Data Processing Addendum
Effective July 26, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer organization ("Controller") and Altyst ("Processor") and applies where Altyst processes personal data on the Controller's behalf. Where terms conflict, this DPA controls for data-protection matters.
1. Roles and scope
For customer content, the Controller determines the purposes and means of processing and Altyst acts as Processor, processing personal data only on the Controller's documented instructions (which include providing the Service and complying with law).
2. Subject matter and duration
Subject matter: provision of the Service. Duration: the term of the agreement. Nature/purpose: hosting, AI-assisted extraction, computation, storage, and export of CRE underwriting data. Data subjects: the Controller's authorized users and individuals referenced in uploaded documents. Categories: account identifiers and the content the Controller submits.
3. Confidentiality and security
Altyst ensures persons authorized to process personal data are bound by confidentiality and implements appropriate technical and organizational measures, including encryption in transit and at rest, tenant isolation with row-level security, least-privilege access, and access controls. See the Privacy Policy.
4. Subprocessors
The Controller authorizes the subprocessors listed at /legal/subprocessors. Altyst imposes data-protection obligations on each and remains responsible for their performance, and will give notice of material changes so the Controller may object on reasonable data-protection grounds.
5. Data-subject requests and assistance
Taking into account the nature of processing, Altyst will assist the Controller, by appropriate measures, in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations. Altyst will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.
6. International transfers
Where personal data is transferred across borders, the parties rely on appropriate safeguards (for example, Standard Contractual Clauses) as required by applicable law.
7. Deletion and return
On termination, Altyst will delete or return the Controller's personal data per the Data Retention Policy, except as required to be retained by law.
8. Audits
Altyst will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable request and confidentiality terms, respond to a Controller's reasonable audit inquiries.
9. California (CCPA/CPRA) service-provider terms
Where the California Consumer Privacy Act as amended by the CPRA applies, Altyst acts as a "service provider" to the Controller ("business") with respect to personal information processed under this DPA, and Altyst:
- will not sell or share the personal information (as "sell" and "share" are defined
by the CCPA/CPRA);
- will not retain, use, or disclose the personal information for any purpose other
than the business purposes specified in this DPA and the agreement (providing, securing, and supporting the Service), or as otherwise permitted by the CCPA/CPRA;
- will not retain, use, or disclose the personal information outside the direct
business relationship between the parties;
- will not combine the personal information with personal information received from
other sources, except as permitted by the CCPA/CPRA for the business purposes; and
- certifies that it understands the restrictions in this Section 9 and will comply
with them, and will notify the Controller if it determines it can no longer meet its obligations under the CCPA/CPRA. Altyst will assist the Controller in responding to verifiable consumer requests as described in Section 5.
Annex I. Details of processing
- Subject matter and nature: hosting, storage, AI-assisted extraction,
deterministic computation, and export of commercial-real-estate underwriting data submitted by the Controller.
- Purpose: providing, securing, and supporting the Service under the agreement.
- Duration: the term of the agreement, plus the deletion/return window in the
- Categories of data subjects: the Controller's authorized users (workspace
members) and individuals referenced in documents the Controller uploads (for example, tenants, borrowers, brokers, and property contacts named in offering memoranda, rent rolls, and financial statements).
- Categories of personal data: account identifiers of authorized users (name,
email, role); and personal data contained in the Controller's uploaded documents and entered deal data (typically business-contact and lease/financial information). The Service is not intended for special categories of personal data.
- Frequency: continuous, as directed by the Controller's use of the Service.
Annex II. Technical and organizational measures
The measures below describe controls that are actually in place:
- Encryption: TLS/HTTPS for all data in transit; encryption at rest for the
database, object storage, and backups.
- Tenant isolation: server-side authorization on every request (deny-by-default),
org-scoped object-storage keys, and PostgreSQL row-level security enforced in production as defense in depth.
- Access control: least-privilege IAM identities for application, backup, and
deletion roles; passwords hashed (bcrypt); secrets held only in provider-managed configuration.
- Backups and recovery: encrypted logical backups with bounded (~35-day)
retention and a documented restore procedure that re-applies completed deletions from the deletion ledger.
- Deletion: a deletion pipeline that removes records, schedules object purge,
and produces content-free deletion receipts.
- Logging discipline: operational logs exclude raw document content, extracted
text, prompts/responses, and secrets.
To execute a countersigned DPA for your organization, contact support@altyst.ai.
*Altyst — commercial real-estate underwriting software. Effective July 26, 2026. Version 1.3. Questions about this document: support@altyst.ai.*