Data Processing Agreement
Effective date: 6 October 2026
Using this DPA
This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.
Key Terms
Agreement This DPA supplements the Squad AI Master Subscription Agreement signed between Provider and Customer or, where no such agreement has been signed, the Squad AI Terms of Service at meetsquad.ai/terms.
Provider Basilisk Labs Limited, trading as Squad AI.
Customer The organisation that has entered into the Agreement with Provider.
Approved Subprocessors List of Subprocessors available at meetsquad.ai/privacy-policy.
Provider Security Contact security@meetsquad.ai
Security Policy Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering, including by implementing the measures described in Annex II.
Until Provider's first independent audit report is issued, Section 5.2 of the DPA Standard Terms (Security Reports) does not apply, and Customer may verify Provider's compliance through the Security Due Diligence process in Section 5.3.
Restricted Transfers
Governing Member State EEA Transfers: Ireland UK Transfers: England and Wales
Annex I(A) List of Parties
Data Exporter Name: Customer Address and contact person: as set out in the Agreement or provided to Provider when Customer's account is set up Activities relevant to transfer: See Annex I(B) Role: Controller
Data Importer Name: Basilisk Labs Limited, trading as Squad AI Address: 5 Beech Court, Hurst, Reading, England, RG10 0RQ Contact person: Steven Crake, Chief Technology Officer, privacy@meetsquad.ai Activities relevant to transfer: See Annex I(B) Role: Processor
Annex I(B) Description of Transfer and Processing Activities
Service The Squad AI platform, including the web application, API and MCP server.
Categories of Data Subjects
Customer's employees and other users authorised by Customer to use the Service
Customer's end users or customers
Individuals who appear in content that Customer uploads to or connects with the Service, such as participants in call recordings and authors of public reviews
Categories of Personal Data
Name
Contact information such as email address
Professional information such as job title and organisation
User activity such as account identifiers and usage events
Personal data contained in content that Customer uploads to or connects with the Service, including documents, call recordings and transcripts, voice dictation audio, product feedback and public reviews
Special Category Data Is special category data Processed? No
Frequency of Transfer Continuous
Nature and Purpose of Processing Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:
Receiving data, including collection, accessing, retrieval, recording, and data entry
Holding data, including storage, organization, and structuring
Using data, including analysis, consultation, and generating summaries and insights using AI models
Protecting data, including restricting, encrypting, and security testing
Sharing data with Approved Subprocessors to provide the Service
Erasing data, including destruction and deletion
Duration of Processing Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.
Annex I(C)
Competent Supervisory Authority The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II Technical and Organizational Security Measures
Pseudonymization and encryption of personal data: Customer Personal Data is encrypted in transit using TLS and encrypted at rest by the hosting provider.
Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services: The Service runs as containers on managed infrastructure in the EU (Amsterdam, Netherlands). Databases and internal services sit on an encrypted private network with no public access. Production and development environments are separate. Service availability is monitored with automated alerting.
Ability to restore the availability of and access to Customer Personal Data in a timely manner following a physical or technical incident: The production database is backed up daily, with backups encrypted and retained for 6 days.
Regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures used to secure Processing: Provider operates an information security management system aligned to ISO/IEC 27001, with internal audits and risk assessments, and is undergoing independent SOC 2 and ISO/IEC 27001 audits. Vulnerabilities are tracked and remediated within defined timeframes.
User identification and authorization process and protection: Users authenticate through a dedicated identity provider. Personnel access to production systems is restricted to those who need it, requires multi-factor authentication, and is reviewed periodically.
Protecting Customer Personal Data during transmission (in transit): All traffic to the Service uses HTTPS (TLS). Traffic between internal services runs over an encrypted private network.
Protecting Customer Personal Data during storage (at rest): Databases, file storage and backups are encrypted at rest. Uploaded files are not publicly accessible.
Physical security where Customer Personal Data is processed: Customer Personal Data is processed only in the data centres of Provider's hosting provider and Approved Subprocessors. Provider operates no data centres or servers of its own.
Events logging: Application and infrastructure logs are retained for at least 30 days. Errors generate alerts to Provider's engineering team.
Systems configuration, including default configuration: The Service is deployed from version-controlled code. Changes require peer review and automated checks before release to production.
Internal IT and IT security governance and management: Provider maintains documented information security policies approved by management, with a named Information Security Manager. Personnel complete security awareness training and agree to confidentiality obligations.
Ensuring limited data retention: Customer Personal Data is deleted within 30 days of a verified deletion request or the end of the Agreement, and then ages out of Provider's database backups within a further 6 days and of its hosting provider's encrypted infrastructure snapshots within 90 days.
Allowing data portability and ensuring erasure: Data subject and deletion requests can be sent to privacy@meetsquad.ai.
Acceptance
Where Customer accepts the Squad AI Terms of Service, this DPA is incorporated into and accepted with those Terms. Where Customer has signed a Master Subscription Agreement, the parties may also sign this Cover Page. Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above.
Licence
Based on the Common Paper Data Processing Agreement, available at commonpaper.com. Licensed under CC BY 4.0. Copyright Common Paper, Inc.
