BaseCite Data Processing Addendum

Private beta draft - not approved for customer reliance until counsel/operator approval.

Processing scope

BaseCite processes customer-submitted/unverified materials and associated metadata to provide protected upload, custody metadata, integrity records, and bounded AI/MCP/API retrieval.

Technical and organizational measures

Controls include authentication, tenant-scoped access, admin/customer credential separation, encrypted private payload path, AWS custody sidecar with SSE-KMS/Object Lock where enabled, no raw download, no bulk export, audit events, security monitoring, and incident response.

Subprocessors

The enterprise procurement pack maintains the subprocessor list. Customer-specific commitments require contract terms.

Transfers and residency

Region guarantees and transfer mechanisms require customer-specific contract terms.