Data Processing Agreement
Last updated: October 15, 2026
1. Parties
This Data Processing Agreement (“DPA”) is entered into between:
- Data Controller: The customer organization that subscribes to and uses the Tendgine application.
- Data Processor: Tendgine (operated by Medallion Intelligence Corp.), acting on behalf of the Data Controller to process personal data as described herein.
2. Data Processed
The Processor processes the following categories of data on behalf of the Controller through the Tendgine application:
- RFP Documents: Uploaded proposals, tender documents, and related attachments.
- Employee PII: Names, roles, qualifications, experience, resumes, and contact details of personnel included in proposals.
- Client Contacts: Names, email addresses, phone numbers, and organizational details of client contacts and feedback reviewers.
3. Sub-Processors
The Processor engages the following sub-processors to deliver the Tendgine service. The Controller consents to the use of these sub-processors:
| Sub-Processor | Purpose | Region |
|---|---|---|
| Supabase Inc. | PostgreSQL database + Object Storage (file uploads) | AWS ca-central-1 (Montreal, Canada) |
| Anthropic, PBC | AI text generation (RFP triage, drafting, scoring); Anthropic API does not train on submitted content | United States |
| OpenAI, Inc. | Text embeddings (pgvector) + completion fallback when Anthropic is overloaded; OpenAI API does not train on submitted content | United States |
| Microsoft Azure | Application hosting (App Service) + daily backup of uploaded files (Blob Storage) | Canada Central |
| Microsoft 365 (SMTP) | Outbound transactional email (feedback requests, review requests, notifications) | Per tenant SMTP config |
| Sentry | Error monitoring + performance tracing; PII redaction filter scrubs emails / JWTs / API keys before send | United States |
| GitHub Actions | CI runner + scheduled storage backup cron; processes source code only — no Customer data | Microsoft Azure-backed |
| Google (reCAPTCHA and Analytics) | Bot protection on sign-in, password reset and public forms; website analytics only after cookie consent and never on pages sent to outside parties. Receives browser signals and page views, not form contents | United States |
| Mapbox | Geocoding for the CRM and RFP Hunter maps (primary; only when configured). Receives a CRM account's business address (street, city, province, postal code, country) and tender location text — no names or contact details | United States |
| Quo (formerly OpenPhone) | CRM text messaging, only for companies that connect a Quo workspace. Receives sent text content (with the company's name and opt-out footer), the contact's mobile number and the sending number; returns replies and delivery statuses. Data processing agreement to be confirmed before production use | United States (to be confirmed) |
| ZeroBounce | CRM contact email verification, only for companies that connect their own ZeroBounce account and only when an administrator runs it. Receives contact email addresses and nothing else. Data processing agreement to be confirmed before production use | United States |
| Nominatim (OpenStreetMap Foundation) | Geocoding fallback, and the only geocoder when Mapbox is not configured; receives the same address and location text. No data processing agreement exists — a free public service used under the OpenStreetMap Foundation's usage and privacy policies | United Kingdom + Netherlands (backups EU) |
Cross-Border Data Flow: Customer data — including the primary database, Object Storage, application traffic, and daily backups — is processed and stored entirely in Canada: Supabase on AWS ca-central-1 (Montreal) and Microsoft Azure in Canada Central. Cross-border processing applies only to ancillary services: Anthropic and OpenAI receive text excerpts of RFP content during AI generation (contractually bound NOT to train on submitted content); Sentry receives error logs and breadcrumbs with PII redaction applied; the geocoders (Mapbox in the United States; Nominatim in the United Kingdom and the Netherlands) receive CRM account business addresses and tender locations to place them on a map; Quo (texting, only for companies that connect it) receives contact mobile numbers and text content; ZeroBounce (email verification, only for companies that connect their own account) receives contact email addresses; google (reCAPTCHA on public forms, and analytics after cookie consent) receives browser signals and page views. The geocoders were added to this list on 2026-09-28 (v3.416.0) as a correction: both had received location data since 2026-04-09 without being listed. Google was added on 2026-10-08 as a correction: reCAPTCHA and consent-gated analytics were in use without being listed. PIPEDA Sec. 4(3.1) requires disclosure of cross-border processing — this constitutes that disclosure. AI features cannot currently be switched off for a single company, so Customers with strict no-cross-border requirements should raise this before onboarding; Sentry can be opted out via the SENTRY_DSN env var. The primary database + Object Storage were migrated from AWS us-west-2 (Oregon) to ca-central-1 on 2026-05-11 (v3.76.12); the disclosure was updated 2026-05-13 (v3.77.5).
4. Security Measures
The Processor implements and maintains the following technical and organizational security measures to protect personal data:
- Encryption at Rest and in Transit: All traffic uses TLS with HTTP Strict Transport Security. The database and file storage are encrypted at rest by the hosting providers; two-step sign-in secrets and texting credentials are also encrypted by the application.
- Authentication: bcrypt-hashed passwords with a strength policy, rate-limited sign-in, optional or company-mandated two-step sign-in, and JSON Web Token sessions in httpOnly cookies: access tokens expire after one hour and sessions renew for at most seven days.
- Company-Scoped Access: Multi-tenant isolation is enforced in the application on every request, so each organization can only access its own data, within the permissions of each user's role. Row-Level Security is enabled on every database table and blocks direct public access to the database.
- Audit Logging: Sign-ins, failed sign-ins and significant changes are logged to an audit trail with user identity, timestamp and action details.
5. Data Retention
- Active Data: Personal data is retained for as long as the Controller's subscription to the Tendgine application remains active.
- Post-Termination: Upon termination of the subscription, all personal data will be deleted within 90 days, unless a longer retention period is required by applicable law.
- Audit Logs: System audit logs are retained for 2 years for compliance and security purposes, then deleted by a daily maintenance job.
6. Data Subject Rights
The Processor assists the Controller in fulfilling data subject rights requests. Data subjects may exercise the following rights:
- Right of Access: Data subjects may request an export of their personal data via the Privacy Policy data export process.
- Right of Erasure: Data subjects may request deletion of their personal data via the Privacy Policy data deletion process.
7. Breach Notification
In the event of a personal data breach, the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification shall include the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed to mitigate the breach.
8. Contact
For questions about this Data Processing Agreement or to exercise data subject rights, email info@medallionintelligence.com.