Data Processing Addendum

Last updated: October 17, 2026

1. Parties, scope, and how this Addendum applies

1.1 Cardinal is a live-video streaming service operated by 1st Flock, LLC (“Cardinal,” “we,” “us,” or “our”). This Data Processing Addendum (the “DPA”) is between Cardinal and the Business Customer or Partner that has accepted the Cardinal Terms of Service (the “Terms”) (“Customer,” “you,” or “your”). It forms part of the Terms.

1.2 When it applies. This DPA applies automatically, without signature, to every Business Customer and Partner to the extent we process Personal Data on your behalf in providing the Service. It does not apply to Consumers. It forms part of the Terms you accepted, and we do not countersign it separately; a signed data processing agreement is available only as part of a signed Order Form or Partner Agreement.

1.3 What it covers. This DPA governs our processing of Customer Personal Data (defined in Section 2) as your processor or service provider. It does not govern personal data for which we are the controller (for example, your account, billing, and contact information), which is described in the Cardinal Privacy Policy.

1.4 Precedence. If this DPA conflicts with the Terms regarding the processing of Customer Personal Data, this DPA controls. If this DPA conflicts with the Standard Contractual Clauses (where they apply under Section 9), the Standard Contractual Clauses control. A signed Order Form or Partner Agreement may modify this DPA only by expressly referring to it.

2. Definitions

2.1 “Applicable Data Protection Law” means all laws that apply to the processing of Customer Personal Data under this DPA, which may include: the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as incorporated into United Kingdom law (“UK GDPR”) and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection (“FADP”); the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”); and other United States state privacy laws that impose obligations on processors or service providers (“US State Privacy Laws”).

2.2 “Controller,” “processor,” “data subject,” “personal data,” “personal data breach,” and “processing” have the meanings given in the GDPR. “Business,” “service provider,” “consumer,” “sell,” “share,” and “personal information” have the meanings given in the CCPA. In this DPA, “personal data” includes “personal information,” “controller” includes “business,” and “processor” includes “service provider,” unless the context requires otherwise.

2.3 “Customer Personal Data” means personal data contained in Customer Content or otherwise processed by us on your behalf through the Service, including personal data about your End Customers, Viewers, and the people who appear in your Broadcasts, as described in Annex I. It does not include personal data for which we are the controller.

2.4 “End Customer,” “Partner,” “Viewer,” “Broadcast,” “Recording,” “Customer Content,” and other capitalized terms not defined here have the meanings given in the Terms.

2.5 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, as amended or replaced.

2.6 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced.

2.7 “Subprocessor” means a third party engaged by us to process Customer Personal Data on our behalf.

3. Roles of the parties

3.1 Customer as controller; Cardinal as processor. For Customer Personal Data, you are the controller (or, where you are a Partner acting for an End Customer that is the controller, the processor) and we are your processor. We process Customer Personal Data only on your documented instructions, as described in Section 5.

3.2 Partners. Where you are a Partner, your End Customer may be the controller of its own Broadcasts and Viewer data, and you may be its processor. In that case we act as your Subprocessor, and you: (a) warrant that your agreement with the End Customer permits you to engage us on the terms of this DPA and imposes on you obligations no less protective than those this DPA imposes on us; (b) are solely responsible for passing on to us only lawful instructions from the End Customer; (c) are our sole point of contact; and (d) acknowledge that the End Customer has no direct rights against us under this DPA, except where Applicable Data Protection Law or the SCCs give a data subject or controller a direct right. You are responsible for determining your own role toward each End Customer.

3.3 CCPA. Where the CCPA applies, you are the business and we are your service provider, and Section 10 applies.

3.4 Our independent processing. We are an independent controller, not your processor, for: your account, billing, and contact data; data we collect to secure the Service and prevent abuse (including IP addresses used for rate limiting and security logs); metering and usage records; audit records; and aggregate or de-identified data that does not identify any data subject. We process that data as described in the Privacy Policy.

4. Details of processing

4.1 The subject matter, duration, nature and purpose of processing, the categories of data subjects, and the categories of Customer Personal Data are set out in Annex I.

4.2 Duration. We process Customer Personal Data for the term of the Terms and for the deletion periods described in Section 6.8 and Annex I.

5. Your obligations and instructions

5.1 Instructions. Your complete and final documented instructions to us are: (a) the Terms and this DPA; (b) your configuration of and use of the Service, including starting Broadcasts, adding Restream Destinations, supplying caption vocabulary, passing Viewer names, creating Recording links, deleting Recordings, and using the API; and (c) any other written instruction we agree to in writing. We may charge for instructions that require work outside the Service’s normal features.

5.2 Lawfulness. You are responsible for: the lawfulness of your collection and use of Customer Personal Data; having a lawful basis for processing; providing all privacy notices required to your End Customers, Viewers, chat participants, and the people who appear in your Broadcasts, including notice that Broadcasts are recorded, streamed, captioned, and, where applicable, restreamed; obtaining every consent required, including for minors; responding to data subjects; and ensuring that your instructions comply with Applicable Data Protection Law. You warrant that you have the authority to give the instructions in Section 5.1.

5.3 Restricted data. You must not use the Service to process protected health information subject to HIPAA, payment card data, government identification numbers, precise geolocation, biometric identifiers used for identification, or other specially regulated data, except to the extent such data is unavoidably contained in the audio or video of a Broadcast. We are not a business associate and will not sign a business associate agreement.

5.4 Unlawful instructions. We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Law, but we are not obliged to perform a legal review of your instructions. We may suspend processing under an instruction we reasonably consider unlawful until the issue is resolved.

6. Our obligations as processor

6.1 Processing on instructions. We will process Customer Personal Data only on your documented instructions under Section 5.1, including with regard to transfers to a third country, unless required to do otherwise by law to which we are subject; in that case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so on important grounds of public interest. We will not sell or share Customer Personal Data, and we will not use it for our own purposes, except as permitted under Section 3.4.

6.2 Confidentiality of personnel. We ensure that every person we authorize to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality, has access only to the extent needed for their role, and is informed of the confidential nature of the data. Staff access to production systems is restricted to a managed group whose membership is re-checked continuously, and staff actions are recorded in audit logs.

6.3 Security. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects, we implement and maintain the technical and organizational measures described in Annex II. We may update Annex II from time to time, but not in a way that materially reduces the overall level of protection during the term. You acknowledge that Annex II states what we do and what we do not do, and that you are responsible for assessing whether those measures are adequate for the Customer Personal Data you choose to process through the Service, including the fact that ingest from your encoder is not encrypted in transit.

6.4 Subprocessors.

6.4.1 General authorization. You give us general written authorization to engage Subprocessors to process Customer Personal Data. The categories of Subprocessors we currently use, their function, and their location are listed in Annex III. We do not publish the names of our Subprocessors; we will provide the current list of Subprocessors by name on your written request, and you agree to treat that list as our Confidential Information under the Terms.

6.4.2 Notice of changes. We will notify you at least 30 days before we add a Subprocessor category, replace a Subprocessor within a category, or add a Subprocessor that will process Customer Personal Data, by email to the account contact email or by notice in the console. The notice will identify the category and function; the name is available on request under Section 6.4.1.

6.4.3 Objection. You may object to a new or replacement Subprocessor on reasonable, documented data-protection grounds by notifying us in writing within 30 days after our notice. We will discuss your objection in good faith and may propose a way to avoid the Subprocessor processing your Customer Personal Data. If we cannot resolve the objection within 30 days after receiving it, either party may terminate the affected part of the Service (or, where that is not practicable, the Terms) on written notice. Fees incurred through termination remain payable, and no refund is due except as the Terms provide. If you do not object within the 30-day period, you are deemed to have accepted the Subprocessor.

6.4.4 Subprocessor terms and liability. We will impose on each Subprocessor, by written contract, data-protection obligations that are no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the service the Subprocessor provides. We remain responsible for the performance of each Subprocessor’s obligations to the same extent we would be if we performed them ourselves.

6.4.5 Not Subprocessors. Restream Destinations you select, identity providers you choose for sign-in, your own giving page and payment provider, and your own encoder, website, and app are not our Subprocessors. They are third parties you engage, and we send data to them only at your direction.

6.5 Assistance with data-subject requests. Taking into account the nature of the processing, we will assist you, by appropriate technical and organizational measures and insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under Applicable Data Protection Law. The Service’s own features (deleting a Recording, removing chat messages, downloading a Recording, closing an End Customer record) are the primary means of assistance. If we receive a request directly from a data subject relating to Customer Personal Data, we will not respond substantively except to acknowledge receipt and refer the data subject to you, and we will notify you promptly unless the law prohibits us from doing so. We may charge a reasonable fee for assistance that goes beyond the Service’s features.

6.6 Assistance with impact assessments and consultation. Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that you are required to carry out under Applicable Data Protection Law in relation to the Service. This DPA, the Privacy Policy, and Annexes I to III are the first source of that assistance; we will answer reasonable written questions beyond them and may charge a reasonable fee for substantial additional work.

6.7 Personal data breach. We will notify you without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notice will be sent to your account contact email and will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point. We may provide information in phases as it becomes available. We will cooperate reasonably with your investigation and with your notifications to supervisory authorities and data subjects. Our notification of or response to a breach is not an acknowledgment of fault or liability. You are responsible for notifying supervisory authorities and data subjects as the law requires of you.

6.8 Deletion and return at the end of the Service.

6.8.1 During the term. The Service deletes Customer Personal Data automatically on the following schedule, which you accept as your standing instruction: Recordings, live segments, and caption and transcript files are permanently deleted 30 days after they are written; chat messages, reactions, and gift notices are deleted 30 days after posting; a verified Viewer name passed through the API is deleted after about 2 hours; access-code attempt digests are deleted after about 10 minutes; restream stream keys are deleted one hour after the Broadcast ends; application and API request logs are deleted after about 31 days; database backups expire 30 days after they are taken. You may delete a Recording earlier through the Service.

6.8.2 At termination. On termination or expiry of the Terms, we will, at your choice, return or delete Customer Personal Data. Return is performed by you downloading Recordings through the Service before their scheduled deletion and before your Account is closed, or through the download links we provide on request under Section 14.6(d) of the Terms. Deletion of Recordings, chat, and the other categories in Section 6.8.1 occurs on the schedules stated there; we do not accelerate or extend them except as the Service’s early-deletion feature allows. After those periods, no Customer Personal Data remains in the Service except: (a) copies in database backups, which expire 30 days after they are taken and are not restored except for disaster recovery; (b) End Customer identifiers, names, metadata, stream titles, and usage records that form part of the account, usage, and billing records we keep as an independent controller under Section 3.4 for the periods stated in the Privacy Policy; and (c) data we are required by law to retain, which we will continue to protect under this DPA and process only for the purpose of that retention. On written request we will confirm deletion in writing.

6.8.3 Suspension and termination for cause. Suspension or termination of your account under the Terms does not stop the automatic deletion schedules. Where we have terminated for cause, we may end your access to Recordings immediately, as the Terms state, in which case return is not available.

6.9 Audits and information.

6.9.1 We will make available to you all information necessary to demonstrate compliance with the obligations in this DPA, as follows: this DPA and its Annexes; the Privacy Policy; written answers to reasonable security and data-protection questionnaires, no more than once in any 12-month period unless Applicable Data Protection Law or a supervisory authority requires otherwise or a personal data breach affecting your Customer Personal Data has occurred; and summaries of any third-party assurance reports we hold (we hold none at the date of this DPA).

6.9.2 We do not permit on-site audits or penetration testing of our systems by Customers, except where an on-site inspection is required by Applicable Data Protection Law or by a competent supervisory authority and cannot be satisfied by the measures in Section 6.9.1. In that case, the inspection will be: conducted by you or an independent auditor bound by confidentiality and reasonably acceptable to us; limited to once in any 12-month period unless a supervisory authority requires otherwise; on at least 30 days’ written notice; during normal business hours; of reasonable duration; limited to systems and records relevant to Customer Personal Data; conducted without access to any other customer’s data or to our Subprocessors’ facilities (whose own audit arrangements apply); and at your cost. You will provide us with a copy of any audit report, which is our Confidential Information.

6.9.3 We will inform you if we believe an instruction given in connection with an audit infringes Applicable Data Protection Law.

6.10 Records. We maintain a record of the categories of processing carried out on your behalf as Applicable Data Protection Law requires, and will make it available to a supervisory authority on request.

6.11 Legal requests. If we receive a legally binding request from a public authority for Customer Personal Data, we will, unless legally prohibited, notify you promptly, redirect the authority to you where possible, disclose only the minimum data required, and challenge the request where we reasonably consider there are grounds to do so under Applicable Data Protection Law. We do not provide any public authority with voluntary, generalized, or bulk access to Customer Personal Data.

7. Data subject rights and third parties

7.1 Data subjects, End Customers, and other third parties have no rights under this DPA against us except as Applicable Data Protection Law or the SCCs (where they apply) grant directly. You are responsible for handling all claims by your End Customers, Viewers, and other data subjects relating to Customer Personal Data, and the indemnity in the Terms applies to them.

8. Partners: flow-down

8.1 A Partner must ensure that its agreement with each End Customer: (a) accurately describes the processing performed through the Service, including the retention schedules in Section 6.8.1; (b) authorizes the Partner to engage us as a Subprocessor on the terms of this DPA and authorizes the Subprocessors in Annex III; (c) obtains the End Customer’s consent to the Partner’s access to all of the End Customer’s Broadcasts, Recordings, chat, and usage data; and (d) provides that the End Customer’s data-subject and audit requests are made through the Partner, not directly to us.

8.2 Where a Partner’s End Customer requires an audit or information under Section 6.9, the Partner will consolidate the request and make it to us itself, and the limits in Section 6.9 apply to the Partner as a whole, not per End Customer.

9. International transfers

9.1 Location of processing. We process Customer Personal Data in the United States. Content delivery and chat use edge locations worldwide, where data is held transiently to serve Viewers close to their location.

9.2 EEA transfers. To the extent you transfer Customer Personal Data to us from the European Economic Area, and that transfer is restricted by the GDPR, the parties enter into the SCCs, which are incorporated into this DPA by reference, as follows:

(a) Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a Partner acting as processor for an End Customer.

(b) Clause 7 (docking clause) does not apply.

(d) In Clause 11, the optional language on independent dispute resolution does not apply.

(e) In Clause 13, the competent supervisory authority is the one determined under Clause 13(a) of the SCCs, according to where the data exporter is established or where its representative is located.

(f) In Clause 17, Option 1 applies and the governing law is the law of Ireland.

(g) In Clause 18, the courts of Ireland have jurisdiction.

(h) Annex I of this DPA serves as Annex I of the SCCs; Annex II of this DPA serves as Annex II of the SCCs; Annex III of this DPA serves as Annex III of the SCCs.

(i) We are the data importer; you are the data exporter. Where you are a Partner acting under Module Three, your End Customer is not a party to the SCCs with us.

9.3 UK transfers. To the extent you transfer Customer Personal Data to us from the United Kingdom, the SCCs as modified by the UK Addendum apply, with: Table 1 completed with the parties’ details in Annex I; Table 2 referring to the SCCs as completed in Section 9.2; Table 3 referring to Annexes I to III of this DPA; and, in Table 4, the importer (Cardinal) may end the UK Addendum as set out in its Section 19.

9.4 Swiss transfers. To the extent you transfer Customer Personal Data to us from Switzerland, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and data subjects in Switzerland may enforce their rights in Switzerland.

9.5 Alternative mechanisms. If the SCCs or UK Addendum are invalidated, superseded, or cease to be an adequate mechanism, the parties will cooperate in good faith to implement a replacement mechanism. If we become certified under a recognized adequacy or data-privacy framework for the relevant jurisdiction, we may rely on that framework instead and will notify you.

9.6 Onward transfers. Transfers to Subprocessors are made under written terms that provide appropriate safeguards as Applicable Data Protection Law requires.

10. CCPA service-provider terms

10.1 To the extent the CCPA applies to Customer Personal Data, we certify that we understand and will comply with the following, and that we act as your service provider:

(a) We process Customer Personal Data only for the business purposes specified in the Terms and Annex I, which are to provide the Service to you.

(b) We will not sell or share Customer Personal Data.

(c) We will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified, including for any commercial purpose other than providing the Service to you, or outside the direct business relationship between you and us.

(d) We will not combine Customer Personal Data with personal information we receive from or on behalf of another person, or collect from our own interaction with a consumer, except as the CCPA and its regulations permit a service provider to do (for example, to detect security incidents or protect against fraudulent or illegal activity).

(e) We will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of businesses.

(f) We will notify you promptly, and in any event within 10 business days, if we determine that we can no longer meet our obligations under the CCPA.

(g) You may take reasonable and appropriate steps to ensure that we use Customer Personal Data in a manner consistent with your obligations under the CCPA, using the information and audit rights in Section 6.9, and you may, on reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

(h) We will cooperate with you in responding to verifiable consumer requests under Section 6.5, and will implement your instructions to delete, correct, or provide Customer Personal Data in response to such requests, to the extent the Service permits.

(i) We will impose the obligations in this Section 10 on any Subprocessor that processes Customer Personal Data subject to the CCPA.

10.2 Other US State Privacy Laws. To the extent other US State Privacy Laws apply, this DPA constitutes the contract between controller and processor they require, and the obligations in Sections 5, 6, and 10.1 are read to include the corresponding obligations under those laws, including the duty of confidentiality, the deletion-or-return obligation, the availability of information to demonstrate compliance, the audit arrangements in Section 6.9, and the flow-down to Subprocessors.

11. Liability

11.1 Each party’s liability, taken in aggregate, arising out of or relating to this DPA, the SCCs (where they apply, to the extent the SCCs permit), and the Terms, whether in contract, tort, or under any other theory, is subject to the exclusions and limitations of liability in the Terms. The cap in the Terms applies to the total liability under the Terms and this DPA together; it is not a separate or additional cap.

11.2 Where you are a Partner, our total liability to you and to all of your End Customers together is subject to a single cap under the Terms. You will ensure that no End Customer brings a claim against us other than through you, except where Applicable Data Protection Law gives the End Customer a direct right that cannot be excluded.

11.3 Nothing in this Section limits a data subject’s rights under Applicable Data Protection Law or the SCCs, or any liability that cannot be limited under Applicable Data Protection Law.

12. Term and termination

12.1 This DPA takes effect when the Terms take effect for you and remains in effect for as long as we process Customer Personal Data on your behalf, including the deletion periods in Section 6.8.

12.2 Termination of the Terms terminates this DPA, subject to Section 6.8.

13. General

13.1 Governing law and disputes. This DPA is governed by the governing-law and dispute-resolution provisions of the Terms, except as the SCCs require otherwise for matters within their scope.

13.2 Changes. We may update this DPA as described in the Terms where required by Applicable Data Protection Law, a change in the Service, or a change in the SCCs, provided that no update materially reduces the protection of Customer Personal Data during the term without your consent.

13.3 Severability. If any part of this DPA is held invalid, the rest remains in effect and the invalid part will be replaced by a valid provision that comes closest to its intent.

13.4 Entire agreement. This DPA, the Terms, and any applicable Order Form or Partner Agreement are the complete agreement between the parties regarding the processing of Customer Personal Data and supersede any earlier data-processing agreement between them.

14. Contact

Cardinal is operated by 1st Flock, LLC, which is the processor under this DPA and the data importer under the SCCs.

Data-protection and DPA requests: legal@cardinalstreaming.com
Legal notices: legal@cardinalstreaming.com
Mailing address: 1st Flock, LLC, Attn: Legal, 4000 Legato Road, Suite 1100, Fairfax, Virginia 22033
Data protection contact: We have not designated a data protection officer. Data-protection questions go to legal@cardinalstreaming.com.

Annex I: Details of processing

A. List of parties

Data exporter (controller or processor): the Customer identified in its Cardinal account, with the contact details recorded there. Role: controller (Direct Customer or Partner acting for itself) or processor (Partner acting for an End Customer). Signature and date: by acceptance of the Terms.

Data importer (processor or subprocessor): 1st Flock, LLC, operating Cardinal, 4000 Legato Road, Suite 1100, Fairfax, Virginia 22033; contact: legal@cardinalstreaming.com. Role: processor (or subprocessor where the Customer is a Partner acting as processor). Signature and date: by publication of this DPA and provision of the Service.

B. Description of processing

Categories of data subjects:

Viewers: members of the public who watch the Customer’s Broadcasts or Recordings or use chat and reactions.
People who appear in Broadcasts: speakers, performers, congregants, attendees, students, and others whose image, voice, or words are included in the Customer’s live stream, including, at the Customer’s discretion and responsibility, minors.
End Customers (Partners only): the Partner’s customers and their personnel.
The Customer’s own personnel and moderators, to the extent they appear in Broadcasts or use chat.

Categories of personal data:

Broadcast content: live video and audio and the Recording of it; captions and transcripts generated from it (where captions are offered); stream titles and descriptions.
Chat data: Viewer display names, chat messages (up to 300 characters each), reactions, gift notices posted by the Customer’s systems, and verified Viewer names passed by the Customer.
Viewer network data: IP addresses processed to deliver video and protect chat (including digests of addresses for access-code rate limiting), and sampled request URLs in request logs.
End Customer data (Partners only): the Partner’s identifier for each End Customer, an optional name, Partner-supplied metadata, caption vocabulary (names and terms), and usage records.
Restream credentials: stream keys for Restream Destinations supplied by the Customer (held encrypted, deleted one hour after the Broadcast ends).

Sensitive data: The Service is not designed for and the Customer must not deliberately submit special categories of personal data or other sensitive data. Broadcast content may incidentally reveal religious beliefs (for example, a worship service), health information, or other sensitive information about people who appear or who post in chat; the Customer is responsible for the lawfulness of including it. We apply the same security measures to all Customer Personal Data and do not analyze content to extract sensitive data.

Frequency of processing: continuous during each Broadcast and for the retention periods below.

Nature of processing: receiving, encoding, segmenting, recording, storing, caching, delivering, displaying, transcribing (captions), forwarding to Restream Destinations at the Customer’s direction, rate limiting, logging, backing up, and deleting.

Purpose of processing: to provide the live-streaming Service to the Customer under the Terms: delivering the Customer’s Broadcasts to its Viewers, providing chat and reactions, creating Recordings, generating captions where offered, forwarding Broadcasts to the Customer’s chosen destinations, protecting the Service against abuse, and metering use for billing.

Duration of processing and retention: for the term of the Terms and the following periods: Recordings, segments, captions and transcripts: 30 days after they are written; chat messages, reactions, gift notices: 30 days; verified Viewer names: about 2 hours; access-code attempt digests: about 10 minutes; restream stream keys: 1 hour after the Broadcast ends; application and API request logs: about 31 days; database backups: 30 days from creation. End Customer identifiers, names, metadata, titles, and usage records persist in account and billing records as described in the Privacy Policy.

Transfers to Subprocessors: the categories, functions, and locations in Annex III; the subject matter, nature, and duration are as above.

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs.

Annex II: Technical and organizational security measures

This Annex describes the measures we implement. It also states, in Section J, measures we do not provide, so that the Customer can assess suitability. We may update this Annex, but not in a way that materially reduces the overall level of protection during the term.

A. Encryption in transit

The website, console, API, player, watch pages, and media delivery (video segments, playlists, and recording downloads) are served only over TLS (HTTPS), with HTTP Strict Transport Security enabled.
Video sent from the Customer’s encoder to our ingest servers is encrypted in transit: with TLS 1.2 or 1.3 (RTMPS), which also protects the stream key, or, over SRT, with AES using a passphrase unique to each Broadcast, without which a connection is refused. Our ingest servers accept only encrypted connections.
Restreams are sent only over RTMPS (TLS), which also protects the destination’s stream key. We refuse restream destinations configured with plain RTMP.

B. Encryption at rest and credential protection

Database backups are encrypted at rest.
API keys and ingest keys are stored only as cryptographic hashes (SHA-256 for API keys); the plaintext is shown once at creation and is not retained.
Private-stream access codes are stored only as digests.
Restream stream keys are encrypted with AES-256-GCM and deleted one hour after the Broadcast ends.
Card data never reaches our systems; it is tokenized in the Customer’s browser by our payment processor, and we store only the token, card brand, last four digits, and expiry.

C. Access control and tenant isolation

Console and API requests are authenticated (sign-in session or API key) and authorized against the Customer’s account; one Customer cannot read, modify, or delete another Customer’s data.
A Partner can reach only the data of its own End Customers; End Customer records are scoped to the Partner’s account.
Recording playback and download use signed, time-limited bearer links (download: 1 hour to 7 days; playback: up to 6 hours), after which the link no longer works.
Private Broadcasts require an access code; repeated wrong attempts from an address are rate limited.

D. Staff access

Staff access to production systems and internal tools is restricted to a managed group of named staff accounts; membership is re-checked continuously and removed when no longer required.
Staff sign in to internal tools through managed accounts in our own directory.
Staff actions on customer accounts (for example, issuing credits, refunds, or creating accounts) are recorded in audit records.

E. Logging and monitoring

Application and API request logs are retained for about 31 days and are used for security investigation and troubleshooting.
Monitoring and logging run on infrastructure we operate; logs are not sent to a third-party analytics service.
Security events such as refused connections are logged.

F. Abuse protection and availability

Rate limits and connection limits apply to the API, chat, and access-code attempts.
Each Broadcast is encoded in more than one data center for redundancy. Redundancy is a design measure, not a guarantee of availability; no service-level agreement is provided.

G. Backup and recovery

Production databases are backed up daily; each backup is encrypted and retained for 30 days.
Recordings are not backed up beyond their primary storage and are not archived; they are deleted 30 days after they are written.

H. Deletion

Automatic deletion on the schedules in Annex I is enforced by the Service; deletion of Recordings is irreversible and there is no archive.
Customers can delete a Recording early through the console or API; deletion is immediate and irreversible.

I. Subprocessor management

Subprocessors are engaged under written contracts that impose data-protection and security obligations appropriate to the service they provide.
All Subprocessor storage and processing of Customer Personal Data is in the United States, except transient global edge delivery of video and chat.

J. Measures not provided

We hold no third-party security certification or attestation (for example, SOC 2 or ISO 27001) and make no claim of compliance with any such standard.
We offer no uptime guarantee or service-level agreement.
We do not offer customer-managed encryption keys, dedicated or single-tenant infrastructure, or data residency outside the United States.
We do not permit Customer-initiated penetration testing (see Section 6.9.2).

Annex III: Subprocessor categories

We disclose Subprocessors by category. The named list is available on written request under Section 6.4.1. Each Subprocessor processes Customer Personal Data only to perform the function stated.

Category	Function	Customer Personal Data processed	Location
Cloud infrastructure and hosting	Compute for ingest and encoding, databases, database backups, and the email-delivery component of the platform	All categories in Annex I, in the course of running the Service	United States (US East)
Content delivery network and edge computing	Delivery of video to Viewers; object storage for Recordings, segments, and caption files; operation of the chat service at edge locations	Broadcast content and Recordings; chat data; Viewer network data	Object storage in eastern North America; delivery and chat at global edge locations
Payment processing	Tokenization of cards and processing of charges	None of the Customer Personal Data in Annex I. Processes the Customer’s own billing data as described in the Privacy Policy. Listed for completeness	United States
Authentication and sign-in	Hosted sign-in for console users, including third-party identity options such as “Sign in with Google”	None of the Customer Personal Data in Annex I. Processes account-holder sign-in identity as described in the Privacy Policy. Listed for completeness	United States
Transactional email delivery	Delivery of billing notices and alerts to the Customer’s contacts	None of the Customer Personal Data in Annex I. Listed for completeness	United States
Monitoring and logging	Operated by us on our own infrastructure; no third party	Request logs, security events	United States
Machine translation	Translating caption text into the languages a Customer turns on for a Broadcast	Caption text of those Broadcasts only (the words recognized from the speech) and any caption vocabulary the Customer supplied. No audio, video, chat, Viewer data, or account data	United States; processing may also occur in other locations under the safeguards in Section 9

Not Subprocessors (engaged by the Customer): Restream Destinations chosen by the Customer; identity providers chosen by individual users for sign-in; the Customer’s giving page and payment provider; the Customer’s encoder, website, and app.

Conditions on machine translation. Machine translation is used only for Broadcasts for which the Customer has turned on translated captions; no other Broadcast’s data is sent to it. We engage machine-translation providers only under written terms that: (a) permit them to use Customer Personal Data solely to return the translation to us; (b) prohibit them from using it to train, retrain, fine-tune, evaluate, or otherwise improve any model; and (c) prohibit them from retaining it after the translation is returned, except as strictly necessary to detect and prevent abuse or to comply with law, and in no case for longer than 30 days. We do not use Customer Personal Data to train any model ourselves. Translated caption files are stored with the Recording and deleted on the schedule in Section 6.8.1. Translations are generated by machine, are not reviewed by any person, and may be inaccurate.