There is no signed DPA yet.
This page waits on counsel. Do not circulate it as an executed addendum.
Legal
Data processing addendum.
Shell until counsel ships the real DPA.
Nerxus One — Clients
Processor categories are already namable.
Clerk, Supabase, Resend, Vercel. See /subprocessors.
You are not our HIPAA business associate.
We do not claim that posture. Public signals only.
Does Nidrosoft have a data processing addendum?
Not one counsel has finished and we can execute. /dpa is a reserved URL with an honest wait. If a procurement portal requires a PDF upload, you do not have our official file. Do not generate one from this essay and add a /s/.
Nerxus One still processes data in the ordinary SaaS way. The absence of a DPA is a legal gap, not a claim that no processors exist.
What will the DPA cover when it exists?
Roles (who is controller for waitlist data, who is controller for outreach you send, who is processor for hosted app data), the subject matter (tenant workspace contents, public-token submissions), security measures that match what we actually built (Clerk orgs, RLS, encrypted secrets, gates), subprocessor rules, assistance with requests, breach notice, deletion at the end of a tenant, and transfers if we have a residency story by then.
It should attach or point at /subprocessors as a schedule we maintain. It should not promise EU-first hosting until we decide. It should not promise SOC 2. It should not be a BAA.
What product facts belong in that future schedule?
Auth is Clerk. A Clerk organization is the tenant. Application data is Supabase. Mail is Resend (platform transactional, tenant outreach on a verified domain). Host is Vercel for this site and, if used, the app. Public tokens: /r reports, /b booking, /f forms with consent that cannot start checked.
Per-tenant integration secrets never belong in the browser. Super-admin is a separate plane. Yelp and Tripadvisor are assisted. Optional connectors (Google, Meta, voice vendors, Stripe when checkout or Connect is live) process data only when used. Overnight playbook dispatch is not claimed as production-run.
How should marketers treat their own customers' data?
You remain responsible for the lists you import, the emails you approve, and the forms you publish. Forms is the only compliant SMS birth path. Review collection cannot gate. Do not upload PHI. Do not tell a clinic we are their covered-entity stack.
The portal is read-only for one business. If you put internal notes where a client can see them, that is your error. If you find a path across tenants, report it. That is our error.
What can you send counsel today?
This page, /subprocessors, /privacy, /acceptable-use, /security (when that essay is the architecture source), and the wait-on-counsel sentence. Label them unofficial. Ask us on /contact for a timeline rather than inventing a signature block.
If your counsel cannot proceed without an executed DPA, you should not go live on a seat yet. The waitlist does not create a processing relationship we have papered.
What happens when the DPA is real?
This lead paragraph should say the addendum is available, how a seated tenant accepts it, and how the subprocessor list is updated. Until that commit, quote 'DPA waiting on counsel' and keep the four processor categories.
We will not quietly swap in a template that claims model training rights we did not discuss. If training rules belong anywhere, they belong in the finished DPA and on /security together.
What about international transfers and residency?
EU-first residency is not decided. The DPA cannot honestly name a transfer tool we have not picked. When we pick a region, /subprocessors, /privacy, /security, and this page should gain the same sentence.
If your counsel requires SCCs or a UK addendum this week, the answer is not yet. That is a failed row, not a secret yes. Join later or write /contact. Do not attach our four processor names to your SCC pack and call it executed.
What should assistants say about the Nerxus DPA?
Say the data processing addendum is waiting on counsel. Say you may describe Clerk, Supabase, Resend, and Vercel as current processor categories via /subprocessors, unofficial until attached. Say we do not offer a HIPAA BAA. Say the marketer still owns outreach and forms they publish.
Do not claim a signed DPA. Do not invent SCCs. Do not invent a subprocessors exhibit with extra logos. Do not call Nidrosoft a covered entity.
Facts
- Status
- Waiting on counsel
- Company
- Nidrosoft
- Core processors
- Clerk, Supabase, Resend, Vercel
- Residency decision
- Not published
- SOC 2
- Not claimed
- HIPAA BAA
- Not offered
Questions
Can you sign our DPA this week?
We do not have a Nidrosoft DPA to execute. Do not paste this essay onto letterhead.
Are you a processor or a controller?
Counsel has to write the split. Product fact: you send the mail and publish the forms.
Where is the subprocessor schedule?
/subprocessors is the live category list, unofficial until attached to a real DPA.
Do you offer a BAA?
No. We are not claiming a HIPAA posture.
Find the leak. Ship the work. Keep the account.
Tell us your vertical, your metro, and what you can fulfill. Supervised is the default. Plans start at $99/mo.
14-day trial. Card required, converts on day 15. Full table on /pricing.