Data Processing Addendum
The processor terms for the research content you put into OtterSR — what we may do with it, how it is protected, who else touches it, and how it is returned or destroyed.
Last updated
1.Scope and roles
This addendum forms part of the Terms of Service between you (“Customer”) and 18317208 Canada Corp., operating as OtterSR, a federal corporation incorporated under the Canada Business Corporations Act (“OtterSR”). It applies where OtterSR processes personal data on your behalf.
- Research content you upload or generate in a review — references, documents, answers, extracted values: you are the controller, OtterSR is the processor.
- Account, security and billing data about your users: OtterSR is the controller, and the Privacy Policy governs it. This addendum does not cover it.
Where this addendum conflicts with the Terms of Service on the processing of personal data, this addendum wins.
2.Annex I — details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing the OtterSR systematic-review service: storing references and documents, sending their text to a model provider on the Customer’s instruction, and storing the results. |
| Duration | For as long as the Customer’s account is open, plus the retention windows in §8 (30 days for a deleted review, 60 days after closure). |
| Nature and purpose | Storage, retrieval, text extraction from PDFs, transmission to OpenAI for inference and for search embeddings, and display back to the Customer’s authorised users. |
| Types of personal data | Ordinarily: author names, affiliations and contact details appearing in bibliographic records and in the full text of publications; the Customer’s own users’ names and email addresses where they appear in the review (for example as the reviewer who made a decision). Any other personal data is whatever the Customer chooses to upload. |
| Special categories | None permitted. The Terms prohibit uploading protected health information or individual patient records, and OtterSR is not designed to hold them. See §3. |
| Categories of data subjects | Authors of publications; the Customer’s own reviewers and collaborators. |
| Frequency | Continuous for the duration of the account, driven by the Customer’s own actions. |
3.Processing on documented instructions
OtterSR processes research content only on your documented instructions. The service itself is the instruction: importing a file, uploading a document, running a screening job, exporting a dataset. We do not process it for our own purposes and we do not use it to train models or to improve the service for other customers.
If we are required by law to process it otherwise, we will tell you before doing so unless that law forbids it.
4.No protected health information
You must not upload protected health information, individual patient records or other directly identifying data about patients or research participants. OtterSR is not a HIPAA-covered entity or business associate, no business associate agreement is available, and there is no automated control that detects or blocks such content — this is a contractual restriction that you undertake to keep, not a technical measure we enforce.
5.Confidentiality
Everyone with access to research content is bound by a duty of confidentiality. Access is limited to what is needed to operate and support the service, and administrative access to customer content is logged.
6.Annex II — technical and organisational measures
These are measures that exist in the running system today, not aspirations. What is not in place is listed at the end of the security page.
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS for every connection, including to the database. |
| Encryption at rest | Server-side encryption on stored documents; encrypted database storage and snapshots. |
| Tenant isolation | PostgreSQL row-level security. The application connects as a role that cannot bypass it, so a query scoped to the wrong account returns nothing rather than someone else’s rows. Covered by an automated cross-tenant test suite. |
| Document isolation | Each document is written under an account-specific key prefix with a server-generated name; there is no shared cache across accounts. |
| Access control | Sign-in with an email address and a password held by Amazon Cognito (AWS us-east-2); a self-made account’s address is confirmed, and a forgotten password reset, with an emailed code; Google or Microsoft OIDC where offered. OtterSR’s own opaque server-side sessions in httpOnly cookies with 14-day idle and 30-day absolute expiry, revocable individually or all at once, and ended everywhere else when a password is changed or reset; CSRF double-submit on every state-changing request. |
| Least privilege | The application’s cloud role may invoke models and read and write its own storage prefix; it cannot change model access, logging or account configuration. |
| Payment data | Card details are captured directly by Stripe and never reach OtterSR’s servers. |
| Logging and accountability | Structured request logs with request identifiers, an append-only audit log for security- and money-relevant actions, and infrastructure alarms. |
| Deletion | Scheduled purge jobs actually destroy expired soft-deleted content, including the stored documents, rather than hiding it. |
7.Annex III — sub-processors
You authorise the sub-processors listed at /legal/subprocessors, which states what each one receives and where it operates. We will give at least 30 days’ notice before adding or replacing one, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service and receive a refund of any prepaid, unused amounts.
We remain responsible for our sub-processors’ performance of these obligations.
8.Assistance with your obligations
- Data subject requests. The application already lets you find, correct, export and delete content yourself. Where you need more, we will help, at no charge for anything proportionate.
- Impact assessments and prior consultation. We will provide the information we hold that you reasonably need, including this addendum and the security page.
- Security. We will assist you in keeping the obligations in GDPR Articles 32–36 as they apply to the processing we carry out.
9.Personal data breach
We will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your content, with what we know about what happened, which data and data subjects are affected, the likely consequences and the measures taken. We will keep you updated as we learn more.
10.Audits
We will make available the information needed to demonstrate compliance with this addendum, and allow audits by you or an auditor you appoint, subject to reasonable notice and confidentiality, no more than once a year and at your cost.
Being straight about assurance: OtterSR holds no SOC 2, ISO 27001 or equivalent certification, and no independent penetration test has been carried out. There is therefore no audit report to send you in place of an audit.
11.International transfers
Processing takes place in the United States. Transfers from the EEA, the UK or Switzerland are made under the EU standard contractual clauses (module two), which are incorporated into this addendum by reference, with the details in Annexes I and II above.
12.Return and deletion
At any time, and without asking us, you can export everything: per-review exports in CSV, Excel, RIS and R, and a complete machine-readable account export.
On termination, content is destroyed 60 days after closure is requested; a review you delete is destroyed after 30 days. We retain invoices, usage events and the audit log, which contain no research content, for as long as accounting law requires.
13.Liability and term
Each party’s liability under this addendum is subject to the limitation of liability in the Terms of Service, which is currently the amounts you paid us in the 12 months before the claim arose. This addendum takes effect when you accept the Terms and continues for as long as we process research content for you. It is governed by the laws of Ontario and the federal laws of Canada that apply there.