Data Processing Addendum

Controller and processor terms for personal data processed through customer tenants.

Last updated: May 9, 2026

Roles

The customer generally determines the purposes and means of processing Customer Personal Data. Hevra processes that data according to documented instructions, product configuration, support requests, and the applicable agreement.

Processing Activities

Host and operate tenant-scoped ERP data and workflows.
Authenticate users and enforce tenant isolation, roles, and permissions.
Provide support, troubleshooting, migration, monitoring, backup, and security operations.

Data Categories

Customer Personal Data may include identifiers, contact details, audit logs, financial records, payroll records, education records, uploaded files, document metadata, signatures, communications, and customer-defined fields.

Security and Subprocessors

Hevra uses reasonable technical and organizational measures and may use subprocessors for hosting, storage, monitoring, support, communications, security, and maintenance, under appropriate data protection commitments.

Processor Obligations

Process Customer Personal Data only according to documented instructions unless required by law.
Ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
Assist with data subject requests, security obligations, data protection assessments, and regulator consultations where legally required.
Notify the customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data.

Controller Obligations

Provide lawful instructions and maintain a lawful basis for processing.
Configure tenants, roles, permissions, modules, retention, exports, and integrations appropriately.
Provide required notices and obtain required consents or authorizations.
Avoid submitting data that is prohibited by the agreement or unnecessary for the customer use case.

Transfers and Audits

Where international transfer safeguards are required, the parties will use an appropriate lawful transfer mechanism. Reasonable security and compliance information may be made available on request, subject to confidentiality and operational limits.