in monthly batches, so each event is deleted at the latest about one month after that period ends. Daily aggregated rollups are kept for the life of the Customer's project so that long-term trends remain available. Rollups contain counts per page, agent and source and no visitor-level identifiers.

#### (b) Notra Sites visitor analytics

- **Data subjects:** visitors to websites the Customer publishes with Notra Sites.
- **Categories of personal data:** a pseudonymous visitor ID computed as a keyed hash of the IP address and user-agent with a key that changes every day, a session ID, page host and path, timestamp, HTTP status, page index within the session, referrer host and source, AI product where the visitor came from an AI assistant, UTM parameters, approximate country, device type, browser, operating system, request ID and, for engagement, the time a page stayed visible and the scroll depth. The IP address itself is not stored.
- **Nature of the processing:** collecting page views and engagement events from Notra Sites, computing pseudonymous visitor and session identifiers, storing the events and aggregating them into the site analytics shown in the dashboard. Where the Customer has configured a consent mechanism for its Site, page views from visitors who have not consented are not counted as visitors.
- **Purpose:** to give the Customer analytics about visits to its Notra Sites.
- **Retention:** raw page view and engagement events are kept for 90 days after they are captured and then deleted in monthly batches, so each event is deleted at the latest about one month after that period ends. Session state used to link page views expires after 30 minutes of inactivity. Daily aggregated rollups without visitor-level identifiers are kept for the life of the Site.

#### (c) Content generation and integrations

- **Data subjects:** the Customer's team members and other people whose information appears in the data the Customer connects or enters, for example repository contributors, issue authors, Slack message authors, meeting participants and people named in brand material or drafts.
- **Categories of personal data:** names, usernames, email addresses and avatars of contributors and the content of commits, pull requests, issues, messages, meeting notes, search performance data and other data the Customer authorises us to access from connected services such as GitHub, Linear, Slack, Granola, Google Search Console and custom MCP servers. It also includes brand information, writing instructions, prompts, generated drafts, published posts, workspace memory and the content of feedback submitted to the Customer's feedback inbox.
- **Nature of the processing:** retrieving data from connected services, storing it and the content derived from it, sending prompts and context to the AI model providers listed in Annex III to generate drafts, analyse brand visibility and classify feedback and publishing content to destinations the Customer configures.
- **Purpose:** to generate, edit, schedule and publish content and run GEO scans and related analysis for the Customer.
- **Retention:** for as long as the Customer keeps the content, integration or workspace, and then as described in section 16. Retention by AI model providers is described in Annex III.

#### (d) Notra Feedback

- **Data subjects:** people and AI agents that send feedback to the Customer's feedback inbox through the public feedback endpoint, the API, the MCP server or a connected integration, for example the Customer's own users and the agents they work with.
- **Categories of personal data:** the feedback message and any title, category, sentiment and related page URL, submission metadata such as the source, agent or integration name and model, tool version, user-agent, external identifiers and any extra context the sender includes. The sender's IP address is used only as a rate limit key that expires after 10 minutes and is not stored with the feedback.
- **Nature of the processing:** receiving and storing feedback, sending its text, title, related URL and agent context to the AI model providers listed in Annex III to suggest a title, category and sentiment and showing it in the Customer's inbox, the API and the MCP server.
- **Purpose:** to let the Customer collect, triage and resolve feedback about its own products.
- **Retention:** for as long as the Customer keeps the feedback or its workspace, and then as described in section 16.

#### (e) Account users

- **Data subjects:** the Customer's authorised users of the Notra dashboard, API and MCP server.
- **Categories of personal data:** name, email address, profile image, role and permissions within the workspace and activity within the workspace such as authorship of content, approvals and comments.
- **Nature and purpose of the processing:** making the data visible to other members of the same workspace, managing roles and approvals and attributing work inside the workspace. Notra processes account data for its own purposes, such as authentication, billing, security and product analytics, as an independent controller under its Privacy Policy and not under this DPA.
- **Retention:** for as long as the user remains a member of the workspace, and then as described in section 16.

### C. Competent Supervisory Authority

The supervisory authority of the Member State in which the data exporter is established, as determined under Clause 13(a) of the SCCs. Where the data exporter is not established in the EU but falls under Article 3(2) GDPR and has appointed a representative, it is the supervisory authority of the Member State where that representative is established. Otherwise it is the supervisory authority of the Member State where the data subjects whose personal data is transferred are located. For UK transfers it is the Information Commissioner's Office, and for Swiss transfers it is the Federal Data Protection and Information Commissioner.

## Annex II: Technical and Organisational Measures

These are the measures Notra has in place for Customer Personal Data. Several of them are provided by our infrastructure sub-processors, as noted.

**Data minimisation**

- Visitor IP addresses are used only transiently in memory to classify requests and to compute salted, daily-rotating hashes, and are never written to storage or logs.
- Ordinary human visits are dropped from GEO AI traffic tracking. Notra Sites visitor analytics uses pseudonymous identifiers that change every day.
- User-agent strings are truncated before storage and are not stored for AI referral visits, referrers are sanitised and tracking parameters are stripped from stored paths.
- Raw traffic events have fixed retention periods enforced by the database (396 days for AI traffic and 90 days for Sites analytics, deleted in monthly batches once the period ends).
- Product analytics events about AI traffic contain organisation-level classification data only, with no IP address or user-agent.

**Encryption**

- All traffic to and from the Service is encrypted in transit with TLS.
- Data at rest is encrypted by our hosting and database providers.
- OAuth tokens and secrets for connected integrations such as GitHub, Linear and Slack are additionally encrypted at the application level with AES-256-GCM before storage.

**Access control**

- Users sign in through WorkOS AuthKit, which supports single sign-on, and can turn on multi-factor authentication for their account.
- Access within a workspace is governed by roles and scopes, and every data access is checked against the user's organisation.
- API keys are scoped, can be revoked at any time and are verified on every request. Tracking tokens are scoped to an organisation and project and can be rotated.
- Access by Notra personnel to production systems is limited to those who need it and removed when no longer needed.

**AI processing**

- Requests through Vercel AI Gateway and OpenRouter are sent with prompt training disallowed, and a model that no provider there can serve without training fails instead of falling back. Neon AI Gateway, our default gateway, does not offer that setting, so requests through it are covered by the API terms of Neon and the model provider.
- Zero data retention is part of the zero data retention add-on. Workspaces with the add-on are restricted to providers that support it, which excludes models that cannot offer it.
- For OpenAI models, Notra disables response storage by default.
- Some gateways and models cannot provide zero data retention. Neon AI Gateway, our default gateway, may keep prompts for up to 30 days for abuse monitoring, and Annex III marks the others.

**Availability and resilience**

- The Service runs on managed cloud infrastructure with redundancy provided by our hosting providers, and the database provider keeps backups for point-in-time recovery.
- Rate limits protect the ingest endpoints, the API, the public feedback endpoint and public forms against abuse and overload. Where a rate limit is keyed by IP address, the key expires with the rate limit window.

**Logging and monitoring**

- Application and ingest logs are collected centrally to detect errors and abuse. Ingest logs are limited to operational fields such as outcome, identifiers, host, status and latency, and never contain IP addresses, user-agents, raw tokens or secrets.
- Traces of AI requests, which can contain prompts and model output, are sent to the observability providers listed in Annex III to debug and improve AI features.

**Organisational measures**

- Personnel with access to Customer Personal Data are bound by confidentiality obligations.
- Sub-processors are selected for their security and data protection guarantees and are bound by data protection terms as described in section 10.
- Security incidents are handled under an incident response process that supports the 48-hour notice in section 13.
- Changes to production go through code review and automated checks before deployment.

Notra does not currently hold an independent security certification such as SOC 2 or ISO 27001.

## Annex III: Sub-processors

The list of sub-processors, with their purpose, data processed and location, is published at [usenotra.com/subprocessors](/subprocessors?ntr=wFlqlJXuhxVZV_pn) and forms part of this DPA. Changes are notified as described in section 10.