Data processing agreement.

A. Parties, roles and purpose of this agreement

1. This agreement is between the customer named in the order form (the customer) and Jesmond AI (Defend This) Ltd, company number 17367476, of Chequers House, Chequers Lane, Watford WD25 0LG (Jesmond). It forms part of the agreement for the Jesmond service made up of the terms of use and the order form (the agreement), and it prevails over them in relation to personal data.

2. The customer is the controller of the personal data it puts into the service and of the personal data generated in running its procedures through the service. Jesmond is the processor of that data, and processes it only as this agreement describes.

3. This agreement is intended to satisfy Article 28(3) of the UK GDPR. Terms used in it, including personal data, processing, controller, processor, data subject, personal data breach and special category data, have the meanings given in the UK GDPR and the Data Protection Act 2018.

B. The zero-access position

4. The unusual feature of this agreement is how little Jesmond can do with the data it processes. The service is built so that Jesmond has no way to read case content. That is enforced by the architecture described in Schedule 3, not by policy or by staff being told not to look, and there is no override, escalation or recovery route by which Jesmond or anyone working for it can obtain readable case content.

5. In consequence, the personal data Jesmond processes falls into four kinds, described in Schedule 1: identity and account data it holds in readable form; case metadata it holds in readable form; case content, drafts and the audit trail it holds only as ciphertext it cannot decrypt; and case content that passes transiently to the model provider under the conditions in Schedule 2.

6. Where a provision of this agreement requires Jesmond to do something with personal data, it applies to the extent that the architecture makes it possible. Jesmond cannot, for example, produce, correct or search the contents of a case in response to a request, because it does not have them; clause 25 describes what Jesmond can do instead.

C. Subject matter, duration, nature and purpose

7. The subject matter of the processing is the running of the customer’s internal employment procedures, including grievances, disciplinaries, appeals and flexible working requests, through the service, and the keeping of a record of them.

8. The processing continues for the term of the agreement and for the retention and deletion periods in section K after it.

9. The nature of the processing is the hosting, routing, storage and transmission described in Schedule 1, and the transient processing of case content by the model provider under Schedule 2. The purpose is to provide the service to the customer under the agreement, and nothing else.

10. The types of personal data and the categories of data subject are set out in Schedule 1. The customer acknowledges that case content will ordinarily include special category data within Article 9 and may include data relating to criminal convictions and offences within Article 10 of the UK GDPR, and that the customer, as controller, is responsible for having a lawful basis and an applicable condition for processing it.

D. Jesmond’s obligations as processor

11. Instructions. Jesmond will process personal data only on the customer’s documented instructions, which are the agreement and this agreement, unless required to do otherwise by law, in which case Jesmond will tell the customer before processing unless the law prevents it. Jesmond will tell the customer if, in its opinion, an instruction infringes data protection law.

12. Confidentiality. Jesmond will ensure that every person it authorises to process personal data is bound by a duty of confidentiality. Jesmond notes that for case content this duty is supported by the architecture: no such person has a means of reading it.

13. Security. Jesmond will implement and maintain the technical and organisational measures in Schedule 3, and any further measures required by Article 32 of the UK GDPR having regard to the risk. Jesmond may update the measures in Schedule 3 provided the level of protection is not reduced.

14. Sub-processors. Jesmond will engage a sub-processor only in accordance with section F.

15. Data subject rights. Jesmond will assist the customer, by the measures in section H, in responding to requests from data subjects to exercise their rights.

16. Assistance. Jesmond will assist the customer in meeting its obligations under Articles 32 to 36 of the UK GDPR, including security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Jesmond, as set out in sections G and H.

17. Deletion and return. At the end of the provision of the service Jesmond will delete or return the personal data as set out in section K, and delete existing copies unless the law requires storage.

18. Demonstrating compliance. Jesmond will make available to the customer the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits as set out in section J.

E. The customer’s obligations as controller

19. The customer is responsible for: deciding what material to put into the service; having a lawful basis and, where it applies, an Article 9 or Article 10 condition for processing it; telling its employees and others whose data is involved how that data is used, including that it is processed through the service; responding to requests from data subjects; carrying out any data protection impact assessment its processing requires; and the custody of its encryption keys as set out in the terms of use.

20. The customer warrants that its instructions to Jesmond comply with data protection law and that it is entitled to put the personal data it puts into the service to the processing described in this agreement.

F. Sub-processors

21. The customer gives general written authorisation for Jesmond to engage the sub-processors listed in Schedule 2. Jesmond will give the customer at least thirty days’ notice of any intended addition or replacement, and the customer may object on reasonable grounds relating to data protection within that period. If the parties cannot resolve an objection, the customer may terminate the agreement in respect of the affected service without penalty. Jesmond will impose on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, and remains liable to the customer for the sub-processor’s performance of them.

G. Personal data breaches

22. Jesmond will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data, and in any event within 48 hours, giving the information the customer needs to meet its own obligations under Articles 33 and 34 so far as Jesmond has it, and supplementing it as more becomes available. Jesmond will take reasonable steps to contain the breach and will cooperate with the customer in dealing with it.

23. The customer acknowledges that a breach of Jesmond’s infrastructure yields, in respect of case content, drafts and the audit trail, only ciphertext that Jesmond cannot decrypt, and that the exposure in such a breach is accordingly confined to the readable data in Schedule 1 parts C and D. That acknowledgement does not limit Jesmond’s duty to notify.

H. Assistance with data subject requests and impact assessments

24. If Jesmond receives a request from a data subject relating to the customer’s personal data, it will not respond except to direct the data subject to the customer, and will pass the request to the customer promptly.

25. On the customer’s request Jesmond will provide the readable personal data it holds about a data subject, being the identity, account and metadata in Schedule 1 parts C and D, and will correct, restrict or delete it as instructed. Jesmond cannot provide, correct, search or selectively delete the contents of a case, because it holds them only as ciphertext it cannot decrypt; the customer holds the keys and can do so itself. Jesmond will assist the customer with the means the service provides for the customer to export, and to delete by clearing, its own cases.

26. On request Jesmond will provide the customer with an accurate and current description of the architecture and the measures in Schedule 3 for the purposes of the customer’s data protection impact assessment, and will answer reasonable questions about them. Whether the customer’s processing requires an impact assessment, and what it concludes, are matters for the customer.

I. International transfers

27. Jesmond processes personal data in the United Kingdom. The service is hosted in Amazon Web Services’ London region, and case content is sent to the model in that region. Jesmond will not transfer personal data outside the United Kingdom, and will not permit a sub-processor to do so, unless the transfer is covered by adequacy regulations made under the UK GDPR, by the International Data Transfer Agreement or Addendum issued by the Information Commissioner, or by another safeguard the law permits, and the customer has been told of it under section F.

J. Information and audit

28. Jesmond will make available to the customer, on request and no more than once in any twelve-month period unless a breach or a regulator requires otherwise, the information reasonably necessary to demonstrate compliance with this agreement, including a current description of the measures in Schedule 3 and the results of any independent assessment Jesmond has obtained.

29. Where that information is not sufficient, the customer or an independent auditor appointed by it and bound by confidentiality may audit Jesmond’s compliance on reasonable notice, during business hours, in a manner that does not disrupt the service or expose other customers’ data. Audits are documentary and remote unless the parties agree otherwise, and each party bears its own costs.

30. The customer notes that its own audit trail is designed to be produced by the customer without Jesmond’s involvement: it is encrypted under the customer’s keys, stored in tamper-evident storage set aside for the customer alone, and can be decrypted and exported by the customer for legal use at any time.

K. Retention, deletion and return

31. During the term the customer may export its working papers at any time, and may delete a case from the service by clearing it, which removes the sealed drafts held for that case.

32. Within thirty days after the end of the agreement, and after giving the customer the opportunity to export what it wishes to keep, Jesmond will delete the personal data it holds for the customer. For sealed data, deletion is by destroying the keys under which it is stored, which renders it permanently unreadable, and by removing the customer’s isolated storage. For readable identity, account and metadata, deletion is by erasure from the control plane and its backups within the backup retention period.

33. The audit trail is held in storage configured so that entries cannot be altered or deleted within a fixed retention period. That period is six years from the date of each entry. Deletion of the audit trail before the period ends is by destruction of the keys under which it is encrypted, which renders it unreadable to anyone, including the customer, and the customer is asked to export a copy before instructing it.

34. Jesmond may retain personal data after the end of the agreement only to the extent the law requires, and only for as long as it requires, and will continue to protect it under this agreement while it does.

L. Liability and general

35. Each party’s liability under this agreement is subject to the limitations and exclusions in the terms of use.

36. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If a provision of this agreement is found to be invalid, the rest is unaffected, and the parties will replace it with a valid provision that achieves the same aim so far as possible.

Schedule 1. Particulars of the processing

A. Data subjects. The customer’s employees, workers and former employees; managers, investigators and decision-makers in the customer’s procedures; witnesses, complainants and other people named or referred to in the material the customer puts into the service; and the customer’s users of the service.

B. Case content, held only as ciphertext Jesmond cannot decrypt. Source documents, evidence, notes, the issues, people and document categories identified, interview scripts, drafts, outcome documents and letters, model prompts and responses, and the audit trail of actions taken in a case. These may contain any category of personal data, including special category data within Article 9 (for example health, trade union membership, racial or ethnic origin, religion or belief, sex life or sexual orientation) and data relating to criminal convictions and offences within Article 10. Jesmond routes and stores this data as ciphertext encrypted in the customer’s browser under keys Jesmond does not hold, and cannot read, search, correct or selectively delete it.

C. Identity and account data, held in readable form. For each user: an identifier from the customer’s identity provider, email address, display name, organisation, role, status, and the time of last activity. Jesmond does not receive or hold passwords. This data is used to authenticate and authorise users, to enforce the customer’s access decisions on every request, and to attribute actions in the content-free audit record.

D. Case metadata, held in readable form. For each case: an opaque identifier, which tool is in use, which step it is at, timestamps and usage counts, and a content-free record of who did what and when. No names, content or free text appear in this data.

E. Case content in transit to the model, held transiently. When a user runs a tool, the material for that step is sent from the user’s browser to the model provider in Schedule 2, in readable form, over an encrypted connection, and is processed and returned to the browser. The model provider retains nothing. In the current beta the request passes through a relay on Jesmond’s domain, which holds it in memory for the fraction of a second needed to forward it, never writes it to disk and never logs it, as described in Schedule 3.

Schedule 2. Sub-processors

A. Amazon Web Services EMEA SARL (AWS). Hosting of the service in the London (eu-west-2) region: the control plane, the metadata database, the per-customer isolated storage for the audit trail and sealed drafts, and key management for at-rest encryption. AWS holds readable identity and metadata, and ciphertext it cannot decrypt. The processing is under the AWS Data Processing Addendum incorporated in the AWS Service Terms.

B. Anthropic, provided through Amazon Bedrock. The model that processes case content. This is the only sub-processor that ever handles case content in readable form, and it does so transiently, in the London (eu-west-2) region, under a zero data retention arrangement under which prompts and responses are not stored, not logged and not used to train models. Model invocation logging is disabled by an organisation-level policy that Jesmond’s own administrators cannot override.

C. 3 Sided Cube Limited. Jesmond’s engineering partner, which builds and supports the service. It uses synthesised or anonymised test data only, holds no key to any customer’s data, and has no route to readable case content. It is listed as a sub-processor because it can see readable identity and metadata in the course of support.

D. GitHub, Inc. Holds the service’s source code only. No customer personal data is processed by GitHub. Listed for completeness and so the customer can see the whole supply chain.

E. Jesmond keeps this list deliberately short. A shorter sub-processor list is treated as a feature of the service, and Jesmond will not add a sub-processor with access to readable case content.

Schedule 3. Technical and organisational security measures

A. No route to case content. Neither Jesmond nor its engineering partner has any means of reading a customer’s case content. This is enforced by the design of the service, not by policy. There is no break-glass procedure, no staff escalation route and no key recovery by Jesmond.

B. Encryption on the device. Case content, working drafts and the audit trail are encrypted in the user’s browser, using AES-256-GCM, under keys derived from the user’s sign-in credential, before they leave the device. Readable content never reaches Jesmond’s application, database or logs.

C. Key custody with the customer. Each authorised person holds their own sealed copy of the organisation’s key, locked to their own sign-in. Jesmond stores those sealed copies and cannot open any of them. A new person is enrolled by an existing key holder from that person’s own browser. Every organisation must have at least two enrolled key holders and a recovery key in the customer’s custody, so that there is no single point of key loss.

D. The model path. Case content is sent from the browser to the model provider under short-lived credentials, valid for fifteen minutes and scoped to a single model in the London region, issued by a broker after a per-organisation quota check. The browser never holds a standing credential. Requests are encrypted in transit. In the current beta the request is forwarded by a relay on Jesmond’s domain that holds it in memory only, never writes it to disk and never logs it; the rule enforcing that is set above Jesmond’s own administrators, who cannot disable it. That rule does not bind the cloud provider’s own privileged staff; Jesmond has accepted that risk for this phase and the engineering that removes it is scheduled.

E. No server-side content. The only server-side record of a case is a content-free audit trail: who did what and when, with opaque identifiers, never content and never names. The control plane holds identity, roles, which case is at which step, usage counts, and ciphertext.

F. Tenant isolation beneath the application. Shared metadata is isolated per organisation at the database engine, by row-level security, not by application code alone. The audit trail and sealed drafts are isolated physically: a separate storage location and encryption key per organisation, and a separate resume database per organisation.

G. Tamper-evident audit. The audit trail is encrypted in the browser before it reaches Jesmond, stored in write-once storage that prevents alteration or deletion within the retention period, and can always be decrypted and exported by the customer for legal use without Jesmond’s involvement.

H. Encryption at rest and crypto-shred. Stored data is additionally encrypted at rest under keys managed in AWS Key Management Service, per organisation. Those keys are the at-rest layer and the mechanism for deletion; they are not the protection, because the data beneath them is already encrypted under the customer’s keys. Deletion is by destroying keys, which renders the data permanently unreadable even where the storage itself cannot be erased.

I. Identity and access. Users authenticate through the customer’s own corporate identity provider; there is no public sign-up. Tokens are validated server-side with issuer, audience and tenant pinned, and every request carries a signed assertion of identity and organisation. Removing a user takes effect on their next request. Access within an organisation is deny-by-default: a person sees only the cases they are assigned to. Administrative actions by Jesmond staff are themselves audited, and Jesmond staff have no case-content path.

J. Engineering and support. The engineering partner builds and supports the service with synthesised or anonymised test data only. Support works from metadata; there is no support view of case content and no escalation that creates one.

K. Organisational measures. Jesmond is implementing an information security management system aligned to ISO 27001, covering staff confidentiality and access, incident response, business continuity and backups, and will provide its current policies to the customer on request under section J.