This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement between FlashTower, operated by Boostlete LLC (“FlashTower”), and the customer (“Customer”) under which FlashTower provides the Service (the “Agreement”). It applies where FlashTower processes Customer Personal Data on Customer's behalf. Customers who require a countersigned copy may request one from privacy@flashtower.com; the countersigned copy has the same terms as this page unless the parties agree otherwise in writing.
1. Definitions
- “Data Protection Laws” means all data protection and privacy laws applicable to the processing of Customer Personal Data under the Agreement, including, as applicable, the CCPA, other U.S. state privacy laws, the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection.
- “Customer Personal Data” means personal data contained in Customer Data that FlashTower processes on Customer's behalf.
- “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in systems controlled by FlashTower or its subprocessors.
- “Subprocessor” means a third party engaged by FlashTower to process Customer Personal Data.
- Terms such as “controller”, “processor”, “business”, “service provider”, “data subject”, and “processing” have the meanings given in Data Protection Laws. Capitalized terms not defined here have the meanings given in the Agreement.
2. Roles and scope
Customer is the controller (or business) and FlashTower is the processor (or service provider) of Customer Personal Data. Where Customer acts as a processor on behalf of another controller, FlashTower is Customer's subprocessor, and Customer is responsible for obtaining any authorizations required from that controller. FlashTower acts as an independent controller only for account, billing, and security information as described in the Privacy Policy.
3. Processing instructions
FlashTower processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's configuration and use of the Service (including Guard approvals and Automation Policies), and any additional written instructions agreed by the parties, unless required to do otherwise by law (in which case FlashTower will inform Customer before processing, unless legally prohibited). FlashTower will inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Customer is responsible for the lawfulness of its instructions and for having a lawful basis, and any required notices and consents, for the processing.
4. Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the FlashTower Service under the Agreement |
| Duration | The term of the Agreement plus the return and deletion periods in Section 12 |
| Nature and purpose | Hosting, storage, assessment evaluation, change monitoring and alerting, customer-authorized response actions, reporting, support, and security |
| Categories of data subjects | Customer's Authorized Users; individuals named as owners of AI systems, policies, or findings; other individuals Customer chooses to reference |
| Categories of personal data | Names, work email addresses, job titles, pseudonymized IP addresses, approval and audit records, and personal data Customer includes in free-text fields or evidence |
| Special categories / sensitive data | Not intended. Customer must not submit special-category data, government identifiers, or payment card data, or protected health information unless a signed Business Associate Agreement covers it |
| Frequency | Continuous for the duration of the Agreement |
5. Confidentiality and personnel
FlashTower limits access to Customer Personal Data to personnel who need it to provide, support, or secure the Service, and ensures they are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality.
6. Security measures
FlashTower implements and maintains the technical and organizational measures summarized in Annex 1, which are designed to protect Customer Personal Data against Security Incidents. FlashTower may update these measures provided that the update does not materially reduce the overall level of protection.
FlashTower does not currently hold SOC 2, ISO 27001, HITRUST, or any other security certification or third-party attestation. FlashTower enters into a Business Associate Agreement only by a separate written agreement signed by both parties; current availability is described on the healthcare security page.
7. Subprocessors
7.1 Authorization. Customer authorizes FlashTower to engage the Subprocessors listed on the Subprocessors page. FlashTower imposes on each Subprocessor written data-protection obligations no less protective than this DPA, and remains responsible for its Subprocessors' performance.
7.2 Notice of changes. FlashTower will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and by email to customers who have subscribed to notifications.
7.3 Objection. Customer may object in writing to a new Subprocessor on reasonable data-protection grounds within the 30-day notice period. The parties will discuss the objection in good faith. If FlashTower cannot reasonably accommodate the objection, Customer may terminate the affected Service by written notice before the new Subprocessor begins processing, and FlashTower will refund prepaid fees for the unused remainder of the Subscription Term for the terminated Service. This termination and pro-rata refund of prepaid, unused fees is Customer's sole and exclusive remedy for an objection.
8. Security Incidents
FlashTower will notify Customer of a Security Incident without undue delay and in any event within 72 hours of confirmation. The notice will describe, to the extent then known, the nature of the incident, the categories and approximate volume of data and data subjects affected, likely consequences, and measures taken or proposed. FlashTower will supplement the notice as information becomes available, take reasonable steps to contain and remediate the incident, and provide reasonable assistance with Customer's notification obligations. Notification is not an acknowledgement of fault or liability. See the Security Incident Terms.
9. Assistance
Taking into account the nature of the processing, FlashTower will provide reasonable assistance (a) through the Service's features, and otherwise on request, with Customer's obligations to respond to data subject requests; and (b) with data protection impact assessments and prior consultations with supervisory authorities, to the extent Customer does not otherwise have access to the relevant information. If FlashTower receives a data subject request relating to Customer Personal Data, it will refer the requester to Customer and will not respond except as Customer instructs or law requires. FlashTower may charge reasonable fees for assistance beyond what the Service's features provide.
10. U.S. state privacy law terms
Where FlashTower acts as a service provider or processor under U.S. state privacy laws, FlashTower will not: sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer; or combine it with personal information received from other sources, except as those laws permit. FlashTower will comply with applicable obligations under those laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. FlashTower certifies that it understands and will comply with these restrictions.
11. International transfers
FlashTower and its Subprocessors process Customer Personal Data in the United States. To the extent Customer Personal Data subject to the GDPR, UK GDPR, or Swiss law is transferred to FlashTower in a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) where Customer is a controller and Module 3 (processor to processor) where Customer is a processor, with the optional docking clause (Clause 7) included, option 2 (general written authorization, with the notice period in Section 7.2) in Clause 9, the optional wording in Clause 11 omitted, Irish law and courts in Clauses 17 and 18, and Annexes completed with the information in this DPA. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the Clauses apply with references adapted to Swiss law. If the Clauses conflict with this DPA, the Clauses prevail.
12. Audits
12.1 Documentation first. On written request, FlashTower will make available information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and security documentation, subject to confidentiality.
12.2 On-site audits. If that information is insufficient to demonstrate compliance, or where required by Data Protection Laws or a supervisory authority, Customer may conduct a reasonable audit, including an on-site audit, at Customer's cost, no more than once in any 12-month period (except following a Security Incident or at a regulator's request), on at least 30 days' written notice, during normal business hours, in a manner that minimizes disruption and does not compromise the security or confidentiality of other customers' data, and through an independent auditor bound by confidentiality where FlashTower reasonably requests.
13. Return and deletion
During the 30 days after termination of the Agreement, Customer may export Customer Personal Data or request its return. FlashTower will then delete Customer Personal Data from active systems within 30 days, unless retention is required by law. Deleted data persists in rolling backups only until those backups age out under FlashTower's standard backup cycle of up to 7 days, and remains protected by this DPA until then.
14. Aggregate statistics and AI processing
FlashTower may combine de-identified metadata from many organizations into aggregate statistics, such as peer benchmarks. A statistic is published or shown only when it is derived from at least 10 organizations, each organization contributes at most one value, and cells that are too small or dominated by a single organization are suppressed. Aggregates never include assessment answers, evidence, documents, prompts, credentials, personal information, organization names, or any organization-specific weakness. Organizations can opt out in Settings → Privacy. FlashTower does not sell customer data and does not use customer data to train AI models. Aggregate statistics produced under these rules are de-identified and are not Customer Personal Data.
Customer Personal Data is sent to an AI Subprocessor only if Customer's administrator enables AI features, and only in redacted form. FlashTower does not use Customer Personal Data to train AI models without Customer's explicit written authorization.
15. Protected health information
Customer must not upload protected health information (as defined by HIPAA) to the Service unless Customer and FlashTower have signed a Business Associate Agreement that covers the features Customer uses. FlashTower does not currently sign Business Associate Agreements unless the healthcare security page states that they are available, and signs one only with eligible customers by a separate written agreement.
Where a signed Business Associate Agreement applies, it governs protected health information and prevails over this Addendum for that information.
16. Liability and precedence
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws or the Standard Contractual Clauses do not permit. In case of conflict, the order of precedence is: the Standard Contractual Clauses (where applicable), this DPA, then the Agreement.
Annex 1 — Summary of technical and organizational measures
| Area | Measures |
|---|---|
| Tenant isolation | Every table holding customer data carries an organization identifier and is protected by Postgres row-level security; cross-tenant access is tested automatically |
| Access control | Role-based access within each organization, checked on the server and mirrored in database policies; least-privilege service credentials |
| Authentication | Hashed passwords managed by the authentication provider; multi-factor authentication available to all users and required for FlashTower administrative access and high-impact Guard approvals |
| Encryption | TLS with HSTS for data in transit; encryption at rest provided by database, storage, and hosting providers |
| Logging | Append-only audit log of security-sensitive actions, protected from modification by database triggers, with IP addresses pseudonymized |
| Application security | Content Security Policy, input validation, rate limiting, same-origin checks, safe redirect handling, SSRF protections, and upload type verification |
| Data minimization | Metadata-based assessments; error monitoring scrubs request bodies, cookies, and personal data; no session replay |
| Resilience | Managed database with rolling backups of up to 7 days |
| Vulnerability management | Dependency updates, automated tests on every change, and a public Responsible Disclosure Policy |
Contact
FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.