Verlix Data Processing Agreement

Last updated: October 24, 2026

This Data Processing Agreement ("DPA") forms part of the Verlix Terms of Service ("Terms") between VerlixAI, Inc. ("Verlix") and the customer that accepted them ("Customer"). It applies whenever Verlix processes Customer Personal Data in providing the Service. It takes effect when Customer accepts the Terms, with no separate signature needed. Customer may ask legal@verlix.ai for a copy signed by Verlix. Words defined in the Terms have the same meaning here.

1. Definitions

1.1 "Data Protection Law" means every law on privacy and personal data that applies to the processing under this DPA, including the EU General Data Protection Regulation ("GDPR"), the GDPR as it applies in the United Kingdom, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended, and the comprehensive privacy laws of other US states.

1.2 "Customer Personal Data" means personal data within Customer Data.

1.3 "Data Subject" means the person to whom Customer Personal Data relates.

1.4 "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

1.5 "Sub-processor" means a third party that Verlix engages to process Customer Personal Data.

1.6 "Standard Contractual Clauses" means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

1.7 "Processing", "controller", "processor", "business", "service provider" and similar terms carry the meanings Data Protection Law gives them.

2. Roles and scope

2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own clients, and Verlix is its processor. Under US state laws, Verlix is Customer's service provider or processor.

2.2 Verlix is a controller only for the personal data it processes for its own purposes, such as managing Customer's account and billing for the Service, as the Verlix Privacy Policy describes. That processing is outside this DPA.

2.3 Annex 1 describes the subject matter, duration, nature and purpose of the processing, and the types of personal data and Data Subjects involved.

3. Customer's instructions

3.1 Verlix will process Customer Personal Data only on Customer's documented instructions. Those instructions are the Terms, the Verlix Contract, this DPA, the settings Customer chooses in the Service, including whether contract reading and each AI agent are on, and any further written instructions Customer gives that are consistent with them.

3.2 Verlix will tell Customer promptly if it believes an instruction breaks Data Protection Law, and may pause the affected processing until Customer confirms or changes the instruction.

3.3 Verlix will not sell or share Customer Personal Data, as US state laws define those terms; will not retain, use or disclose it for any purpose other than providing the Service, or outside its direct business relationship with Customer; and will not combine it with personal data from other sources except as Data Protection Law permits a service provider to do. Verlix understands these restrictions and will comply with them.

3.4 If Verlix finds that it can no longer meet its obligations under Data Protection Law, it will tell Customer, and Customer may take reasonable steps to stop and remedy any unauthorized processing.

4. Customer's responsibilities

4.1 Customer is responsible for having a lawful basis for the processing, and for giving Data Subjects every notice Data Protection Law requires, including notice that contracts and billing records are processed with AI and that collections messages are sent through the Service.

4.2 Customer is responsible for keeping Customer Personal Data accurate and for choosing settings in the Service that suit its obligations.

4.3 Customer will not submit special categories of personal data, or data about criminal convictions, to the Service.

5. Confidentiality of personnel

5.1 Verlix will make sure that every person it authorizes to process Customer Personal Data is bound by a duty of confidentiality, is trained in protecting personal data, and has access only to the data their work requires.

6. Security

6.1 Verlix will apply the technical and organizational measures in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.

6.2 Verlix may update those measures over time, but will not lower the overall level of protection they give.

7. Sub-processors

7.1 Customer gives Verlix general authorization to engage Sub-processors in the categories below.

7.2 The named list of Sub-processors is available on request from privacy@verlix.ai.

7.3 Payment providers and other Connected Services that Customer links to the Workspace are engaged by Customer under its own agreements. Verlix exchanges data with them only on Customer's instruction, and they are not Verlix's Sub-processors.

7.4 Verlix will bind each Sub-processor by a written agreement that protects Customer Personal Data at least as well as this DPA does, and remains responsible to Customer for each Sub-processor's performance.

7.5 Verlix requires each Sub-processor in the AI model processing category to use Customer Personal Data only to return results to Verlix, and never to train its models with it.

7.6 Verlix will notify Customer's administrators by email at least 30 days before a new Sub-processor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds by writing to privacy@verlix.ai within that period. The parties will then work in good faith to find an alternative. If they cannot, Customer may end the affected part of the Service, and Verlix will refund the prepaid fees for the rest of the term for that part.

7.7 Where a person in the Workspace turned contract reading on, rather than leaving it on by default, Verlix will ask for that choice to be confirmed before it sends Documents to a newly engaged AI model provider.

8. Assistance with Data Subject requests

8.1 The Service lets Customer view, correct and export Customer Personal Data, through the application and the API.

8.2 If Verlix receives a request from a Data Subject about Customer Personal Data, it will pass the request to Customer within five business days, and will not answer it except to direct the Data Subject to Customer, unless Customer authorizes Verlix to do so.

8.3 Where Customer cannot meet a Data Subject request through the Service itself, Verlix will give reasonable help, taking into account the nature of the processing.

9. Personal Data Breaches

9.1 Verlix will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach.

9.2 The notice will describe, as far as Verlix then knows, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Verlix will add information as it becomes available.

9.3 Verlix will take reasonable steps to contain and remedy the breach, and will help Customer meet its own duties to notify authorities and Data Subjects.

9.4 A notice under this Section 9 is not an admission of fault or liability.

10. Impact assessments

10.1 Verlix will give Customer the information it reasonably needs to carry out a data protection impact assessment of the Service, and to consult a supervisory authority where Data Protection Law requires it.

11. Return and deletion

11.1 During the term, Customer may export Customer Data at any time through the Service and the API.

11.2 When the Verlix Contract ends, administrators may export Customer Data for 30 days. Within 30 days after that period, Verlix will delete Customer Personal Data from the Service, and backups that hold it will expire within a further 35 days.

11.3 Two records are kept longer, because their purpose is to make financial records trustworthy:

• issued invoices and credit notes are held in write-once storage for seven years from their issue date, cannot be altered or deleted before then, are used only to restore Customer's records at its request or when the law requires, and are deleted when that period ends;
• the audit trail of actions in the Workspace is kept for seven years, and identifies people only by pseudonymous identifiers and shortened IP addresses.

11.4 Verlix may also keep Customer Personal Data where the law requires it, and will protect it under this DPA for as long as it does.

11.5 On request, Verlix will confirm in writing that deletion is complete.

12. Audits

12.1 Verlix will make available the information Customer reasonably needs to verify Verlix's compliance with this DPA. That includes Verlix's SOC 2 report once issued, the summary of its most recent independent penetration test once one has been completed, and answers to a reasonable security questionnaire once a year. Verlix's SOC 2 Type I examination is in progress.

12.2 If that information is not enough to show compliance, or if a supervisory authority requires it, or after a Personal Data Breach, Customer may audit Verlix's compliance once in any 12 months. Customer must give at least 30 days' notice, use an auditor bound by confidentiality, avoid disrupting Verlix's operations, and bear its own costs.

13. International transfers

13.1 Verlix stores and processes Customer Personal Data in the United States. When Verlix offers a data region in the European Union, Customer may choose it where the Service allows.

13.2 Where Customer Personal Data is transferred from the European Economic Area to Verlix, the Standard Contractual Clauses apply and are incorporated into this DPA: Module Two where Customer is a controller, and Module Three where Customer is a processor. For those clauses:

• clause 7, the docking clause, does not apply;
• under clause 9, option 2 applies, with the notice period in Section 7.6 of this DPA;
• the optional language in clause 11 does not apply;
• under clauses 17 and 18, the law and courts of Ireland apply;
• Annex 1 of this DPA completes Annex I of the clauses, and Annex 2 of this DPA completes Annex II.

13.3 Where Customer Personal Data is transferred from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies to the Standard Contractual Clauses, completed with the information in this DPA.

13.4 Where Customer Personal Data is transferred from Switzerland, the Standard Contractual Clauses apply with the changes Swiss law requires, with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.

13.5 If the Standard Contractual Clauses conflict with this DPA, the clauses control.

14. Liability

14.1 Each party's liability under this DPA is subject to the exclusions and limits in Section 15 of the Terms, and liability under this DPA and the Terms together counts toward a single limit.

14.2 Nothing in this Section 14 limits any right a Data Subject has under the Standard Contractual Clauses.

15. Term and order of precedence

15.1 This DPA lasts for as long as Verlix processes Customer Personal Data.

15.2 On the processing of personal data, this DPA controls over the Terms and the Verlix Contract.

15.3 Verlix may update this DPA as Data Protection Law requires, or to describe changes to the Service that do not lower the protection it gives. Verlix will notify administrators of any change at least 30 days before it applies.

16. Contact

Data protection questions, objections and requests: privacy@verlix.ai

Legal notices: legal@verlix.ai

Annex 1: Details of the processing

Subject matter. Providing the Service to Customer under the Terms.

Duration. The term of the Terms, plus the export and deletion periods in Section 11.

Nature of the processing. Hosting and storing; collecting records from the Connected Services Customer links; computing invoices, credit notes, payment matches, revenue schedules, journal entries, reports and metrics; reading Documents with AI while contract reading is on; sending and receiving email on Customer's behalf; and producing exports.

Purpose. To bill Customer's End Customers, collect payments, recognize revenue, report on Customer's finances and connect these activities to Customer's other systems, as Customer instructs.

Data Subjects.

• Customer's Users;
• End Customers who are individuals, and the staff and contacts of End Customers that are businesses;
• people named in Documents, such as signatories;
• people who write to or receive email from the Workspace.

Types of personal data.

• names, job titles, business email addresses, phone numbers and postal addresses;
• tax identifiers of End Customers;
• signatures and other details within Documents;
• subscription, usage, invoice, credit note, payment and bank transaction records, including payment method type and partial account details;
• the content of collections emails and replies;
• Users' sign-in records, pseudonymous identifiers and shortened IP addresses in the audit trail.

Special categories. None are intended, and Section 4.3 bars Customer from submitting them.

Frequency. Continuous, for as long as the Service is used.

Sub-processors. As Section 7 describes, for the purposes in the table there.

Annex 2: Technical and organizational measures

Encryption. Data is encrypted in transit with TLS 1.2 or higher, and encrypted at rest. The credentials for each Connected Service are encrypted again, field by field, before they are stored.

Separation. Each customer's data is kept logically apart from every other customer's, and each Workspace's Sandbox data is kept apart from its Live data. Every request reaches exactly one plane, and a request that names no valid plane is refused.

Access control. Users sign in with passwords and multi-factor authentication or single sign-on. Each User holds one role that sets their permissions, and sensitive actions need recent re-authentication and, where the Workspace requires it, a second person's approval. Verlix staff access to production is limited to those who need it, and every service holds only the permissions it uses.

Audit trail. Actions in each Workspace are recorded in a tamper-evident audit trail kept for seven years.

Email safety. Inbound email is scanned for malware before any part of the Service reads it.

Vulnerability management. Software and its dependencies are scanned for known vulnerabilities, critical findings are fixed within 7 days and high findings within 30 days, and an independent firm tests the Service at least once a year.

Resilience. Data stores are backed up continuously, with point-in-time recovery, and backups expire within 35 days.

Change management. Every production change is reviewed and traceable to its author and its source revision.

Incident response. Verlix keeps an incident response plan, reviews it every year and rehearses it.

Supplier review. Verlix reviews the security of its critical suppliers every year.

Assurance. Verlix's SOC 2 Type I examination is in progress.