Last updated October 8, 2026
This Data Processing Agreement ("DPA") is entered into by and between SurgeTK ("Provider," "Processor," "we," or "us") and the firm that accepts the SurgeTK Software as a Service Agreement ("Client," "Controller," or "you"). This DPA supplements, is incorporated by reference into, and forms part of the Software as a Service Agreement between the parties ("SaaS Agreement"), published on Provider's website and Trust Center, and the Provider's Terms of Service, published at https://surgetk.com/terms. It governs the Processing of Personal Data by Provider on behalf of Client in connection with the SurgeTK platform (the "Platform").
Acceptance. This DPA applies automatically, and forms part of the SaaS Agreement, when Client accepts the SaaS Agreement. No signature is required. On request, Provider will provide a countersigned copy of this DPA for Client's records.
Purpose. Client is a registered investment adviser, broker-dealer, or similar regulated financial firm that is subject to data protection obligations under the Gramm-Leach-Bliley Act and SEC Regulation S-P, and, where applicable, the California Consumer Privacy Act (as amended) and the EU/UK General Data Protection Regulation. This DPA sets out the commitments under which Provider, acting as Client's service provider and processor, protects Personal Data that Client makes available through the Platform.
1. Definitions
Capitalized terms not defined here have the meanings given in the SaaS Agreement. The following terms apply throughout this DPA:
"Applicable Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under this DPA, including the Gramm-Leach-Bliley Act and SEC Regulation S-P ("GLBA"), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act and its implementing regulations ("CCPA"), and, where applicable, the EU General Data Protection Regulation 2016/679 and the UK GDPR (collectively, "GDPR").
"Personal Data" means any information relating to an identified or identifiable natural person, or that is otherwise protected as nonpublic personal information, personal information, or personal data under Applicable Data Protection Laws, that Client makes available to, or that is Processed by, Provider through the Platform. Personal Data includes "Nonpublic Personal Information" ("NPI") as defined in GLBA and Regulation S-P.
"Processing" (and "Process") means any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, use, transmission, disclosure, or deletion.
"Data Subject" / "Consumer" means the identified or identifiable natural person to whom Personal Data relates, including a "consumer" as defined under the CCPA.
"Sub-processor" means any third party engaged by Provider to Process Personal Data on Provider's behalf in connection with the Platform.
"Security Incident" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data Processed by Provider. "Security Incident" includes a "breach of security" involving "sensitive customer information" as those terms are used in Regulation S-P.
"Sensitive Customer Information" has the meaning given in Regulation S-P, generally meaning any component of customer information alone or in conjunction with other information that would permit access to a customer's account or that creates a reasonably likely risk of substantial harm or inconvenience to the customer if compromised.
"Standard Contractual Clauses" / "SCCs" means the clauses approved under GDPR for the transfer of personal data to third countries, including EU Commission Implementing Decision 2021/914 and, for UK transfers, the UK Information Commissioner's International Data Transfer Addendum.
"Trust Center" means Provider's public security and compliance page at https://app.vanta.com/surgetk.com/trust/cajo26wc4ytpjpd4zys2xt, or a successor page that Provider designates.
Role-specific terms. Where this DPA uses "Controller" and "Processor," those terms carry their GDPR meanings. Where it uses "Business" and "Service Provider," those terms carry their CCPA meanings. Client is the Controller / Business; Provider is the Processor / Service Provider.
2. Roles of the Parties and Scope
2.1 Allocation of roles. As between the parties, Client is the Controller and Business and determines the purposes and means of Processing Personal Data on the Platform. Provider is the Processor and Service Provider and Processes Personal Data only on behalf of, and at the direction of, Client. Client is solely responsible for the lawfulness of the Personal Data it makes available and for compliance with its own obligations under Applicable Data Protection Laws, including any required notices and consents to Data Subjects.
2.2 Processing on documented instructions. Provider will Process Personal Data only (a) to provide, maintain, and support the Platform under the SaaS Agreement; (b) as further documented in Exhibit A; and (c) on Client's other documented instructions, including with regard to transfers, unless required to act otherwise by law. If Provider is required by law to Process Personal Data beyond Client's instructions, Provider will, where legally permitted, inform Client before doing so. If Provider reasonably believes an instruction violates Applicable Data Protection Laws, Provider will promptly notify Client.
2.3 Scope and applicability. Sections 7 (GLBA / Regulation S-P) and 8 (CCPA) apply to Personal Data subject to those laws. Section 9 (GDPR) applies only to the extent Client makes EU or UK personal data available through the Platform. Where more than one regime applies, the provisions operate cumulatively and the stricter requirement controls for the data at issue.
3. Confidentiality of Personal Data
Provider treats all Personal Data as Client's confidential information and will not use or disclose it except as permitted by this DPA or required by law. Provider ensures that personnel authorized to Process Personal Data are bound by written obligations of confidentiality (or are under an appropriate statutory duty of confidentiality) and are subject to access controls limiting Processing to what is necessary to perform their duties. Provider provides such personnel with appropriate data protection and security training.
Provider limits access to Personal Data to Provider's personnel and contractors who need it to operate, support, and secure the Platform. Provider does not give any other customer of the Platform, any affiliate of Provider, or any other third party access to Personal Data, other than Sub-processors engaged under Section 5.
Provider does not use Personal Data to train, fine-tune, or otherwise improve any artificial-intelligence or machine-learning model, whether Provider's own or a third party's, and does not permit its Sub-processors to do so.
4. Security of Processing
Provider implements and maintains appropriate administrative, technical, and physical safeguards designed to protect Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, the nature and scope of Processing, and the risks to Data Subjects. These safeguards are described in Exhibit B and are designed to meet or exceed the requirements of the GLBA Safeguards framework, the safeguarding requirements of Regulation S-P, and, where applicable, Article 32 of the GDPR. Provider regularly tests and monitors the effectiveness of its safeguards and updates them as appropriate; Provider will not materially diminish the overall level of protection during the term.
5. Sub-processors
5.1 Authorization. Client provides general authorization for Provider to engage Sub-processors to support the Platform. A current list of Sub-processors is set out in Exhibit C and published on the Trust Center. Provider remains fully responsible to Client for the performance of each Sub-processor's obligations.
5.2 Flow-down and changes. Provider imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, including a prohibition on using Personal Data to train or improve artificial-intelligence or machine-learning models. Provider will give Client at least thirty (30) days' prior notice by email of any intended addition or replacement of a Sub-processor that Processes Personal Data. Notices are sent to Client's account administrators or to another contact Client designates in writing. Provider updates the Sub-processor list on the Trust Center at the same time. If Client reasonably objects on data protection grounds, the parties will work in good faith to resolve the objection; if they cannot, Client may suspend or terminate the affected Platform services as its sole remedy.
6. Assistance with Data Subject and Consumer Requests
Taking into account the nature of the Processing, Provider provides reasonable assistance, through appropriate technical and organizational measures and insofar as possible, to enable Client to respond to requests by Data Subjects or Consumers to exercise their rights (including access, correction, deletion, portability, and opt-out, as applicable). If Provider receives a request directly from a Data Subject or Consumer relating to Personal Data Processed for Client, Provider will not respond to the request itself except to confirm that it is acting as a service provider/processor, and will promptly forward the request to Client unless legally prohibited.
7. GLBA and SEC Regulation S-P Commitments
This Section applies to all NPI and Sensitive Customer Information Provider Processes for Client. Provider acknowledges that Client is a "covered institution" and/or financial institution subject to GLBA and Regulation S-P, and that Provider is a service provider receiving NPI from Client. Provider commits as follows:
Permitted use of NPI. Provider will Process NPI solely to provide the Platform services and will not use, disclose, sell, or otherwise make NPI available except as necessary to perform those services or as permitted by Section 248.14 or 248.15 of Regulation S-P. Provider will not, directly or indirectly, reuse or redisclose NPI in any manner that would be prohibited if done directly by Client (Regulation S-P reuse and redisclosure limits). Provider will not use NPI to train or improve artificial-intelligence or machine-learning models.
Safeguards. Provider maintains written policies and procedures and the safeguards described in Exhibit B reasonably designed to ensure the security and confidentiality of customer information, protect against anticipated threats, and protect against unauthorized access or use that could result in substantial harm or inconvenience to a customer.
Disposal. Provider properly disposes of consumer report information and NPI in a manner consistent with the disposal requirements of Regulation S-P and Section 12 of this DPA.
Service-provider oversight support. To support Client's obligation under amended Regulation S-P to oversee service providers, Provider will, on reasonable request, complete due-diligence questionnaires and provide its written information security policies, third-party audit reports or certifications (e.g., SOC 2 Type II), and other documentation reasonably necessary for Client to assess and monitor Provider's safeguards.
Incident notification timed to Client's 30-day window. Because amended Regulation S-P requires Client to notify affected individuals as soon as practicable and not later than thirty (30) days after becoming aware that Sensitive Customer Information was, or is reasonably likely to have been, accessed or used without authorization, Provider will notify Client of any Security Incident as soon as possible, and no later than seventy-two (72) hours after becoming aware that it has occurred, on the terms set out in Section 10, so that Client can meet that obligation. Provider will provide the information Client reasonably needs to assess its notification obligations and to make any required notifications.
Service-provider acknowledgment. Provider acknowledges that it is a service provider to Client for purposes of Regulation S-P (17 CFR 248.30), and that this DPA and the SaaS Agreement are the written terms through which Client oversees Provider's safeguards. Provider will reasonably cooperate with requests from Client's regulators that relate to the Platform or to Personal Data.
8. CCPA / CPRA Service Provider Commitments
This Section applies to Personal Data that constitutes "personal information" of California Consumers under the CCPA. Provider is a "Service Provider" and receives such personal information from, or on behalf of, Client (the "Business") for the business purpose of providing the Platform. Provider certifies that it understands the restrictions in this Section and will comply with them.
No sale or sharing. Provider will not sell or share (as those terms are defined in the CCPA) personal information received from Client.
Purpose limitation. Provider will not retain, use, or disclose personal information for any purpose other than the specific business purposes of performing the services in the SaaS Agreement, including not retaining, using, or disclosing it outside the direct business relationship between the parties, and not using it to train or improve artificial-intelligence or machine-learning models, except as otherwise permitted by the CCPA.
No combining. Provider will not combine personal information received from Client with personal information it receives from, or on behalf of, any other person, or collects from its own interaction with the Consumer, except as permitted by the CCPA to perform a business purpose.
Equivalent protection. Provider will provide the same level of privacy protection as required of Businesses under the CCPA and will comply with applicable obligations under the CCPA.
Business oversight. Client may take reasonable and appropriate steps to help ensure that Provider uses personal information in a manner consistent with Client's CCPA obligations, and, upon notice, may take reasonable steps to stop and remediate unauthorized use of personal information.
Notice of inability to comply. Provider will notify Client promptly if it determines it can no longer meet its obligations under the CCPA.
Assistance with consumer rights. Provider will reasonably assist Client in responding to verifiable Consumer requests, as described in Section 6.
9. GDPR Commitments (Where Applicable)
This Section applies only to the extent Client makes EU or UK personal data available through the Platform. In addition to the commitments elsewhere in this DPA, and to give effect to Article 28 of the GDPR, Provider commits as follows:
Instructions. Provider Processes such personal data only on Client's documented instructions, as set out in Section 2.2.
Confidentiality. Provider ensures persons authorized to Process the personal data are bound by confidentiality, as set out in Section 3.
Security. Provider implements measures meeting Article 32, as set out in Section 4 and Exhibit B.
Sub-processors. Provider engages Sub-processors only in accordance with Article 28(2) and (4) and Section 5.
Data subject rights. Provider assists Client, by appropriate measures and insofar as possible, to fulfill Client's obligation to respond to requests to exercise data subject rights, as set out in Section 6.
Assistance with Articles 32 to 36. Taking into account the nature of Processing and the information available to it, Provider assists Client in ensuring compliance with security, breach notification, data protection impact assessment, and prior-consultation obligations.
Deletion or return. At Client's choice, Provider deletes or returns the personal data at the end of the services, as set out in Section 12.
Audits and information. Provider makes available to Client information reasonably necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, as set out in Section 11.
9.1 International data transfers. Where Provider transfers EU or UK personal data to a country that does not provide an adequate level of protection, the parties agree that the applicable Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) are incorporated into this DPA by reference and apply to that transfer. Client is the data exporter and Provider is the data importer. Provider will implement supplementary measures where reasonably necessary to protect the transferred data.
10. Security Incident Notification
10.1 Notification to Client. Provider will notify Client as soon as possible, and in any event no later than seventy-two (72) hours after Provider becomes aware that a Security Incident has occurred affecting Personal Data Processed for Client. Notification is sent by email to Client's account administrators and to any other contact Client designates in writing. This timeline is intended to give Client sufficient time to meet its own notification obligations, including the thirty (30)-day customer-notification requirement under Regulation S-P and, where applicable, the seventy-two (72)-hour supervisory-authority notification requirement under the GDPR.
10.2 Content of notification. To the extent known, Provider's notification will describe:
the nature of the Security Incident, including the categories and approximate number of Data Subjects and records affected;
the likely consequences of the Security Incident;
the measures taken or proposed to address it and to mitigate its possible adverse effects; and
a point of contact for further information.
Where Provider cannot provide all information at once, it may provide it in phases without undue further delay. Provider will document the Security Incident and cooperate reasonably with Client's investigation and response. Provider's notification or response is not an acknowledgment of fault or liability.
11. Audits and Oversight
Provider will make available to Client, on reasonable request and no more than once per twelve (12) months (or more frequently if required by a regulator or following a Security Incident), the information reasonably necessary to demonstrate compliance with this DPA, including its most recent third-party audit reports or certifications (e.g., SOC 2 Type II). Such reports are provided under confidentiality protections, including through the access request on the Trust Center. Where such information is insufficient, Client (or a mutually agreed independent auditor bound by confidentiality) may conduct an audit of Provider's relevant controls during normal business hours, on reasonable prior notice, in a manner that does not unreasonably disrupt Provider's operations and protects the confidentiality and security of other customers' data.
12. Return and Deletion of Personal Data
Upon termination or expiration of the Platform services, and at Client's election, Provider will return Personal Data to Client and/or delete it, except to the extent retention is required by law or for a permitted business purpose. Provider will complete deletion within ninety (90) days of termination unless a longer period is required by law, and will, on written request, certify completion of such deletion. Deleted Personal Data may remain in Provider's encrypted database backups until those backups expire, no later than twelve (12) months after deletion. Personal Data retained in backups or as required by law remains subject to the confidentiality and security obligations of this DPA for as long as it is retained.
13. Liability
Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the SaaS Agreement, and any reference in the SaaS Agreement to the liability of a party means the aggregate liability of that party under the SaaS Agreement and this DPA combined. Nothing in this DPA limits either party's liability to the extent such limitation is not permitted by Applicable Data Protection Laws.
14. Term and Survival
This DPA takes effect on the date Client accepts the SaaS Agreement (or, if later, the date Provider first Processes Personal Data for Client) and remains in effect for as long as Provider Processes Personal Data for Client. Provisions that by their nature should survive termination survive, including confidentiality, the GLBA/Regulation S-P, CCPA, and GDPR commitments as to retained data, return and deletion, liability, and governing law.
15. Order of Precedence
This DPA is incorporated into the SaaS Agreement. In the event of a conflict between this DPA and the SaaS Agreement or Terms of Service with respect to the Processing or protection of Personal Data, this DPA controls. Where the Standard Contractual Clauses apply, they control over this DPA to the extent of any conflict regarding the transfer of EU or UK personal data. In all other respects, the SaaS Agreement remains in full force and effect.
16. Governing Law
This DPA is governed by the laws of the State of Alaska, as specified in the SaaS Agreement, except to the extent Applicable Data Protection Laws require otherwise (for example, where the Standard Contractual Clauses specify the governing law of an EU Member State for transfer-related matters).
17. Entire Agreement and Updates
This DPA, together with its Exhibits, the SaaS Agreement, and the Terms of Service, constitutes the entire agreement between the parties regarding the Processing of Personal Data and supersedes all prior agreements and understandings on that subject.
Provider may update this DPA in the manner the SaaS Agreement sets out for updates to that agreement: a new version is published on Provider's website and Trust Center, Client's account administrators are notified by email at least thirty (30) days before a material change takes effect, and Client may terminate before the change takes effect if it objects. Provider may update Exhibit B (security measures) and Exhibit C (Sub-processors) in accordance with this DPA. No update may materially diminish the overall level of protection for Personal Data. Any other amendment must be in writing and agreed by both parties.
Acceptance
This DPA is accepted electronically as part of the SaaS Agreement, as described under "Acceptance" above. No signature is required. A countersigned copy is available on request from [email protected].
Exhibit A: Details of Processing
Item | Description |
Subject matter | Provision of the SurgeTK Platform to Client as described in the SaaS Agreement. |
Duration | For the term of the SaaS Agreement and any period of permitted retention thereafter (see Section 12). |
Nature and purpose | Hosting, storage, organization, display, and transmission of Personal Data to enable Client to use the Platform's templates, checklists, workflows, and value-add materials with its clients. |
Categories of Data Subjects | Client's clients and prospective clients; Client's authorized users and personnel. |
Types of Personal Data | Identification and contact details (such as names, dates of birth, addresses, and contact information); household and beneficiary relationships; financial account metadata and account identifiers; and financial profile inputs entered by Client or synced from Client's CRM. The Platform does not collect Social Security numbers, payment card numbers, or driver's license numbers. Payment card details for Client's subscription are collected and tokenized by Stripe and are not stored by Provider. |
Special categories | None intended. Client agrees not to enter special-category or highly sensitive data except as expressly supported by the Platform. Client is responsible for the integrity of its data. |
Frequency of Processing | Continuous, for the duration of the services. |
Exhibit B: Technical and Organizational Security Measures
Access control
Role-based access control within each Client firm. Roles are admin, lead advisor, assistant, and team member, with permission levels from view only to admin. Users can be limited to the households assigned to them.
Provider personnel access follows least privilege. Access to Personal Data is limited to authorized personnel with a business need, granted through a documented request. Personnel and contractors who can access production systems are bound by written confidentiality obligations and Provider's information security policies. No affiliate of Provider and no other customer firm has access to Personal Data.
Each Platform user has unique credentials. Two-factor authentication (time-based one-time password) is required for all password sign-ins. Google and Microsoft sign-ins rely on the identity provider's multi-factor authentication. Email sign-in links require possession of the user's email account.
Multi-factor authentication is required for privileged access to production infrastructure where the system supports it.
Quarterly access reviews. Provider personnel access is removed within twenty-four (24) business hours of termination.
Logical multi-tenant isolation enforced by the application. Client records carry a per-firm identifier, queries are scoped to the signed-in user's firm, access checks confirm a record belongs to the user's firm before returning it, and automated cross-firm isolation tests run on code changes.
Encryption
Encryption of Personal Data in transit using Transport Layer Security 1.2 or higher, with HTTP Strict Transport Security enforced.
Encryption of Personal Data at rest using Advanced Encryption Standard 256-bit in MongoDB Atlas (database) and Amazon Simple Storage Service (object storage, including Client-uploaded files).
Application-level Advanced Encryption Standard 256-bit Galois/Counter Mode encryption for Client-supplied CRM credentials (Redtail password; Zoho and Calendly refresh tokens).
Encryption keys and service credentials are held in a secrets manager with restricted access and rotated under Provider's Credential Rotation Policy.
Network and application security
The database accepts connections only from addresses on its IP access list (Provider's fixed outbound addresses and specific approved staff addresses) and requires TLS.
Object storage buckets that hold Client data block all public access. Client files are retrieved through short-lived presigned URLs. Only the profile image and logo buckets are publicly readable.
Cross-Site Request Forgery protection: state-changing requests identified as coming from another origin are rejected unless they carry a valid token.
Content Security Policy restricting browser-side scripts to an allow-list.
Rate limiting on sign-in, email sign-in link requests, code verification, two-factor authentication, password reset and setup, sign-up, import, and Zoho CRM endpoints.
Automated tests, AI-assisted security review, and dependency scanning (Dependabot, weekly) on code changes submitted as pull requests. The AI-assisted review reads source code only; it does not receive Personal Data.
Periodic vulnerability scanning.
Artificial intelligence
Provider does not use Personal Data to train, fine-tune, or improve artificial-intelligence or machine-learning models, and does not permit Sub-processors to do so.
No Personal Data is sent to an artificial-intelligence model provider. The AI-assisted code review tool listed on the Trust Center receives source code only, never Personal Data. If Provider adds a feature that uses an artificial-intelligence model to Process Personal Data, the provider is added to Exhibit C with the notice required by Section 5.2 and only under terms that prohibit training on Personal Data.
Operational resilience
Application error monitoring (Sentry) and performance monitoring (New Relic). Request bodies and cookies are removed from error events before they are sent, and 9-digit and 12-or-more-digit numbers are redacted. Error events identify the affected user by ID and email.
Audit logging of create, update, and delete operations on households, accounts, assets, liabilities, insurance, tax years, imports, Surge records, and unlinked beneficiaries, recorded in a dedicated activity log scoped to each Client firm.
Application and platform logs retained in a log management service with a 365-day archive.
Database: three-node replica set with automatic failover; backups every six hours with a seven-day point-in-time restore window; monthly backups kept twelve months. Object storage: versioning enabled, with replication to a second AWS region; superseded and deleted file versions expire after ninety (90) days in both regions.
Documented Business Continuity and Disaster Recovery Plan with a Recovery Time Objective of one hour for the application tier and four hours for the data tier, and a Recovery Point Objective of one hour. The plan requires a disaster recovery test, including backup restoration, at least annually.
Organizational measures
Written information security policies approved by management and reviewed at least annually. Personnel acknowledge the Code of Conduct and the Information Security Policy.
Security awareness training for personnel.
Documented Incident Response Plan with severity levels, remediation targets, and root cause analysis for critical incidents. Customer notification as soon as possible and no later than seventy-two (72) hours after Provider becomes aware of a Security Incident, as set out in Section 10. A customer summary of the plan is available on the Trust Center.
Cyber liability insurance with limits of one million U.S. dollars ($1,000,000) per event and in the aggregate. A certificate of insurance is available on request.
Independent SOC 2 Type II examination in progress with Johanson Group LLP; the report will be available under a non-disclosure agreement through the Trust Center when issued.
Secure disposal of consumer report information and Nonpublic Personal Information consistent with Regulation S-P disposal requirements.
Exhibit C: Authorized Sub-processors
Provider engages the following Sub-processors to Process Personal Data. This list is also published on the Trust Center, which additionally lists service providers that do not Process Personal Data (source code hosting, internal email and identity, secrets management, compliance monitoring, and AI-assisted code review); those providers are not Sub-processors. Last reviewed October 8, 2026.
Sub-processor | Service provided | Personal Data processed | Location |
Heroku (a Salesforce company) | Application hosting, background jobs, Redis queue and cache | All application data in transit and in processing | United States |
MongoDB Atlas | Primary database, sessions, audit log, database backups | All Client firm and client data | United States |
Amazon Web Services (Amazon Simple Storage Service) | Object storage for imports, generated reports, and profile images; backup copies | Client import files and generated reports | United States |
QuotaGuard Static | Fixed outbound IP addresses for database connections | Encrypted database traffic passes through | United States |
Cloudflare | DNS; access control for Provider's internal admin panel | Admin panel traffic | Global network |
Papertrail (SolarWinds) | Log management | Application and platform logs | Vendor-hosted on Amazon Web Services |
Sentry | Error tracking and masked session replay | User ID and email, error details, masked session replays | United States |
New Relic | Application performance monitoring | Request metadata and performance metrics | United States |
Mixpanel | Product analytics with session replay | User ID, email, firm name and ID, role, usage events, session replays with all text and numeric content masked | United States |
PostHog | Server-side product usage events | User ID, firm ID and name, event values | United States |
Intercom | In-application support, onboarding, and customer messaging | User name, email, firm, role, firm account details, support messages | United States |
SendGrid (Twilio) | Transactional and alert email | Recipient addresses and email content | United States |
Stripe | Subscription billing and payment processing | Billing contact details; card data is collected and tokenized by Stripe | United States |
DocRaptor | PDF generation for import reports | Import report contents | United States |
ipinfo.io | Approximate location of sign-ins | User IP addresses | United States |
Zapier | Sign-up and onboarding workflows | Advisor name, email, and firm | United States |
Integrations enabled by Client. Personal Data flows to these services only when Client or its users connect them: Redtail (CRM data sync), Zoho CRM (CRM data sync), Calendly (meeting sync), Google sign-in and Microsoft sign-in (user authentication).
Provider will notify Client of changes to this Exhibit as set out in Section 5.2.