---
title: Data Protection and Security Addendum
doc: dpa
version: "1.0"
effective: "11 October 2026"
---

# Data Protection and Security Addendum

This addendum is part of the Customer Terms of Service between Lomatico LLC ("Lomatico", "we", "us") and the customer that accepted them ("Customer", "you"). It governs how we process Customer Data. Words defined in the Customer Terms have the same meaning here. If this addendum and the Customer Terms conflict on the processing of Customer Data, this addendum controls.

## 1. Roles

1.1 **You are the financial institution; we are your service provider.** For the purposes of the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 C.F.R. Part 314), you are a financial institution and we are a service provider that receives Customer Data, including nonpublic personal information, in order to provide the Service to you.

1.2 You decide what Customer Data is collected, from whom, and for what purposes. We process it on your behalf and on your instructions. Your instructions are this Agreement and your use of the Service's features. We will tell you if we believe an instruction breaks the law.

## 2. Purpose limitation

We process Customer Data only to provide, secure, maintain and support the Service for you, and as the law requires. We do not sell Customer Data, use it for our own marketing, combine it with data from other customers, or use it to train artificial intelligence models. We do not disclose it except as this addendum allows.

## 3. Personnel

Everyone we authorise to access Customer Data is bound by a duty of confidentiality, receives access only where their work requires it, and loses access when it no longer does.

## 4. Security

4.1 We maintain the technical and organisational measures in Schedule 1. They describe what is in place today. We will not reduce the overall protection they give during your subscription.

4.2 **What we do not claim.** We do not hold a SOC 2 report, an ISO 27001 certificate or any other third-party security attestation, and nothing in this Agreement implies that we do. Multi-factor authentication is not yet required for every person with privileged access; until it is, Schedule 1 does not list it. We will tell you when either changes.

4.3 You are responsible for the security of your own accounts, devices and credentials, for choosing which Users have access, and for overseeing us as your service provider as the Safeguards Rule requires. Section 8 is how we help you do that.

## 5. Subprocessors

5.1 You authorise us to use the subprocessors listed in Schedule 2. The page at lomatico.net/trust/data describes, service by service, what each receives, when, and what never goes to it.

5.2 We impose data protection obligations on each subprocessor that are no less protective than this addendum, to the extent the services it provides allow, and we remain responsible for their performance.

5.3 We will give you at least 30 days' notice by email before we add or replace a subprocessor that will receive Customer Data, and update lomatico.net/trust/data. If you object on reasonable data protection grounds, tell us within that period. We will try to address the objection. If we cannot, you may end your subscription before the change takes effect and we will refund fees you prepaid for the period after it ends. Where a change is needed urgently for security or to keep the Service running, we will give notice as soon as we can.

5.4 Services you connect yourself, such as Follow Up Boss, Arive and Facebook Lead Ads, are not our subprocessors. Data flows to and from them at your direction, under your agreements with them.

## 6. Security incidents

6.1 If we become aware of unauthorised access to, or acquisition, disclosure or loss of, Customer Data in our systems or our subprocessors' systems, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it.

6.2 Our notice will describe what happened, the Customer Data and the period involved, what we have done to contain it, and a contact for further information. We will update you as we learn more, cooperate with your investigation, preserve relevant records, and take reasonable steps to limit harm and prevent recurrence.

6.3 You are responsible for notifying consumers, regulators and others where the law requires you to. We will not notify them on your behalf without your consent, unless the law requires us to.

## 7. Assistance

7.1 We will help you, at your reasonable request, to respond to requests from consumers to access, correct or delete their information, using the Service's features where they exist.

7.2 We will provide information you reasonably need for a regulatory examination or inquiry concerning the Service, including the evidence export the Service produces.

7.3 If we receive a request from a consumer or a regulator about Customer Data, we will pass it to you unless the law forbids it.

## 8. Audit by questionnaire

Once a year, and after any incident described in section 6, you may send us a written security questionnaire. We will answer it completely and accurately within 30 days. Where the law or a regulator requires more, we will cooperate with a reasonable, mutually agreed review at your expense, subject to confidentiality.

## 9. Return and deletion

9.1 For 30 days after your subscription ends, you may export Customer Data using the Service's export tools, or ask us to provide an export.

9.2 After that window an operator deletes your company's records from the Service's production database by hand, and confirms to you in writing when it is done.

9.3 Copies in our providers' backups expire on the providers' backup schedules and are not restored except to recover the Service.

9.4 We may keep Customer Data longer where the law requires. We will keep it confidential and protected under this addendum for as long as we hold it.

## 10. Duration

This addendum applies for as long as we hold Customer Data.

---

## Schedule 1. Security measures in place today

Each measure below is implemented in the Service's code or configuration today. Where a measure is provided by a subprocessor, it says so.

**Separation between companies**

1. Every record carries the company it belongs to, and the application server's queries filter by it. An automated test reads the server's source and fails when a query does not, apart from a short list of reads the same test names and justifies, such as resolving a user at sign-in, operator routes and background sweeps that then scope every read after them.
2. A user's company and identity are taken from their verified sign-in on the server, never from what the browser sends.
3. Routes that act across companies are limited to a named list of operator accounts.

**Database access**

4. Every database table enables row-level security, and an automated test fails a migration that creates a table without it. Tables added since September 2026 also revoke all access from the public and signed-in database roles in the migration that creates them.
5. The database service key is held only by the application server. It is never sent to a browser.

**Encryption**

6. All traffic to the website and the application server uses TLS.
7. Data at rest is encrypted by our database provider, Supabase.
8. Credentials a company gives the Service for Follow Up Boss and Arive are encrypted by the application with AES-256-GCM, bound to the company and the provider, under a key held in the server's environment configuration.

**Records that cannot be rewritten**

9. Consent and opt-out records, the audit log and the referral ledger are append-only: the database refuses to change them, and a correction is a new record that says so. Drafts and approvals are added as new rows, and the application never edits them.
10. Every approved message records who approved it, which version of which words, how (a tap on the draft or a signature on fixed words), and when, and the evidence export checks that the version sent matches the version approved.

**Sending**

11. Nothing is emailed unless a person has approved the exact words, by a tap on that draft or a signature on a play's fixed words, and every email must pass a series of checks before it sends. Each check fails closed. The checks are listed on lomatico.net/trust.
12. Email and text messaging are each switched off by default, for the platform and for each company. Text messaging is off for every company today.

**Minimising what is kept**

13. The delivery ledger stores a hash and a masked form of each recipient's address, not the address.
14. Operational logs carry request identifiers, routes and error codes. In the paths we have reviewed, message bodies and recipient addresses are not written to them.

**Application protections**

15. Request bodies are limited in size. Public endpoints, signed-in traffic, drafting and messaging have separate rate limits on the application server. Sign-in itself is rate limited by our authentication provider, Supabase.
16. The website sends a content security policy. The website and the application server send headers that restrict framing, content sniffing and referrers, and HTTP Strict Transport Security. The application server accepts browser requests only from listed origins.
17. Provider callbacks verify the provider's signature or a company-specific token.

**Change control**

18. Changes are made on a branch and tested by an automated suite before they are merged. A change that sends, touches consent, crosses the boundary between companies or alters the database goes through a separate, fresh review pass before it is merged. Database changes are applied by hand by an operator.

## Schedule 2. Subprocessors

| Subprocessor | Purpose | Customer Data it receives |
|---|---|---|
| Supabase | Database and sign-in | All records the Service keeps |
| Railway | Hosting for the application server | Customer Data in transit through the server; operational logs |
| Vercel | Hosting for the website and application pages | Pages and assets; request logs |
| Resend | Email delivery | Recipient address, subject and body of an approved message, the sender's address |
| Twilio | Text message delivery (off) | A phone number and message text, only when texting is turned on |
| Anthropic | Suggested wording and summaries | The details needed for the draft or summary requested, as lomatico.net/trust/data lists |
| Mapbox | Maps on property pages | The listing address on the page, from the visitor's browser |
| Stripe | Billing | Your billing details only; no consumer data |