PRODUCT.md §10.9

Data Processing Agreement

Effective 16 September 2026. Binding long-form text is in PRODUCT.md. This page is the public copy.

POPIA ss 20–22 operator terms between the firm (responsible party) and Owlaw (operator).

1. Subject. Hosting of client files, ledgers, users, signatures, and logs.
2. Instructions. Process only to provide the product, backups, and security. No secondary marketing.
3. Confidentiality. Privilege is the firm’s to assert.
4. Security. JWT + tenant_id, optional TOTP, audit log. Production must add TLS, PostgreSQL, backups. The demo’s H2 database is not that programme.
5. Subprocessors. Only those listed under Service Providers, plus any the firm connects (PayFast, Twilio).
6. Breach. Notify the firm without undue delay.
7. Deletion. On written request after termination, delete or return tenant data except records kept by law.
8. PAIA. The firm remains responsible for its s 51 manual. The product can generate a starting text.