Template copy. To be reviewed by a qualified UK solicitor before launch.
Data processing addendum
Last updated 2026-10-25 · Version 2026-10-25
The short version
Where we process personal data on your behalf, we do it only on your instructions, keep it secure, tell you who else handles it, and delete it when you ask.
Parties and roles
This addendum is between the customer and Critical Cloud Limited, which runs CostAssured. For account data we hold about the customer's own users, we are a controller and our Privacy notice applies. For personal data that appears in the usage metadata and documents a customer connects or uploads, we act as a processor. [Controller and processor analysis for each category of data to be confirmed.]
What we process
Usage and billing metadata and configuration inventory from the platforms a customer connects, and any contract the customer uploads. This can include the names or email addresses of people who created keys or own resources. We do not process the content of a customer's applications, their prompts, their database rows or their customers' details.
Our instructions
We process this data only to produce the customer's reports, to check later bills, to send the service emails the customer asks for, and as the customer otherwise instructs in writing. We do not use it to train AI models. [Training wording to be confirmed against our model provider's terms.]
Security
We protect the data with the measures described on our security page, including keeping credentials in a vault, decrypting them only inside the workers that run a scan, and separating each organisation's data.
Read the security pageSub-processors
We use the sub-processors listed on our security page, under written contracts. We give [number] days' notice before adding one, and a customer may object in that time. [Objection process to be confirmed.]
See the sub-processor listDeletion and return
When a customer disconnects a platform we destroy our copy of the credential at once and delete that platform's data within [number] days. When a customer deletes its organisation, we delete its data and remove its uploaded files. A customer can ask for a copy of its data first.
Breaches, audits and transfers
We tell the customer without undue delay, and within [number] hours, if we become aware of a personal data breach affecting its data. [Audit rights and the mechanism for transfers outside the UK, such as the UK addendum to the standard contractual clauses, to be confirmed.]
Getting a signed copy
To receive a signed copy of this addendum, email privacy@costassured.ai. [Signing process to be confirmed.]