Data Processing Agreement (DPA)

Effective Date: October 25, 2026 • Controller-to-Processor Terms governing Real Builds LLC (d/b/a VendorsCert™ and PactIQ™), 5725 S Valley View Blvd Ste 5 #213698, Las Vegas, NV 89118-3122 US.

1. Scope, Roles & Statutory Alignment

Governs the processing of Personal Data and Business Contact Data in accordance with CCPA/CPRA, Washington RCW 19.255.010, Nevada NRS 603A, and GDPR Article 28.

2. Zero AI Model Training & DLP Redaction Guarantee

Customer data is never used to train public or foundation AI models. Automated DLP masks SSNs, EINs, bank routing numbers, and payment card PANs prior to inference.

3. Technical & Organizational Security Controls (Annex II)

• Encryption in Transit & at Rest: TLS 1.3 (HSTS enforced) and AES-256 encryption at rest in US cloud data centers.
• Zero-SMS Authentication Posture: OAuth 2.0 and RFC 6238 TOTP Authenticator Apps.
• Tamper-Evident SHA-256 Cryptographic Audit Evidence & Signer Attribution: Pursuant to 15 U.S.C. § 7001 (ESIGN Act) and RCW 1.80 (UETA), every executed PactIQ™ agreement is sealed with full 64-character "Before" and "After" SHA-256 hexadecimal digests, IPv4/IPv6 origin logs, and tamper-evident audit timestamps to support evidentiary attribution.

4. Security Incident Notification (72-Hour SLA)

Notification without undue delay and in no event later than seventy-two (72) hours after confirming a breach of security.

5. Data Deletion, Export & Subprocessor Governance

$0.00 bulk export available anytime. Authorized subprocessors (including Telnyx LLC) are published at /subprocessors.