Data Terms and Security Terms

Data Security

Salestools AI Inc is committed to ensuring the security, integrity, and confidentiality of customer data. We adhere to industry best practices and are compliant with SOC 2 and ISO 27001 standards.

• Encryption: All data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted using AES-256.
• Access Control: Access to customer data is restricted to authorized personnel based on role-based access control (RBAC) and the principle of least privilege.
• Data Segmentation: Customer data is logically segmented to prevent unauthorized access across accounts.
• Monitoring: Salestools employs 24/7 monitoring and alerting systems to detect and respond to potential threats promptly.
• Data Retention and Deletion: Data is retained only as long as necessary to fulfill the purpose for which it was collected, in compliance with applicable laws and customer agreements.

Compliance

Salestools AI Inc is aligned with:

• SOC 2 Type II: Demonstrating effective implementation of controls related to security, availability, processing integrity, confidentiality, and privacy.
• ISO 27001: Ensuring that an Information Security Management System (ISMS) is in place to protect sensitive data and reduce risks.

Incident Response

In the event of a data breach or security incident:

• We will notify affected customers within 72 hours of detection.
• A root cause analysis will be conducted, and a report will be provided to affected parties.
• Mitigation measures will be implemented immediately to prevent recurrence.

Customer Responsibilities

• Customers must ensure secure access to their accounts and systems by maintaining strong passwords and implementing two-factor authentication.
• Customers are responsible for ensuring compliance with local laws regarding data collection and processing within their jurisdictions.

Data Processing Agreement (DPA)

1. Definitions

• Controller: The entity that determines the purposes and means of the processing of Personal Data.
• Processor: The entity that processes Personal Data on behalf of the Controller.
• Personal Data: Any information relating to an identified or identifiable natural person.

2. Scope of Processing

• Salestools processes Personal Data solely for the purposes outlined in the Agreement.
• The processing activities include but are not limited to data collection, analysis, and reporting as required for providing AI sales services.

3. Obligations of the Processor

• Process Personal Data only on documented instructions from the Controller.
• Ensure that personnel authorized to process Personal Data have committed to confidentiality.
• Implement technical and organizational measures to ensure data security, including pseudonymization, encryption, and incident response measures.

4. Sub-processors

• Salestools may engage sub-processors for specific processing activities. A list of current sub-processors is available upon request.
• The Processor will ensure that sub-processors are bound by similar data protection obligations.

5. Data Subject Rights

The Processor will assist the Controller in responding to data subject rights requests, including:

• Right to access, rectification, and erasure.
• Right to restriction of processing and data portability.

6. International Data Transfers

Salestools will not transfer Personal Data outside the European Economic Area (EEA) without appropriate safeguards, such as Standard Contractual Clauses (SCCs).

7. Security Measures

• Secure physical facilities and restricted access.
• Secure software development lifecycle (SDLC).
• Regular security audits and penetration testing.
• Data backup and disaster recovery protocols.

8. Breach Notification

• The Processor will notify the Controller within 72 hours of discovering a Personal Data Breach, including:
• Nature of the breach.
• Categories and approximate number of data subjects affected.
• Measures taken to address the breach.

9. Data Retention and Deletion

Upon termination of the Agreement, Salestools will delete or return all Personal Data, as per the Controller’s request, unless otherwise required by law.

10. Liability

The Processor’s liability arising out of or related to data processing will be governed by the liability terms in the Agreement.

11. Governing Law

This DPA shall be governed by the laws of the state or jurisdiction specified in the Agreement.

Appendix: List of Sub-processors

• AWS (Amazon Web Services): Cloud hosting and infrastructure.
• Hetzner: Cloud hosting and infrastructure.
• OVH: Cloud hosting and infrastructure.
• Attio: Customer Communication.
• OpenAI Inc.: AI Models.
• Antrophic Inc.: AI Models.
• Perplexity Inc.: AI Models.
• Meta Inc.: AI Models.
• Intercom Inc.: Customer Support.