Data Processing Agreement
Last updated: September 15, 2026
1. Parties
This Data Processing Agreement (“DPA”) is between:
- CaseRail Technologies Inc. (“Processor”)
- The Tenant (“Controller”)
2. Purpose
Processor provides a multi-tenant SaaS platform for case and record management.
3. Roles
Controller determines:
- Purpose of processing
- Categories of data
- Lawfulness of data collection
Processor processes data only on Controller instructions.
4. Processor Obligations
Processor shall:
- Maintain security measures (role-based access control and audit logs; field-level encryption and multi-factor authentication where enabled for Controller’s deployment)
- Ensure Tenant data isolation
- Assist Controller with data subject requests where technically feasible via the platform’s data subject request tooling
- Notify Controller of security incidents
- Maintain a list of subprocessors
- Execute appropriate cross-border transfer safeguards where required
5. Subprocessors
Processor may use the subprocessors listed at /legal/subprocessors. Controller authorizes these subprocessors. Processor will notify Controller of material changes.
6. Data Subject Rights
Processor assists Controller only to the extent supported by the platform’s data subject request features.
7. Retention & Deletion
Processor deletes data according to Controller-configured retention policies.
8. Liability
Processor’s liability under this DPA is limited to fees paid in the preceding 12 months.
9. Governing Law
British Columbia, Canada.