Data Processing Addendum

Customer (or the carrier or agency it acts for) controls the personal information. Relay is a service provider and processor, and processes it only on Customer’s documented instructions: to receive, validate, normalize, route, deliver and retain it as configured.

Everyone at Relay with access to customer data is bound by confidentiality. Staff access customer data only through a time-limited, reasoned break-glass session recorded in Customer’s audit log.

• Encryption in transit and at rest, with a per-organization data key and field-level encryption of restricted fields.
• Multi-factor authentication for privileged users and all staff.
• Tenant isolation enforced in the application and by database row-level security, tested automatically.
• Audit logging of authentication, credential changes, data reveals and staff access.
• Retention limits and nightly purges, as published in the Privacy Policy.

Relay will cooperate with Customer’s oversight duties under state laws based on the NAIC Insurance Data Security Model Law (#668) and 23 NYCRR Part 500, including reasonable security questionnaires, evidence of controls, and the incident notice below.

Relay will notify Customer without undue delay, and within 48 hours of confirming a security incident affecting Customer’s data, with the information Customer needs to meet its own notice obligations. Final timing is subject to counsel review.

Relay uses the listed sub-processors under written terms at least as protective as this addendum, and will give 30 days’ notice of new ones so Customer can object.

Relay will help Customer respond to individuals’ privacy requests about data Relay holds, and will forward any request it receives directly.

On termination Relay deletes Customer data within 30 days, destroying the organization’s encryption key, except non-personal transmission records retained for 7 years as proof of delivery.

Relay will provide information reasonably needed to show compliance. Once a SOC 2 report exists it will be provided under NDA in place of on-site audits, except where the law requires otherwise.