1. Roles & scope

You (the Client) are the data controller. BusFactor is the data processor, acting only on your documented instructions to analyze communication metadata: who works with whom, and who owns or approves what. The scope of each source is agreed with you in writing before it is connected. BusFactor's analysis works on communication metadata. It never stores the text of a message or the contents of a file, and never sends either to an AI model, on any setting. A test checks this on every build. BusFactor does not process customer records or special-category data.

2. What we process

• Directory data: name, title, department, work email.
• Communication metadata: sender, recipients, channel, timestamp. Message text is never stored and never sent to an AI model, on any setting.
• Optional documents you provide (org charts, key-person lists) for ownership and structure.

Every name and channel is replaced with a code before any analysis or AI processing. The re-identification mapping is used only to label your own report.

Content depth. Content depth is set per source, and is whatever you and BusFactor agreed for that source in the scoping exercise. Where a platform returns message text alongside the metadata, the analysis reads it in memory only to compute yes-or-no signals, such as whether a message is a question, and drops it in the same step. Switching on deeper analysis for a source lets those checks read up to 500 characters of each message for the length of the run. A file import that includes a chat export (a Slack export, for example) does contain message text: the uploaded file is held only while it is read, the text is read in memory for the same checks, and none of it is stored or sent to an AI model. Hybrid-broker deployments carry no message text at all. In every case only counts go forward, and nothing from message text appears in the report. The enabled sources are recorded and can be changed or switched off by you at any time.

3. Subprocessors

For the managed (cloud) deployment, BusFactor uses:

• Anthropic: the analysis model (receives coded metadata and computed signals only, never message text, on any setting; does not train its models on data submitted via its API).
• Supabase: database & authentication.
• Vercel: application hosting.
• Stripe: billing (card data goes directly to Stripe; BusFactor does not store it).
• Resend: transactional email.

Each subprocessor is bound by confidentiality and data-protection obligations. BusFactor will give you reasonable prior notice of any new subprocessor and an opportunity to object on legitimate data-protection grounds. For the on-premise and file-import deployments, no subprocessor receives your data: processing stays within your environment or an isolated workspace, as specified in your order. The one optional exception on-premise: if your admin emails the first calibration report to BusFactor for review, Resend delivers that one email, and BusFactor deletes the report within 30 days.

4. Security

Data is encrypted in transit (TLS) and access-controlled. Access tokens are encrypted at rest. Processing runs in isolated, access-logged workspaces. BusFactor maintains least-privilege access and does not sell or share your data.

5. Retention & deletion

For a one-time assessment, your data is deleted within 30 days of report delivery (or on request), including backups, using NIST SP 800-88 media-sanitization methods, and a Certificate of Data Deletion is issued. For an ongoing subscription, data is retained for the term and deleted on termination.

When an analysis runs in the background for a connected-source deployment, the communication metadata fetched for that run is held encrypted for the length of the run and at most 24 hours: a ceiling enforced by the database itself, not by application code, then deleted, whether the run completes, fails, or is abandoned. An hourly sweep removes any expired copy and verifies it is gone, and an expired copy is never analyzed. This is strictly less than a file-import deployment keeps, where your uploaded export is stored encrypted with no fixed end date. Sources you have opted into deeper content analysis are excluded from background runs entirely, so no message text is ever held this way.

6. International transfer, breach notification, audit

• Cross-border transfers are covered by standard contractual clauses where applicable.
• BusFactor notifies you without undue delay (and within 24 hours for the on-premise/enterprise tier) of any personal-data breach.
• You may audit compliance once per year with reasonable notice; regulator audit rights are honored.

7. Legal basis & employee transparency

Processing relies on the controller's legitimate interest in organizational continuity and risk management, not employee consent. You are responsible for notifying your staff and completing any works-council or DPIA steps required in your jurisdiction. Use the template below.

8. Term, precedence & contact

This DPA applies for as long as BusFactor processes personal data on your behalf and survives until that data is returned or deleted. It forms part of, and takes precedence over, the Terms of Service on matters of data protection. BusFactor processes personal data only for the duration and purpose set out in your order, and on your documented instructions. Data-protection questions: privacy@getbusfactor.com.

Employee Notice Template

Send this to your staff before the analysis begins. Adapt to your jurisdiction (EU Art. 13, US state notice laws, works-council rules).

Subject: How we're strengthening how our teams work together

Hi team,

We're running a short organizational review with a tool called BusFactor to understand where knowledge and key relationships are concentrated, so we can reduce risk and support the right people.

What it looks at: the sources your employer agreed to share, at the agreed scope, patterns of who works with whom (for example, which teams collaborate), drawn from systems we already use. It does not store the content of your messages or send it to any AI model, and it does not score individual performance. Every name is replaced with a code before analysis. [If you have enabled deeper analysis on a specific system, name it here, for example: "On our documentation wiki, a short part of each page is also checked by the software for things like whether it is written as steps. That text is not stored, not sent to any AI model, and nothing from it appears in the report."]

Why: to find single points of failure and make sure critical knowledge isn't stuck with one person. This protects you and the team.

If you have questions, reach out to [HR contact].

Thank you.

This is a standard template provided for convenience and is not legal advice. Have your counsel review before use.