Legal

Data processing agreement

How NexQloud AI Drawback, LLC ('we', 'us') processes personal data in uploads for clients, filing brokers and partners. We sign this agreement with each client or partner before any work begins.

Section 1

Roles and scope

You decide how your documents are used, and we process them on your behalf.

Your uploaded business records may name people at suppliers, customers, carriers and brokers.

The purpose is limited to providing the service.

Section 2

Instructions

We process data only on documented instructions.
No training of any model.
No selling or sharing.

Section 3

Processing by mode

In Sealed mode, no one sees your documents without your consent.

Sealed

AMD SEV-SNP confidential VMs. No NexQloud access to documents.

Exceptions go to the client or its broker. The working copy is cryptographically erased, with a signed receipt.

Standard

NexQloud cloud, plus an outside AI provider if one is used, only on terms that bar training.

Named staff access, for exception review and support, logged.

Section 4

Personnel

Confidentiality obligations.
Access logging.
In Sealed mode, no NexQloud access to document contents.
In Standard mode, access only by named staff, for exception review and support.

Section 5

Subprocessors

The agreement we sign with you includes the current list.

We give advance notice of changes, and you have a right to object.

Section 6

Security measures annex

Encryption in transit and at rest.
Access control.
Logging.
Vulnerability disclosure, under our vulnerability disclosure policy.
SOC 2 Type 2. The report is available under NDA on request.

Section 7

Incidents

We notify the client and its filing broker after we confirm an incident.

We do it in time for the broker's 72-hour report to CBP and its follow-up list of affected importer numbers (19 CFR 111.21).^⁠[1]

Section 8

Assistance

We assist with requests from individuals, security reviews and the client's own obligations.

Section 9

Return and deletion

Sealed: Cryptographic erase of the working copy, with the NIST SP 800-88r2 conditions met.^⁠[2]
Standard: Deletion on schedule at the end of the engagement.

Section 10

Audits

The agreement we sign with you sets your audit rights and the documents we provide for them.

Section 11

Customs and export confidentiality

Brokers share records with written client authorization (19 CFR 111.24).^⁠[3]
We handle export data as the exporter's agent (15 CFR 30.60).^⁠[4]

Section 12

Partners' own duties

We support firms under the FTC Safeguards Rule, which must bind service providers by contract and assess them (16 CFR 314.4).^⁠[5]

Section 13

Legal requests

We notify the client of a legal request where lawful.

What we could produce if compelled:

Sealed: Claim totals, receipts, billing records and content-free logs, not document contents.
Standard: Records still within retention.

Section 14

Location

The agreement we sign with you states where each mode's processing runs, and any transfer terms.