neesh Inc.

Data Processing Agreement

Last updated: 2026-05-02

Scope. This DPA covers personal data processed through AskBase subscriptions and the other neesh Inc. base products as each becomes available. Assessment engagements and custom build engagements are not covered here. Data protection for those is governed by the terms of their own statement of work.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between neesh Inc. ("Processor") and the customer organisation ("Controller"). It governs the processing of personal data by neesh Inc. on the Controller's behalf in connection with the AskBase service.

Definitions

"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable data protection law, including GDPR (EU/UK) and PIPEDA (Canada). "Processing" has the meaning given in applicable law.

Scope and purpose of processing

neesh Inc. processes personal data solely to deliver the AskBase service as instructed by the Controller. Categories of data processed include: account credentials, documents uploaded by the Controller's users, query text submitted by users, and usage metadata (timestamps, response times, query counts).

Controller obligations

The Controller is responsible for ensuring it has a lawful basis for processing personal data under applicable law before uploading it to AskBase, and for obtaining any necessary consents from data subjects.

Processor obligations

neesh Inc. will:

  • Process personal data only on documented instructions from the Controller
  • Ensure personnel with access to personal data are subject to confidentiality obligations
  • Implement appropriate technical and organisational security measures
  • Assist the Controller in responding to data subject rights requests
  • Delete or return personal data at the end of the service relationship, per the retention schedule in our Privacy Policy
  • Provide information reasonably necessary to demonstrate compliance with this DPA

Sub-processors

neesh Inc. uses the sub-processors listed on our Subprocessors page. We will provide 30 days notice before adding a new sub-processor that processes personal data. If the Controller objects, it may terminate the service.

Auditor role and query-text PII handling

By default, audit-log views and exports redact query text to length+hash for users with the Auditor role. Org administrators may opt the org into raw-text Auditor visibility via Settings → Compliance.

This default is a compliance-safe posture for organisations in regulated industries (HIPAA, GLBA, and similar frameworks). Organisations that enable raw-text Auditor access should document that decision in their internal data processing records.

International data transfers

AskBase is hosted on AWS in the us-east-1 region. Data may be processed by Anthropic and OpenAI servers outside Canada. Where personal data of EU or UK residents is transferred, we rely on Standard Contractual Clauses or equivalent safeguards under applicable law.

Security measures

For details of our technical and organisational security measures, see our Security page.

Data subject rights

neesh Inc. will assist the Controller in fulfilling data subject rights requests (access, correction, erasure, portability, objection) within a commercially reasonable timeframe. Contact us at hi@neeshinc.ca.

Breach notification

In the event of a confirmed personal data breach affecting the Controller's data, neesh Inc. will notify the Controller without undue delay and within 72 hours of becoming aware, where feasible, to assist the Controller in meeting its own notification obligations.

Governing law

This DPA is governed by the laws of the Province of Ontario, Canada. EU and UK customers may request a separate DPA addendum with applicable Standard Contractual Clauses.

Contact

neesh Inc. · 112 King Street East, Hamilton, Ontario, L8N 1A8, Canada
hi@neeshinc.ca