Data processing addendum · effective September 19, 2026
This addendum is part of the terms of service between you and Iron Rod Systems LLC, a Utah limited liability company doing business as Iron Rod AI™ ("we", "us"). It applies wherever you submit personal data to TruthLock and data protection law makes you its controller and us your processor. It takes effect when you accept the terms. Nothing needs signing, and we will sign a counterpart if your procurement process wants one.
Two kinds of data move through TruthLock, and they are not governed the same way.
Where a term is defined in the GDPR, the UK GDPR, or the CCPA, it carries that meaning here.
The full description sits in Annex I. In short: we process customer content only to run verifications you asked for, to keep the service secure and available, and to support you when you ask. We process it for as long as your account or stack exists, subject to the retention you set per organization, and then as section 10 says.
We do not sell it, share it for advertising, use it to serve another customer, use it to build or improve our own models, or mine it for statistics. Our own product metrics count verifications, latency, errors, and spend. They do not look inside what was verified.
We process customer content only on your documented instructions. The terms, this addendum, the configuration you set in the application, and the API calls you make are those instructions, and they are complete. If you want something else, write to legal@truthlock.io and we will agree it in writing, including who pays if it costs something to build.
We will tell you if an instruction appears to break data protection law, and we may pause that processing while we sort it out. If a law we are subject to compels us to process beyond your instructions, we will tell you before doing so unless that same law forbids telling you.
Access is limited to the people who need it to run or support the service, each under a written confidentiality obligation that survives their leaving. On a pooled deployment, access is scoped, logged in the audit trail, and available to you. On a dedicated stack, the data lives in an AWS account under your control and we have no standing path into it; we see what you show us in a support session, and nothing else.
We keep the technical and organizational measures in Annex II, judged against the risk to the people whose data this is. We may change a measure as the product changes, but not in a way that materially weakens overall security. The security page carries the working detail and stays current.
You give us general authorization to use subprocessors. Those that may touch customer content are named in Annex III. Each is bound by written terms no less protective than these, and we remain responsible to you for what they do.
Before adding or replacing one, we will give you at least 30 days' notice by email to your account owners. If you have a reasonable data protection objection, tell us within that window and we will work to offer you an alternative. If we cannot, you may terminate the affected part of the service and we refund prepaid fees for the unused period. That is the remedy.
People whose data you sent us deal with you, not with us, because you are the controller. If one of them comes to us directly, we will not respond on the substance; we will tell them to contact you, and tell you promptly.
The application is built so you can answer them yourself: records are searchable, exportable, and deletable, and retention is configurable per organization. Where the tooling is not enough, we will help, and we will not charge for reasonable assistance.
If we become aware of a personal data breach affecting customer content, we notify you without undue delay, and we aim to do it within 72 hours. The notice describes what we know: the nature of the breach, the categories and rough number of records, the likely consequences, what we are doing about it, and who to talk to. We will send what we know first and fill in the rest as we learn it, rather than wait for a complete picture.
We do not notify regulators or affected people on your behalf unless you ask us to in writing, because those are the controller's calls. We will not make a public statement identifying you without your consent unless the law compels it.
If you need to run a data protection impact assessment or consult a supervisory authority about your use of TruthLock, we will give you the information we hold that you reasonably need and cannot get elsewhere.
You can export your records at any time while the account is open, as a bundle that verifies on its own.
After termination you have 30 days to export. Then we delete customer content from live systems, and backups containing it roll off within 35 days. We keep nothing except what a law requires us to keep, which we then isolate and stop processing for any other purpose. A dedicated stack is in your own AWS account and is yours to keep or destroy; deletion there is your action, not ours. We will certify deletion in writing if you ask.
One honest limit. An attestation signs a hash of a record, not the record itself. Deleting the underlying content removes the readable data, and the hash that remains cannot be turned back into it. If you enabled the optional public-chain anchor, that hash is on a public ledger permanently and neither of us can remove it. It contains no personal data, but it does not disappear, and you should know that before you turn the anchor on.
We will give you the information you reasonably need to show that we are meeting this addendum, including our current security documentation and any third-party reports we hold.
If that is not enough, you may audit us, or have an independent auditor who is not our competitor do it, once in any twelve months and on 30 days' notice, during business hours, without disrupting the service, and under confidentiality. A regulator with the authority to audit may do so whenever its rules say. You cover the cost unless the audit finds we were in material breach, in which case we do.
Our infrastructure is in the United States, so using the pooled service means customer content is processed there. A dedicated stack runs in the region you choose.
Where you transfer personal data from the EEA to us, the European Commission's standard contractual clauses of 4 June 2021 apply, module two, controller to processor, and are incorporated here in full. Annex I of this addendum populates their Annex I, Annex II populates their Annex II, and Annex III their list of subprocessors. Clause 7 does not apply, clause 9 uses option two with the 30 days' notice in section 6, clause 11 does not use the optional independent dispute body, clauses 17 and 18 take the law and courts of Ireland, and clause 13 takes the supervisory authority of the member state in which you are established or represented.
For the UK, the Information Commissioner's international data transfer addendum applies to those clauses, with tables 1 to 3 completed by the annexes here and neither party permitted to end it under section 19 except as that addendum requires. For Switzerland, the clauses read with the Federal Data Protection Act substituted for the GDPR and the Federal Data Protection and Information Commissioner as the authority. If any of these instruments is replaced, the replacement applies from the date it takes effect.
We have no establishment in the EEA or the UK. Where the law requires a representative for the processing we do here, we will appoint one and tell you who it is.
For personal information covered by the CCPA, we are a service provider and you are the business. We do not sell or share it as that statute defines those words. We do not retain, use, or disclose it for anything outside the direct business purpose of providing TruthLock to you, and never for a commercial purpose of our own. We do not combine it with personal information from any other source, except as the statute permits a service provider to do. We understand these restrictions and we comply with them. You may take reasonable steps to confirm that we do, which section 11 describes.
Where this addendum and the terms of service conflict on the handling of personal data, this addendum wins. On everything else, the terms win. Each party's liability under this addendum is subject to the limits in section 13 of the terms, counted together with the terms rather than in addition to them, except where data protection law forbids limiting it.
This addendum is governed by the law of the State of Utah and disputes follow section 18 of the terms, except where the standard contractual clauses require otherwise, in which case they govern themselves. If a provision is held unenforceable, it is narrowed to the least extent needed and the rest stands.
Accepting the terms of service accepts this addendum, so there is nothing you need to do. If your process requires a signed counterpart naming your legal entity, write to legal@truthlock.io and we will send one that matches this text.
Data exporter and controller: the customer named on the account, whose contact details are the account and billing contacts on its company record. Its role is controller of the customer content it submits.
Data importer and processor: Iron Rod Systems LLC, dba Iron Rod AI™, Utah, United States. Contact privacy@truthlock.io and 833-IRON-ROD. Its role is processor, providing AI answer verification.
Whoever appears in the material you submit. Typically that means your own customers, employees, members, or the subjects of the answers you verify. You choose, and you are the only one who knows in advance.
TruthLock is not designed for it and we ask you not to send it. If your use case requires it, tell us first at legal@truthlock.io so we can agree the extra restrictions in writing rather than discover them later.
Continuously, for as long as you use the service. Retention follows the setting you configure per organization, and otherwise section 10.
Decomposing responses into claims, retrieving and snapshotting evidence, grading each claim against the source hierarchy you declared, applying your reliance policy, producing signed standing records and attestations, and storing and serving all of it back to you. Plus the ordinary work of hosting: backup, monitoring, security, and support.
As Annex III describes, for as long as the subprocessor's role requires.
For the standard contractual clauses, the authority of the EEA member state where you are established, or where your Article 27 representative is, or where the affected people are.
These may process customer content.
These process account and support data, where we are the controller and the privacy policy governs rather than this addendum. They are listed for completeness, not as subprocessors of customer content.