Data Processing Addendum

Customer is the Data Controller. Market Fortress is the Data Processor with respect to Customer Data. We process data only on documented instructions from the Customer, as set out in the Terms of Service and this DPA.

This DPA applies for the duration of the Service subscription. Processing terminates with the end of the subscription, subject to the 30-day export window.

• Customer's personnel (officers, directors, employees) using the Service.
• Personnel of customer's service providers (auditors, counsel, transfer agents).
• Beneficial owners and shareholders identified in filings ingested by the Service.

• Identification data (name, email, role, organization).
• Authentication data (hashed credentials, session tokens, audit metadata).
• Filings and disclosures uploaded or ingested.

• Vercel. Application hosting (US).
• Supabase. Database, authentication, storage (US).
• Google Cloud Platform. Vertex AI inference for MNPI in customer-isolated VPC (US).
• Google AI. Gemini API for public-record analysis (US).
• Resend. Transactional email delivery (US).
• Sentry. Application observability and error reporting (US).

Where personal data of EEA, UK, or Swiss residents is transferred outside those regions, transfers rely on the Standard Contractual Clauses (Module Two for Controller-to-Processor) along with supplementary measures including encryption in transit and at rest.

We implement appropriate technical and organizational measures including the items detailed in our Security Statement and Security Whitepaper.

If we become aware of a personal data breach, we will notify affected Customers without undue delay and in any event within 72 hours of confirmed identification, with such information as is reasonably available at the time.

Customers may audit our compliance with this DPA once per calendar year on reasonable notice and at the Customer's expense, subject to confidentiality obligations and reasonable scheduling.

We may update the subprocessor list. Customers will be notified by email at least 30 days before any new subprocessor is engaged for the processing of personal data.

DPA questions? Email privacy@marketfortress.app. To execute a signed DPA, contact legal@marketfortress.app.