FortressSphere Data Processing Agreement
Version 1.2 | Last updated: October 2026
1. Parties and Background
This Data Processing Agreement ("DPA") is entered into between:
(a) the customer identified in the applicable Order Form, organisation account or subscription record (the "Controller", "Customer" or "you"); and
(b) the FortressPoint entity identified as the contracting entity in the applicable Order Form, subscription record or other written agreement, which provides FortressSphere to the Customer (or, where none is identified, FortressPoint Consulting Limited, a company incorporated in Nigeria) (the "Processor", "FortressPoint" or "we"),
together the "Parties". The FortressPoint entities in the United Kingdom and Nigeria are separate legal entities. This DPA is made with the one that contracts with the Customer.
This DPA forms part of, and is incorporated by reference into, the FortressSphere Terms of Service and any Order Form or separate signed customer agreement (together, the "Agreement"). It applies automatically to every Customer whose use of the Platform involves the Processing of Personal Data on the Customer's behalf, without a separate signature, in the same way the Terms of Service are accepted when an account is created. If the Customer wants a separately countersigned copy, FortressPoint will provide one on reasonable request to compliance@fortresspointconsulting.com.
The Customer acts as Controller (or, where the Customer is itself Processing Personal Data on behalf of another controller, as Processor) of the Personal Data that it submits to, or generates within, the Platform. FortressPoint acts as Processor (or sub-processor, as applicable) of that Personal Data for the purpose of providing the Platform. Where the Customer acts as Processor, the Customer confirms that it has the authority to give the instructions in this DPA on behalf of the relevant controller.
FortressPoint also acts as an independent Controller of certain Personal Data for its own purposes, namely account administration, billing and subscription administration, direct customer support, platform security and abuse prevention, and compliance with its own legal obligations. That processing is described in the FortressSphere Privacy Policy and is not governed by this DPA.
Some Sub-processors also act as independent controllers, under their own terms and privacy policies, in respect of limited account, billing or usage data they hold about the people who use the Platform. The Sub-Processors Register identifies them. This DPA does not govern that processing, and a Sub-processor is a Sub-processor under this DPA only for the Customer Personal Data it Processes on FortressPoint's behalf.
2. Definitions
Capitalised terms not defined in this DPA have the meanings given in the Terms of Service. In this DPA:
"Applicable Data Protection Laws" means, as applicable to the Personal Data in question: (i) the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025 made under it (together, "NDPA"); and (ii) the UK General Data Protection Regulation as it forms part of the law of the United Kingdom, as supplemented by the Data Protection Act 2018 and as amended, including by the Data (Use and Access) Act 2025 (together, "UK GDPR"); and any other data protection law that applies to the Processing of the relevant Personal Data under this DPA.
"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given in the Applicable Data Protection Laws.
"Customer Personal Data" means Personal Data that FortressPoint Processes on the Customer's behalf under the Agreement.
"Platform" means the FortressSphere software-as-a-service product, including the customer-facing application, the administrative portal and the AI-assisted features, whichever add-ons the Customer has subscribed to.
"Sub-processor" means any third party engaged by FortressPoint to Process Customer Personal Data in order to provide the Platform, including the entities in the Sub-Processors Register.
"Sub-Processors Register" means FortressPoint's register of its Sub-processors, giving for each its name, the Processing it carries out and where it Processes Customer Personal Data. FortressPoint makes it available to the Customer in the Platform under Settings, Legal, and to the Customer or a prospective customer on written request (including before an account is created), and keeps it current. Annex 3 summarises it by category.
"Privacy Policy" means the FortressSphere Privacy Policy, as published by FortressPoint from time to time.
3. Subject Matter, Duration, Nature and Purpose of Processing
The details required by NDPA section 29 and UK GDPR Article 28(3) are set out in Annex 1. In summary:
- Subject matter: FortressPoint's provision of a multi-framework compliance self-assessment, document-generation, evidence-management, vendor-assessment, incident-reporting, staff-training and AI-governance platform to the Customer, together with any add-on features the Customer has subscribed to.
- Duration: the term of the Agreement and, after that, only the retention periods in Annex 1 or any longer period required by law.
- Nature: automated storage, retrieval, analysis, and AI-assisted generation of outputs from Personal Data submitted by or on behalf of the Customer.
- Purpose: to enable the Customer to assess, document and demonstrate its own compliance posture under the frameworks the Platform supports.
The Customer decides what Personal Data it places in the Platform and remains responsible for having a lawful basis and the required notices for everything it submits. FortressPoint does not review uploaded content to identify the Personal Data in it.
Special-category data is not permitted. The Customer must not enter or upload into the Platform, including its free-text fields, chat, the AI-assisted features and the Evidence Vault, Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person, data concerning health or a person's sex life or sexual orientation, or Personal Data about criminal convictions and offences, unless FortressPoint has agreed to it in writing beforehand. Most of the Platform's Sub-processors do not accept this data under their terms. The Customer may still record that a policy, control or process exists in relation to such data (for example, a policy on handling employee health records) without including the data itself. The Platform is also not designed to hold health information regulated by the United States Health Insurance Portability and Accountability Act, and must not be used for it. If special-category data is submitted despite this clause, the Customer is responsible for it, must tell FortressPoint promptly, and FortressPoint may delete it when it becomes aware of it.
4. FortressPoint's Obligations as Processor
FortressPoint shall, in respect of Customer Personal Data:
4.1 Instructions. Process Customer Personal Data only on the Customer's documented instructions, including as to transfers to a third country, unless required to do otherwise by law to which FortressPoint is subject. In that case FortressPoint will, where the law permits, tell the Customer before Processing on that other basis. The Customer's instructions are given through its configuration and use of the Platform (for example the frameworks it selects, the data it uploads and the settings it applies), supplemented by any further written instruction the Customer gives. FortressPoint will tell the Customer promptly if it considers that an instruction infringes Applicable Data Protection Laws.
4.2 Confidentiality. Ensure that every person authorised by FortressPoint to Process Customer Personal Data, including employees and contractors, is subject to a binding duty of confidentiality, whether contractual or statutory, and has access only to the extent needed to operate, support and secure the Platform.
4.3 Security. Implement technical and organisational measures appropriate to the risk, as set out in Annex 2.
4.4 Sub-processors. Engage Sub-processors only as follows.
(a) The Customer gives FortressPoint general written authorisation to engage the Sub-processors in the Sub-Processors Register as at the date this DPA starts to apply to the Customer.
(b) FortressPoint will give the Customer at least 14 days' notice before a new or replacement Sub-processor begins Processing Customer Personal Data. Notice will be given by updating the Sub-Processors Register and by email to the Customer's account administrators. Where a Sub-processor itself gives FortressPoint less than 14 days' notice of a change, or a replacement is needed urgently to maintain the security or availability of the Platform, FortressPoint will give the Customer notice within five working days of becoming aware of the change, and the Customer's right to object under paragraph (c) runs from that notice.
(c) The Customer may object on reasonable data protection grounds by writing to compliance@fortresspointconsulting.com within 14 days of the notice. The Parties will work in good faith to resolve the objection, and FortressPoint will use the objection rights it has against the Sub-processor where that would help. If the objection cannot be resolved, the Customer may terminate the affected part of the Platform by written notice, without liability for early termination. Any refund of prepaid fees is governed by the Agreement.
(d) FortressPoint will ensure that each Sub-processor is bound by written data protection terms that give protection for Customer Personal Data materially equivalent to this DPA in respect of the Processing it carries out. Those terms may be the Sub-processor's standard data processing terms. Where a Sub-processor also acts as an independent controller for certain data (see Annex 3), these terms apply to the Customer Personal Data it Processes on FortressPoint's behalf. FortressPoint remains liable to the Customer for each Sub-processor's performance of its data protection obligations.
4.5 Data Subject rights. Taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, so far as possible, to respond to requests from Data Subjects to exercise their rights (including access, rectification, erasure and restriction). If an individual contacts FortressPoint directly about Customer Personal Data, FortressPoint will refer the request to the Customer promptly rather than respond to it, unless the individual is using a right the Platform gives them directly (for example, self-service account deletion).
4.6 Security and impact assessments. Assist the Customer, taking into account the nature of the Processing and the information available to FortressPoint, to meet its obligations on security of Processing, data protection impact assessments and prior consultation with a supervisory authority.
4.7 Personal Data Breach. Notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and aim to do so within 72 hours of becoming aware, including where it becomes aware because a Sub-processor has told it of the breach. If FortressPoint has not notified the Customer within 72 hours, it will give the reasons for the delay when it does. The notice will describe, so far as FortressPoint then knows, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences and the measures taken or proposed, and FortressPoint will supplement it as its investigation continues. FortressPoint will take reasonable steps to contain and remediate the breach. Notifying a supervisory authority or Data Subjects remains the Customer's responsibility as Controller, and FortressPoint will not notify them on the Customer's behalf unless the law requires it or the Customer instructs it to.
4.8 Deletion or return. At the Customer's choice, and in any event when the Agreement ends, delete or return all Customer Personal Data and delete existing copies, unless Applicable Data Protection Laws require it to be kept, in which case FortressPoint will keep protecting it and Process it only for the purpose that requires its retention. Return is by the export functions available in the Platform or, on reasonable request, in another commonly used format. Deletion is carried out through the Platform's account and company deletion processes and the retention schedules in Annex 1. Copies held in backups expire in the ordinary course of the backup cycle, which is currently up to 14 days.
4.9 Information and audit. Make available to the Customer, on reasonable written request and no more than once in any 12-month period (except after an actual Personal Data Breach affecting the Customer), the information reasonably needed to demonstrate compliance with this DPA, and allow for and contribute to a reasonable audit, including an inspection, by the Customer or a mutually agreed independent auditor. Audits will be on reasonable notice, during business hours and in a way that does not unreasonably disrupt FortressPoint's operations or compromise the confidentiality or security of other customers' data. FortressPoint may first answer by providing its security and data protection documentation and completed due diligence questionnaires. FortressPoint cannot give the Customer access to a Sub-processor's systems. It will instead share the audit reports it receives from that Sub-processor and use the audit rights it holds against it where that is reasonably needed.
5. International Data Transfers
Some Sub-processors in the Sub-Processors Register Process Customer Personal Data outside the United Kingdom and Nigeria, including in the United States. The Sub-Processors Register and Annex 3 show the location FortressPoint has configured for each Sub-processor or category. Several Sub-processors' terms also allow them and their own sub-processors to Process data in other countries, for example for support, and FortressPoint does not control that. FortressPoint's agreements with its Sub-processors are currently held by its Nigerian entity. FortressPoint maintains a register of Sub-processor locations and transfer mechanisms and will make it available to the Customer on request.
Where Customer Personal Data originating from a Data Subject in the United Kingdom is transferred to a country without an adequacy decision, FortressPoint will ensure that an appropriate transfer mechanism is in place. In general this is the Sub-processor's own mechanism, such as the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or the International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses, as applicable to that Sub-processor.
Where Customer Personal Data originating from a Data Subject in Nigeria is transferred outside Nigeria, FortressPoint will make the transfer only where the NDPA permits it, that is to a recipient in a country with adequate protection or subject to appropriate safeguards. FortressPoint applies the data transfer and data protection terms in its Sub-processor agreements, together with its own security measures, to those transfers, and will keep a record of the basis and safeguards relied on.
6. Liability
Each Party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits or excludes either Party's liability where it cannot lawfully be limited or excluded under Applicable Data Protection Laws.
7. Term and Termination
This DPA takes effect on the date the Customer first uses the Platform in a way that involves Processing Customer Personal Data and continues for as long as FortressPoint Processes Customer Personal Data on the Customer's behalf under the Agreement. Ending the Agreement ends this DPA, without affecting any obligation that by its nature should continue, such as deletion after termination, confidentiality, and notification of Personal Data Breaches that occurred before termination.
8. General Provisions
8.1 Order of precedence. If this DPA conflicts with the Terms of Service on the Processing of Customer Personal Data, this DPA prevails.
8.2 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force and effect.
8.3 Governing law. This DPA is governed by the law, and subject to the courts or dispute resolution arrangements, that govern the Agreement. Nothing in this DPA affects any mandatory right or protection under Applicable Data Protection Laws that cannot lawfully be excluded or varied by contract.
8.4 Changes. FortressPoint may update this DPA to reflect changes in Applicable Data Protection Laws, in the Platform or in its Sub-processors. It will notify the Customer of material changes through the Platform or by email with reasonable notice, and no update will reduce the protection given to Customer Personal Data. Where a separate signed customer agreement applies, its amendment provisions take precedence.
8.5 Contact. Questions about this DPA, requests for a countersigned copy, Sub-processor objections and requests under clause 4.9 should be sent to compliance@fortresspointconsulting.com.
Annex 1: Details of Processing
A. Subject matter and duration
FortressPoint Processes Customer Personal Data for the duration of the Customer's subscription, plus the retention periods in Part E.
B. Categories of Data Subjects
| Category | Description |
|---|---|
| Platform users | Individuals who hold a login to the Platform on the Customer's behalf (Admins, Editors, Viewers, or a solo account holder). |
| The Customer's staff (Staff Roster) | Employees and contractors of the Customer tracked for compliance training, including those who complete a training link or quiz. These individuals typically have no direct relationship with FortressPoint and do not have a login. |
| Vendor and third-party contacts | Named contacts at the Customer's vendors, including respondents to vendor assessments and follow-up questions sent through assessment links. |
| Trust Page enquirers | Individuals who send an enquiry through a Trust Page the Customer has published. |
| Individuals named in uploaded or generated content | Any individual whose Personal Data appears in evidence documents, incident reports, questionnaires, AI System Register or DPIA entries, chat messages or generated compliance documents. The scope of this category is determined entirely by the Customer's use of the Platform. |
C. Categories of Personal Data
| Category | Examples |
|---|---|
| Identity and contact data | Name, email address, phone number, job title, department, employer or company name. |
| Account and role data | Login credentials (managed by the Platform's identity provider), assigned role and permissions, activity timestamps. |
| Compliance content | Self-assessment answers, generated policy documents, evidence files, vendor assessment responses, incident report details, AI System Register and DPIA entries, security questionnaires and answers. The content is determined by the Customer. |
| AI and assistant content | Prompts, questions, conversation history and evidence excerpts sent to the AI-assisted features, to the extent needed to provide them. |
| Training records | Training assignments, completion status and quiz scores. Individual quiz answers are not stored. |
| Technical data | IP address, browser and device information and request data associated with use of the Platform, Processed for security and abuse prevention. |
Billing and payment data for the Customer's own subscription is Processed by FortressPoint as Controller and described in the Privacy Policy. The Platform does not accept special-category Personal Data and is not designed for health information regulated by the United States HIPAA. Clause 3 sets out the Customer's obligations if it is submitted.
D. Nature and purpose of Processing
Storage, retrieval, structuring, and AI-assisted analysis or generation of the categories of Personal Data above, to enable the Customer to complete compliance self-assessments, generate compliance documents, manage evidence, assess vendor risk, track staff training, report incidents, maintain its AI governance records and answer security questionnaires. Processing also covers what is needed to operate and secure the Platform, prevent fraud and abuse, and respond to the Customer's support requests. Processing is continuous for as long as the Customer uses the Platform.
E. Retention
| Data category | Retention period |
|---|---|
| Compliance content, evidence, chat and AI System Register / DPIA records | For the life of the Customer's account or company. Deleted with the account or company under the deletion process below. No separate automated retention limit applies to this content while the account is active. |
| Staff Roster records | 12 months after the staff member is deactivated. |
| Vendor records and assessment answers | 24 months after the vendor was last active. |
| Trust Page enquiries | 24 months. |
| Platform administrator action log | 5 years. |
| Customer-facing audit and activity log | 90 days. |
| System security and health log | Tiered by event type: 90 days for routine job success records, 1 year for job failures and health events, 5 years for security events. |
| Authentication session events (sign-in and sign-out records) | 1 year. |
| Rate-limiting and abuse-prevention data | 24 to 48 hours. |
| Incomplete verified sign-ups | 90 days from verification, after reminder communications. |
| Account or company deletion | A 14-day grace period after a deletion request, after which deletion proceeds. A company left with no members is purged after 90 days. Records may be kept longer only where the law requires, for example financial records for 6 years. |
| Backups | Backup copies expire in the ordinary course, currently up to 14 days after the live data is deleted. |
The AI providers listed in Annex 3 apply their own limited retention to the content sent to them, described in Annex 3.
Annex 2: Technical and Organisational Security Measures
FortressPoint applies the following measures across the Platform as a whole, rather than configuring them for each customer:
- Database row-level security policies, enforced in production, that restrict access to each customer's data.
- Encryption of data in transit (TLS) and at rest, the latter provided by the managed database and storage providers.
- Role-based access control that distinguishes customer roles (Admin, Editor, Viewer) from platform-administrator roles (Super Admin, Support Admin, Billing Admin), each separately permissioned.
- Server-side rate limiting on authentication, support, vendor-assessment and other abuse-prone endpoints, backed by a persistent store so that it survives server restarts.
- Magic-byte content verification on file uploads, so that a file's actual content is checked against its declared type.
- A strict, nonce-based Content Security Policy and other security response headers.
- A persisted, browsable log of platform-administrator actions and a separate log of system health and security events, with error and security-event monitoring.
- Automated nightly database backups, retained for 14 days.
- Automated code analysis, dependency, secret and web-application security scanning in the development pipeline, with dependency updates reviewed weekly.
- A time-bound account and company deletion process that removes dependent records.
- Use of AI providers under commercial API terms under which customer content is not used to train their models (see Annex 3).
Annex 3: Authorised Sub-processors
This Annex summarises, by category, the Sub-processors FortressPoint engages at the date this DPA starts to apply to the Customer. The names are in the Sub-Processors Register, which the Customer can open in the Platform under Settings, Legal. Prospective customers can ask for it by writing to compliance@fortresspointconsulting.com. The Sub-Processors Register is the authorised list for the purposes of clause 4.4, and this Annex is a summary of it.
| Category | Processing | Processing location |
|---|---|---|
| Identity and account management | User authentication and account and organisation management. This provider is a Sub-processor only for Personal Data outside the account information (names, email addresses, login credentials and similar sign-in data) that it holds as an independent controller. | United States, under the provider's certification to the EU-US Data Privacy Framework and its UK Extension. The provider offers no regional hosting option. |
| Cloud database hosting | Managed Postgres database hosting. | Database stored in Ireland (European Union). The provider's staff may access it from other countries for support and operations. |
| AI generation provider | AI-assisted document generation, self-assessment guidance, questionnaire answering and the in-app Compliance Assistant. | United States. |
| AI embeddings provider | Text embeddings that support evidence and content retrieval. | United States. |
| Email delivery | Transactional and notification email delivery. The provider is also an independent controller for its own account and delivery-log data. | United States, under the provider's certification to the EU-US Data Privacy Framework and its UK Extension. |
| Application hosting, file storage and analytics | Application hosting (server functions run in London), file storage and cookieless web analytics. | United Kingdom for server functions. The provider does not specify a region for file storage or analytics, which may include the United States. |
| Error monitoring | Error tracking, and session replay recorded only when an error occurs (not continuously). | Data stored in the European Union by configuration. The provider is a United States company and its terms allow processing in other countries, including the United States. |
Payment processing is not Sub-processing of Customer Personal Data. Subscription payments are handled by a payment provider in Nigeria, which acts as FortressPoint's processor for payment data and as an independent controller for its own fraud prevention and legal compliance. FortressPoint does not store payment-card details. This is described in the Privacy Policy and is outside this DPA.
AI providers
Under their commercial API terms, neither AI provider uses content sent through the Platform to train its models. The generation provider deletes inputs and outputs within 30 days, and may keep content flagged for policy violations for up to 2 years. The embeddings provider keeps embeddings requests in abuse-monitoring logs for up to 30 days. FortressPoint has not opted in to any programme that shares customer content with either provider for training or product improvement.
FortressPoint will notify Customers of any change to the Sub-Processors Register under clause 4.4.