Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Terms of Use between the customer ("Customer") and Tierback. It applies when Tierback processes personal information on the Customer's behalf through the Service.
1. Roles
The Customer is the business (controller) and Tierback is the service provider (processor) for the personal information in the data the Customer sends to the Service. Tierback processes that information only to provide the Service and on the Customer's documented instructions, which are these terms and the Customer's use of the Service.
2. Scope of processing
| Item | Detail |
|---|---|
| Purpose | Running interchange diagnostics, validating and correcting Level 2 and Level 3 transaction data, and showing results in the dashboard. |
| Data subjects | The Customer’s users of the Service, and the Customer’s buyers to the extent their information appears in transaction data. |
| Categories of data | User name and work email; session details (browser and operating system, city and country, sign-in and last access times); webhook endpoint URLs and the events sent to them; in-portal notifications, which may name a team member, an API key, a webhook endpoint or a merchant; transaction data such as transaction ids, amounts, card brand and product, the first 6 digits of the card, merchant reference and category code, customer reference, line item descriptions and ship-to postal codes. |
| Excluded data | Full card numbers, card security codes and gateway credentials. The Service checks every upload and request and rejects any that contain a full card number, without storing it. |
| Duration | For the term of the agreement and the retention periods in section 6. |
3. Service provider commitments
Tierback will not:
- sell or share the Customer's personal information, as those terms are defined in the California Consumer Privacy Act;
- retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Customer;
- combine it with personal information from other sources, except as permitted by law.
Tierback will tell the Customer if it can no longer meet these obligations or believes an instruction violates applicable law.
4. Security measures
- Encryption in transit, including TLS with certificate verification between the application and the database.
- Isolation of each organization's data by row-level security in the database, in addition to checks in the application.
- An application database role that cannot bypass row-level security.
- API keys stored only as keyed hashes; card number detection on every upload and request before anything is stored.
- Diagnostic files processed in memory and never written to storage; columns outside each report's allow list discarded on read.
- Two-factor authentication for users, confirmation for sensitive changes, and an append-only audit log of changes to keys, members and webhook endpoints.
- Sessions limited on the server to 12 hours, or 30 days with "Keep me signed in", and revocable from the account settings; trusted devices stored only as a hash of the device token, while sensitive changes still ask for confirmation.
- Webhook signing secrets stored only encrypted and shown once; payloads signed with HMAC-SHA256 and sent only to public HTTPS addresses; no card data in webhook payloads.
- Personnel access limited to what is needed to run the Service, under confidentiality obligations.
5. Subprocessors
The Customer authorizes Tierback to use the following subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database and user authentication | United States (us-east-1) |
| Vercel Inc. | Hosting and application runtime | United States (iad1) |
| Resend, Inc. | Transactional email: account emails and Contact sales messages | United States |
Tierback binds each subprocessor to data protection terms at least as protective as this DPA and remains responsible for them. Tierback will notify the Customer by email at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection, the Customer may terminate the affected Service.
6. Retention and deletion
| Data | Retention |
|---|---|
| Fee report you upload for a diagnostic | Read in memory and never stored. A file that contains a full card number is rejected as a whole. |
| Normalized diagnostic rows (transaction id, card product, rate received, amount, merchant account) | 90 days, then deleted automatically. |
| Diagnostic summary | Until your organization deletes the diagnostic or the organization itself. |
| API request payloads | Stored only for test keys, for 7 days. Payloads sent with live keys are never stored. |
| API request metadata (endpoint, result, score, amounts, card product, first 6 digits of the card, latency) | 13 months, then deleted automatically. |
| Audit log (who did what, and when, in your organization) | 1 year, then deleted automatically. |
| Batch files sent to POST /v1/batches (each line as sent) | Each line is deleted as soon as its item is processed. Only the line of an item that failed because of an error on our side is kept, so it can be retried, until the batch is deleted. A line with a full card number is rejected and never stored. |
| Batches and their results (status, counts and the result of each item) | 30 days after the batch is sent, then deleted automatically by a daily cleanup. |
| Webhook endpoints (URL, events and environment) | Until an owner or admin deletes the endpoint, or the organization is deleted. |
| Webhook signing secrets | Stored only encrypted and shown once, when the endpoint is created or the secret is rolled. After a roll, the previous secret keeps signing for 24 hours. Deleted with the endpoint. |
| Webhook events and deliveries (event payload, response code or failure type, attempt times) | 30 days, then deleted automatically by a daily cleanup. Deleting an endpoint deletes its deliveries. |
| Sign-in sessions (browser and operating system, city and country, sign-in and last access times) | A session ends after 12 hours, or after 30 days with “Keep me signed in”, or when you sign it out. Records of sessions that ended more than 30 days ago are deleted the next time you sign in, and all of them when your account is deleted. |
| Trusted devices (a hash of the device token, browser, and when it was trusted and last used) | Trusted for 30 days from when you confirm the code. Records that expired or were removed more than 30 days ago are deleted the next time you trust a device, and all of them when your account is deleted. |
| In-portal notifications (the notice, and whether you read it) | 90 days, read or not, then deleted automatically by a daily cleanup. A person who leaves an organization loses its notifications at once. |
| Notification preferences | Until you change them or your account is deleted. |
| Account and organization data | While your account is active. Deleting an organization removes its diagnostics, keys and request data. You can ask us to delete your account at any time. |
| Check one transaction daily count (salted hash of the IP address, day and number of checks) | Kept for the current and the previous day (UTC), then deleted automatically by a daily cleanup. The transaction you paste is never stored. |
| Contact sales messages | Kept in our hi@ inbox for 24 months after our last exchange, unless you become a customer, or sooner if you ask us to delete it. Customers follow the account and organization data row. |
| Full card numbers | Never stored. Requests that contain one are rejected. |
Deletion runs automatically on a daily or monthly schedule; session and trusted device records are cleaned up as the table says. On termination, Tierback deletes the Customer's data within 30 days, except the audit log, which is kept for 1 year from each entry, and data the law requires Tierback to keep.
7. Assistance
Tierback will help the Customer respond to requests from individuals exercising their privacy rights and with data protection assessments, to the extent the Customer cannot do so through the Service. Requests received directly from the Customer's buyers will be forwarded to the Customer.
8. Security incidents
Tierback will notify the Customer without undue delay, and within 72 hours, after becoming aware of a security incident affecting the Customer's personal information, with the information the Customer reasonably needs to meet its own obligations.
9. Audits
On written request, no more than once a year, Tierback will provide information reasonably necessary to demonstrate compliance with this DPA.
10. Location
Customer data is stored and processed in the United States.