Data Processing Agreement

Last updated: May 6, 2026 · Compliant with GDPR Article 28

Who this applies to

This Data Processing Agreement (DPA) applies to customers who process personal data of EU/EEA residents using Credible Documents. By using the Service, you (the "Controller") agree to this DPA with Blakiston Peak LLC (the "Processor"), as required by GDPR Article 28.

1. Definitions

Controller: The customer who determines the purposes and means of processing personal data
Processor: Blakiston Peak LLC / Credible Documents, which processes data on behalf of the Controller
Data Subject: The individual whose personal data is processed
Personal Data: Any information relating to an identified or identifiable natural person
Processing: Any operation performed on personal data
GDPR: EU General Data Protection Regulation 2016/679

2. Subject Matter and Nature of Processing

Category	Details
Subject matter	Document management, authentication, electronic signing, and verification services
Duration	For the term of the Service agreement
Nature	Storage, retrieval, transmission, hashing, and blockchain recording of documents
Purpose	Providing document authentication and signing services as instructed by the Controller
Data types	Names, email addresses, IP addresses, document contents, signing timestamps
Data subjects	Controller's customers, employees, contractors, and document signers

3. Processor Obligations

Blakiston Peak LLC (Processor) agrees to:

Process personal data only on documented instructions from the Controller
Ensure persons authorized to process personal data are bound by confidentiality
Implement appropriate technical and organizational security measures (see Section 5)
Not engage sub-processors without prior written consent from the Controller
Assist the Controller in fulfilling data subject rights requests
Assist the Controller with security obligations, breach notifications, and impact assessments
Delete or return all personal data upon termination of services
Provide all information necessary to demonstrate compliance with GDPR Article 28

4. Controller Obligations

The Controller agrees to:

Have a lawful basis for processing personal data before using the Service
Provide appropriate privacy notices to data subjects
Ensure data subjects' rights can be exercised
Only instruct the Processor to process data in compliance with GDPR
Not upload Special Category Data (health, biometric, racial, religious data) without specific arrangements

5. Technical and Organizational Security Measures

        Implemented Safeguards
        Pseudonymization & Encryption: AES-256 encryption at rest, TLS 1.2+ in transit, bcrypt password hashing
Confidentiality: Access controls, session management, API key authentication
Integrity: Cryptographic hashing (SHA-256), blockchain immutability, HMAC webhook signatures
Availability: Daily automated backups, 10-day retention, containerized infrastructure
Resilience: Docker container isolation, database backups with email confirmation
Access control: 2FA, rate limiting, account lockout, tiered permissions
Audit logging: Comprehensive audit trail for all document actions
Virus scanning: ClamAV scanning on all uploaded files with daily definition updates
Secret rotation: Monthly cryptographic secret key rotation

    

6. Sub-Processors

Sub-Processor	Purpose	Location
Stripe Inc.	Payment processing	United States
Hostinger	Email delivery (SMTP)	United States / EU

The Controller consents to the use of the above sub-processors. The Processor will notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

7. International Data Transfers

Personal data is currently processed and stored in the United States. Transfers from the EU/EEA to the US are made on the basis of Standard Contractual Clauses (SCCs) as adopted by the European Commission. By accepting this DPA, you agree to these transfer mechanisms.

We are working toward EU data residency as a future product milestone, which will allow EU customers to keep their data within the EU.

8. Data Breach Notification

In the event of a personal data breach, the Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, consistent with GDPR Article 33 requirements. Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

9. Data Subject Rights

The Processor will assist the Controller in responding to data subject rights requests including: access, rectification, erasure, portability, restriction, and objection. Submit requests to [email protected]. We will respond within 5 business days.

10. Audit Rights

The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable notice (minimum 30 days) and confidentiality obligations. Audits may be conducted by the Controller or a qualified third-party auditor appointed by the Controller.

11. Term and Termination

This DPA remains in effect for the duration of the Service agreement. Upon termination, the Processor will delete or return all personal data within 30 days, except where retention is required by law (e.g., signed document audit trails — 7 years).

12. Governing Law

This DPA is governed by the laws of the State of Florida, United States, without prejudice to the rights of EU data subjects under GDPR.

Need a signed DPA?

For enterprise customers requiring a countersigned DPA document, please contact us. We can provide a signed PDF within 2 business days.

Request Signed DPA →

13. Contact

Blakiston Peak LLC — Data Controller & Processor
13459 Romford Ave, Port Charlotte, FL 33981, United States
[email protected]