Eklo Data Processing Addendum (0.9 private beta)

This addendum sets the rules for how Eklo processes personal data on a church's behalf during the 0.9 private beta. Effective date: November 3, 2026.

1. Parties, scope and rolesCopy Anchor Link

Parties. This Data Processing Addendum ("DPA") forms part of the Terms of Service between Mind Mill Media, LLC, PO Box 2922, Cleveland, TN 37320 ("Eklo") and the Customer named in the Terms.

Scope. It applies whenever Eklo processes Customer Personal Data to provide the service. It does not cover data Eklo controls for its own purposes (account, sign-in, beta-request, support and marketing-site data); the Privacy Policy covers those.

Roles. The Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Eklo is the Customer's processor, and its "service provider" or "processor" under US state privacy laws.

Definitions.

• Customer Personal Data: personal data in Customer Data, as the Terms define it.
• Data Protection Laws: the laws that apply to that processing, which may include the EU GDPR, UK GDPR, the Swiss FADP and US state privacy laws such as the CCPA.
• Personal Data Breach: a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
• Subprocessor: a third party Eklo engages that processes Customer Personal Data.
• SCCs: the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914.

Order of precedence. On data protection, this DPA overrides the Terms. Where the SCCs apply, they override this DPA.

2. Eklo's obligationsCopy Anchor Link

2.1 Instructions. Eklo processes Customer Personal Data only on the Customer's documented instructions. These are the Terms, this DPA, and the Customer's use and configuration of the service. Eklo will tell the Customer if it believes an instruction breaks Data Protection Laws, and if the law requires processing the Customer hasn't instructed, unless the law forbids telling.

2.2 Confidentiality. Everyone Eklo authorizes to process Customer Personal Data is bound by confidentiality, and access is limited to what their work needs.

2.3 Security. Eklo maintains the measures in Annex 2 and may update them, provided overall protection doesn't drop.

2.4 Subprocessors. The Customer authorizes the Subprocessors in the Subprocessors list. Eklo will:

• give at least 15 days' notice before adding or replacing a Subprocessor, by email to each workspace owner and an update to the published list;
• let the Customer object on reasonable data-protection grounds; if the parties can't resolve it, the Customer may end the affected service without penalty;
• bind each Subprocessor to data-protection terms at least as protective as this DPA; and
• remain responsible for its Subprocessors' performance.

2.5 Requests from individuals. Eklo will promptly pass on requests it receives about Customer Personal Data and won't answer them itself unless the Customer agrees. Eklo will help the Customer respond. The Customer can export its workspace's main data, but not direct messages, which only the people in them can see, or Ask Eklo data, which only the person who had the conversation can see. For Ask Eklo data, the Customer instructs Eklo to act on a user's requests about their own data, and each user can export a copy of their own Ask Eklo data in the service. A user can delete the notes Ask Eklo keeps for them in Eklo, and their own Ask Eklo conversations while the Customer has AI features on (otherwise Eklo acts on the user's request); removing a user from the workspace, or their leaving it, deletes their Ask Eklo data in that workspace. The Customer can also delete its workspace in Eklo; Eklo will help with other requests within 15 days.

2.6 Assessments. Eklo will give reasonable help with data protection impact assessments and consultations with regulators about the service.

2.7 Personal Data Breaches. Eklo will notify the Customer without undue delay, and within 48 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as known, what happened, the data and people affected, likely consequences, and the steps taken. Eklo will update the Customer as it learns more and take reasonable steps to contain the breach.

2.8 Deletion and return. Workspace owners and admins can export Customer Personal Data from Settings → Data at any time; exports leave out direct messages, Ask Eklo data and some other records (task templates, questions asked of form submitters, activity history and email audiences), and are deleted 7 days after they're ready to download. When the owner deletes the workspace, it can be restored for 30 days and is then permanently deleted. When the Terms end, the Customer may ask for an export of Customer Personal Data within 15 days. Eklo will then delete it from the live service within 30 days, and remaining copies leave backups within 40 days after that deletion, unless the law requires keeping it.

2.9 Audits. Eklo will make available the information reasonably needed to show compliance with this DPA, and will answer one reasonable written security questionnaire a year. On-site audits are limited to cases a regulator requires or after a Personal Data Breach, with 30 days' notice and at the Customer's cost. Eklo does not currently hold third-party security certifications.

2.10 International transfers. Customer Personal Data is hosted in the United States. During the beta, Eklo accepts Customers based in the United States only. Before accepting a Customer in the EEA, UK or Switzerland, Eklo will put a transfer safeguard in place, such as the SCCs with the UK Addendum and Swiss changes, and update this DPA.

2.11 US state privacy laws. Eklo will not sell or share Customer Personal Data, or use, keep or disclose it outside the direct business relationship with the Customer, except as those laws allow.

2.12 Government requests. If Eklo receives a legally binding demand for Customer Personal Data, it will notify the Customer first where the law allows, and disclose only what is legally required.

Annex 1: Details of processingCopy Anchor Link

Annex 2: Security measuresCopy Anchor Link

Eklo's production service runs on one Amazon EC2 server in AWS us-east-1 (Northern Virginia), with these measures:

• Encryption in transit. HTTPS, with TLS 1.2 or newer, between browsers and Eklo's content delivery network (Amazon CloudFront). CloudFront reaches Eklo's server over Amazon's private network, through a private connection into Eklo's own isolated cloud network, never over the public internet. The server has no public address and accepts only requests that come through CloudFront. That last hop, inside Amazon's network, is not separately encrypted. File storage accepts only HTTPS connections.
• Network isolation. The server sits in a private subnet of Eklo's isolated cloud network, with no public IP address and no SSH. Eklo's operators reach it only through AWS Systems Manager. Its network firewall admits only CloudFront's private connection, and the web server rejects any request that doesn't carry a secret header CloudFront adds. The database and cache (Postgres and Redis) sit on an internal container network with no published ports, reachable only by Eklo's application containers. Outbound connections from the server are limited to HTTPS.
• Web application firewall. AWS WAF screens every request before it reaches the server. It blocks requests from IP addresses on Amazon's threat reputation list, limits how many sign-in requests one IP address can make in a short window, and blocks requests to the staff console from any address outside Eklo's allowlist. Firewall logs record only blocked and flagged requests, with their IP address but without cookies, authorization headers or query strings, and are kept 30 days.
• File storage. Uploads are kept in private S3 buckets that block public access and are encrypted at rest with S3-managed keys. Originals and thumbnails are reached through signed links that expire after 15 minutes, issued after a permission check.
• Malware scanning. Files members upload for others (chat and direct-message attachments, task attachments, form uploads and Library files) are scanned by Amazon GuardDuty Malware Protection for S3 before anyone is given a link to them. A file found harmful is kept from everyone, the person who uploaded it and the Customer's workspace owners and admins are told, and the event is recorded in Eklo's security records.
• Database encryption. Postgres and Redis store their data on an encrypted disk volume, and the server's own disk is encrypted too. Database backups go to a private S3 bucket that blocks public access, requires encrypted connections and encrypts them at rest with S3-managed keys; the backup software adds no encryption of its own.
• Backups and recovery.
  • Database changes are copied to backup storage at least every 60 seconds and a full backup runs nightly, so the database can be restored to any moment in the last 14 days.
  • Backup files that are deleted or overwritten are kept another 22 days before they're gone.
  • The data volume is snapshotted daily, and 14 daily snapshots are kept.
  • Restores are drilled into a scratch copy that never touches the live database, and a deploy that fails, or fails its post-deploy checks, rolls back to the previous release automatically.
  • Every deploy checks that continuous backup is working.
• Resilience. Eklo runs on one server in one availability zone, by design. If the server, its disk or its zone is lost, Eklo rebuilds onto a replacement server from the snapshots and backups above rather than failing over to a standby, losing at most about a minute of database changes.
• Secrets. Database credentials, signing keys and third-party API keys live in AWS Secrets Manager. They are written onto the server, readable only by its root user, when a release is deployed, and aren't kept in the code repository.
• Passwordless sign-in. No passwords are stored. Email codes expire after 5 minutes and sign-in links after 10. Optional passkeys and Google sign-in. Workspace SAML single sign-on through the Customer's own identity provider, with optional Require SSO for verified domains, is available during the beta; after it, SAML is included on the plans that list it at eklo.io/pricing.
• Tenant isolation. Application queries for church data are written to be limited to the workspace they belong to, except in Eklo's support console and system jobs such as clean-up, which deliberately work across workspaces. An automated check on every code change looks for queries that aren't limited this way. Role-based permissions apply inside each workspace.
• Staff access. Eklo HQ, the staff console, is reachable only from Eklo's allowlisted IP addresses, and only by Eklo team accounts carrying a superadmin flag that the API checks on every staff request. Only an operator on the server can grant or revoke that flag, and every grant and revoke is written to the audit log.
• Public-form protection. Cloudflare Turnstile bot checks, required in production, plus per-IP rate limits.
• Content Security Policy. Eklo's pages are sent with a Content Security Policy in report-only mode: browsers report would-be violations to Eklo, where they are logged after scrubbing, so the policy can be enforced once it's known not to break real use. The same pages carry HTTP Strict Transport Security and headers that stop other sites framing Eklo.
• Log scrubbing. Application logs contain no email addresses, sign-in codes, session tokens or client IP addresses: every line is scrubbed before it's written, and request logs record only the method and path. They're kept in AWS CloudWatch for 30 days, and the server keeps a size-capped recent copy.
• Monitoring. Application errors are reported to Sentry.
• Security records. Eklo staff actions in its support console, and sensitive workspace actions, are recorded in an append-only security record with who acted, when and their IP address. Sensitive actions include exports, workspace deletion and restore, account deletion, member removal, single sign-on changes and files that malware scanning finds harmful.
• Alarms. Amazon CloudWatch alarms watch the server's health and disk space, error rates at the edge and in the application, the job queues and the backups, and email Eklo's operators through SNS when they fire and when they recover.
• Change control. Changes to the main branch go through pull requests that must pass automated checks (lint, type checks, tests). Third-party CI actions are pinned to exact versions and audited. Each release scans the API and worker images, and the database image when it changes, for known vulnerabilities.
• AI providers. Used under business terms that say they do not train on Eklo's data by default. In Eklo, Ask Eklo works only with what the person asking can open, and only that person can see their conversations with it. It asks them to confirm before anything that would notify someone else, and before any change once it has read a web page or an attached file. Owners and admins can turn AI features off for their workspace.
• Self-serve export and deletion. Owners and admins can export the workspace's main data (not direct messages, Ask Eklo data, task templates, questions asked of form submitters, activity history or email audiences); the owner can delete the workspace, which can be restored for 30 days and is then erased from the live service, after which remaining copies leave file-version history within 30 days and database backups within 40 days; any user can download their own Ask Eklo data, and delete their account after confirming a code sent to their email.