Data processing addendum

The same list, with fuller descriptions, is on the Trust Center. Razorpay processes billing data only and never touches RFQ, quote or customer records.

5. International transfers

Customer data is stored in the USA by default at every tier, on AWS US-East and US-West, with no offshore replication. EU or India residency is available on Enterprise by contract. Where processing involves a restricted transfer of personal data out of the EEA or the UK, the parties incorporate the European Commission's standard contractual clauses (Module Two, controller to processor) and, for UK transfers, the UK International Data Transfer Addendum, together with a transfer risk assessment available on request. We will co-operate with any supplementary measures reasonably required.

6. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2 or better) and at rest (AES-256), role-based access control, audit logging, encrypted daily backups with point-in-time recovery, a 4-hour RTO and 1-hour RPO target, and an independently audited SOC 2 Type II control environment. The full description is in the Trust Center and forms part of this addendum by reference.

7. Breach notification

We will notify you without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting your data. The notice will describe the nature of the breach, the categories and approximate number of records and data subjects affected so far as known, the likely consequences, the measures taken or proposed, and a contact point. We will provide updates as the investigation progresses, and we will not delay an initial notice merely because the picture is incomplete.

8. Assistance, audit and data subject requests

We will assist you, taking into account the nature of processing, with data subject requests, data protection impact assessments and consultations with a supervisory authority. If a data subject contacts us directly about data in your workspace, we will route them to you rather than answer for you. On request, and no more than once a year unless a regulator requires otherwise, we will provide our SOC 2 Type II report and respond to a reasonable security questionnaire; on-site audit rights are available under a negotiated Enterprise agreement.

9. Return and deletion

You can export your records in CSV and JSON at any time during the subscription. After termination we retain your data for 30 days so an export can be completed, then delete it. Backups containing it age out within a further 30 days on their normal cycle. We will confirm deletion in writing on request.

10. Order of precedence and governing law

This addendum forms part of the terms of service and prevails over them to the extent of any conflict about the processing of personal data. A negotiated DPA signed by both parties prevails over this published version. This addendum is governed by the laws of the State of Delaware, USA. Contracting entity: Soor LLC, 16192 Coastal Hwy, Lewes, DE 19958, USA. Privacy contact: [email protected]; security contact: [email protected].