Askhive

Data Processing Agreement

For Askhive Practice: you are the controller of your clients' data, and we are your processor.

Last updated: 29 September 2026

Written by us, in plain language, and kept true rather than lawyerly: every factual sentence here is one we can show you the mechanism for. If anything looks wrong, tell us at support@bridgeshorelabs.com and we will correct it.

What this is and when it applies

This Data Processing Agreement applies when you use Askhive Practice and put your clients' personal data into it. It forms part of the Terms of Service.

It does not apply to consumer use of Askhive, where you are the subject of your own data and we are the controller — that is covered by the Privacy Policy.

1. Roles

You are the controller. We are your processor. Your clients' names, email addresses, the briefs you write about them and the deliverables you produce are yours. You decide what goes in, what it is for, and how long it stays. We process it only to provide Askhive Practice to you and only on your documented instructions, of which your use of the product is the primary one.

Separately, we are an independent controller of your own account data — your email, your firm profile, your subscription. That is not covered here.

We will tell you if an instruction of yours appears to us to breach data protection law, and we may decline to act on it.

2. Annex A — details of processing

Item	Detail
Subject matter	Drafting client deliverables from briefs you provide
Duration	For as long as your Practice subscription is active, plus the deletion window in §8
Nature and purpose	Storage, retrieval, redaction, model-assisted drafting, rendering, and delivery by link or email
Types of personal data	Client name, email address, interface locale; notes you keep on a client record (entity type, fiscal year, engagement scope, and preferred form of address); the content of briefs and deliverables, which may contain financial, tax, legal or other information you choose to include; attached source documents
Categories of data subject	Your clients, and any individual you write about in a brief
Special categories	Not requested and not required. If you put special-category data into a brief you remain responsible for having a lawful basis under GDPR Art. 9.
Frequency	Continuous, as you use the product
Location	United States (AWS us-east-1, Northern Virginia)

The categories, purposes, lawful basis and retention we hold on your behalf:

Category	Purpose	Lawful basis	Retention
Questions, answers and reportsWhat you asked and the report it produced.	Produce your report and show it to you again when you come back	Performance of a contract	Until you delete the report or your account
AttachmentsPractice only: a document a firm attached to a client's deliverable.	Keep a professional's source document with the deliverable it produced	Performance of a contract	Until the report or the account is deleted
Practice client recordsA firm's notes about its own client — name, email, and the details it keeps so it does not retype them.	Let a professional address a deliverable to their client, draft without asking the same questions twice, and track engagement	Performance of a contract — the professional is the controller of this data; we are their processor	Until the professional deletes the client or the account
Engagement eventsWhether a delivered report was opened, read or replied to.	Show a professional whether their client opened the report	Legitimate interests of the professional, as controller	Cascades when the report is deleted

3. Annex B — security measures

These are the measures the system actually implements, not a list of aspirations.

Tenant isolation. Every table carries row-level security keyed to the workspace, enforced by the database rather than by application code. One firm cannot read another firm's client data even if the application is wrong. Attachments are stored under a per-workspace path and the storage policy checks that path.
No implicit access. Database roles used by browsers hold no privileges in the public schema; access is granted explicitly, per object, and an automated check, run before release, fails if a new table or function becomes client-reachable without a decision.
Redaction before the model. Identifiers in a brief — SSN, EIN, bank routing and account numbers, dates of birth, and optionally the client's name — are replaced with tokens before the brief is sent to the model provider, and restored into the finished draft afterwards. Identifiers Askhive recognises in labelled text are removed before the text goes to the model provider; attachments and free text may still carry them, so a firm should send no more identifying detail than the task needs.
Encryption. In transit with TLS; at rest by our infrastructure provider.
Access control on delivered reports. Client links carry a six-digit passcode by default. Wrong guesses are slowed and then refused, enforced inside the database function so that no route around the check exists.
Audit trail. Every edit a professional makes to an AI-drafted block is recorded — what changed, in which block, before and after — so the distinction between what the model wrote and what you approved is evidenced rather than asserted.
Deletion. Account deletion removes the rows, including cascading client records, reports, edit history and engagement events. It deletes rather than deactivates.
Files, after deletion. A file is removed from the live store the moment it is deleted. Askhive also keeps its own nightly copy of every file — the provider's database backups hold the records of files, not the files — so a deleted file can still exist in that copy for up to 30 days, until the copy's own retention rule removes it. The copy is a private bucket: no client and no signed-in person can read it, and only a restore run by Askhive can reach it.
Backups. The database: daily, kept seven days. Uploaded files are not in those backups; Askhive copies them nightly into a second bucket on the same provider, kept thirty days. Restores are rehearsed against a scratch schema, never over production. Point-in-time recovery is not yet enabled, so the worst-case recovery window is 24 hours.

4. Confidentiality

Everyone at Bridgeshore Labs, LLC with access to your data is bound by confidentiality obligations. Access is limited to those who need it to run or support the service.

5. Sub-processors

Email you forward to us. Where you forward a client's email to your Practice address, the mail provider keeps a copy for thirty days and its backups for seven more; we delete our own copy at once, and ask the provider to remove a specific message sooner when a firm asks us to. We do not store the original message; the draft it produces is Customer Data under this agreement and is deleted on your instruction like any other. The provider offers no deletion API for received mail, so a removal request is made by us to the provider on your behalf.

You authorise the sub-processors below. The current list is always at askhive.app/legal/subprocessors.

Sub-processor	Purpose	Data	Location
Supabase, Inc.	Database, authentication, file storage, and the server functions that run the productThe primary store. Everything else in this list receives a subset of what Supabase holds.	Account email, questions and reports, Practice client records and attachments, usage counters	United States (AWS us-east-1, Northern Virginia)
Anthropic, PBC	The language model that reads a question and drafts the reportPractice briefs are redacted before they are sent: identifiers are replaced with tokens and restored afterwards, so the model receives [SSN_1] rather than the number.	The question text, any attached file, and the clarifying answers — sent per request, not stored by us there	United States
Anthropic, PBC — web search	Research for a Deep Dive: the model's own web search, used to find and cite sources Used only for the Deep Dive and the Research memo, not yet available.	Search queries built from the report's topic. They carry no name, account number or other identifier, and the person's own documents are never sent to search.	United States
OpenAI, L.L.C.	Concept images for a Deep Dive — the illustrations captioned as AI-generated Used only for the Deep Dive and the Research memo, not yet available.Chosen on provenance rather than price: the images come back carrying C2PA metadata saying they were machine-made, and the bytes are stored unmodified so that mark survives.	A written description of the picture to draw, composed from the report's topic. No personal data, no attachments, and no part of a Practice client's record.	United States
Vercel, Inc.	Hosting for askhive.app, the shared-report pages, the Practice web app, and uptime monitoring	Request metadata (IP address, user agent) in ordinary web logs; the content of a shared report as it is served	United States
Stripe, Inc.	Subscription billing for Askhive PracticeCard details go to Stripe directly and never reach our servers. We store only Stripe's identifiers.	Billing name and email, payment method, subscription state	United States
Twilio Inc. (Verify)	Would deliver six-digit sign-in and consent codes by text message, only to a person who has given their number and consent (notification settings, PD8) Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends.	The phone number, the code, and delivery metadata. Never a name, never a report.	United States
Deepgram, Inc.	Would transcribe a professional's dictated brief or a client's voice note into text, per request Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends.	The audio clip and its transcript, per request, with the vendor's no-retention option set. Nothing stored there.	United States
Voyage AI Innovations Inc.	Would turn report and client-record text into embeddings for search by meaning across a firm's own workspace; the index itself would live in Askhive's own database Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends.	The text of a report or a client record, sent once to embed and not stored by the vendor.	United States
Cloudmersive, LLC (Virus Scan API)	Would scan a client's uploaded file for malware before the firm can open it Not yet in use — may be used from October 30, 2026, when the thirty days' notice given on naming it ends.	The uploaded file, sent once to scan and not stored by the vendor; the verdict	United States
Resend (Plus Five Five, Inc.)	Transactional email — delivered reports, refinement notifications, account mail	Recipient email address and the message content	United States

Change notice. We will give you 30 days' notice before adding or replacing a sub-processor, by email to the address on your workspace and on the sub-processors page. If you reasonably object on data-protection grounds within those 30 days, you may terminate your Practice subscription without penalty and receive a pro-rata refund of any prepaid unused period.

6. International transfers

Askhive runs in the United States. Where you transfer personal data of individuals in the EEA, the UK or Switzerland, the Standard Contractual Clauses apply and are incorporated into this agreement by reference — Module Two (controller to processor) between you and us, and Module Three (processor to processor) where you are yourself a processor for your client. The UK International Data Transfer Addendum applies to UK transfers. Where the Clauses require a choice, the governing law is Ireland and the supervisory authority is the Irish Data Protection Commission.

7. Personal data breach

If we become aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point.

Reporting to a supervisory authority and to affected individuals is your decision and obligation as controller. We will give you the information and assistance you reasonably need to make it.

8. Assistance, audit, deletion

Data subject requests. If one of your clients contacts us directly we will not respond substantively; we will refer them to you and tell you. We will help you answer within the time the law allows.

Assistance. We will provide reasonable assistance with data protection impact assessments and prior consultations, taking into account the nature of processing and the information available to us.

Audit. We will make available the information reasonably necessary to demonstrate compliance with this agreement and allow for audits, including inspections, by you or an auditor you mandate — on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise, during business hours, and subject to confidentiality.

Deletion on termination. When your subscription ends you may export your data yourself, from Account → Export my data — a zip of JSON covering the workspace you own, its reports and its clients, with any attached files linked for a week. After that, on your written request or in any event within 30 days of termination, we will delete the personal data we process for you, except where law requires us to keep it — in which case we will tell you what and why.

9. Liability and precedence

Liability under this agreement is subject to the limitations in the Terms of Service. Where this agreement conflicts with the Terms on the processing of your clients' personal data, this agreement prevails; where it conflicts with the Standard Contractual Clauses, the Clauses prevail.

10. How this is accepted

Accept this agreement in Practice → Settings → Data Processing Agreement. We record who accepted it, when, and which version, and email you a countersigned copy for your records. Questions: privacy@bridgeshorelabs.com.