This Data Processing Addendum (“DPA”) is between the customer that uses Morrow (“Customer”) and Enortic, Inc. (“Enortic,” “Processor”). It applies when Enortic processes personal data on Customer’s behalf in a cloud, managed, or shared-workspace deployment.
It does not apply to purely local-first or self-hosted use where Enortic does not receive Customer content. Enterprise customers may request a signed custom DPA and sub-processor review.
1. Roles
Customer is the controller (or a processor acting for its own controller). Enortic is the processor for Customer Content processed in Morrow cloud or managed components. Each party is an independent controller for its own account, billing, and website data, as described in the Privacy Policy.
2. Subject matter and duration
Enortic processes Customer Content to provide Morrow: company memory, tasks, planning, agents, and connected integrations. Processing lasts for the subscription and any agreed wind-down, then data is deleted or returned as set out below.
3. Nature and purpose
- Store, index, and retrieve project memory that Customer or its users approve
- Run Mor and other agents only after a human approval gate, unless Customer configures otherwise in writing
- Sync integrations Customer connects, limited to invited projects
- Host shared workspaces, SSO, and admin controls on Business and Enterprise
- Provide support when Customer shares data with us
Enortic does not use Customer Content to train public models.
4. Types of data and data subjects
Customer determines what it puts into Morrow. This may include names, work emails, roles, meeting notes, tickets, chat excerpts, files, and similar workplace data about Customer’s employees, contractors, customers, or other contacts. Enortic does not need special categories of data to run Morrow and asks Customer not to upload them unless a written agreement says otherwise.
5. Customer instructions
Enortic processes Customer Content only on documented instructions: this DPA, the Terms, product configuration, and written orders. Enortic will tell Customer if an instruction appears to breach GDPR, KVKK, or similar law, unless the law forbids that notice.
6. Confidentiality and personnel
Enortic limits access to personnel who need it to provide the service and binds them to confidentiality. Production access is logged and reviewed.
7. Security
Enortic maintains appropriate technical and organizational measures, including:
- TLS 1.3 in transit
- AES-256 at rest for cloud components
- OS keychain storage for local secrets
- Role-based access, project isolation, and optional SSO
- Human approval before agents write to tasks, plans, or integrations
Details are on the Trust page. Enterprise may add customer-managed keys and air-gapped deploy.
8. Sub-processors
Customer authorizes Enortic to use infrastructure sub-processors required to host Morrow cloud components, currently Amazon Web Services in Frankfurt (EU) or Virginia (US), plus payment and calendar vendors for account and demo flows. Enortic will impose data-protection terms no less protective than this DPA and remains responsible for its sub-processors.
Integration providers Customer connects are Customer’s processors or controllers, not Enortic sub-processors. Enterprise customers may request a current sub-processor list and review window.
9. International transfers
Where Customer Content leaves the EEA, UK, or Türkiye, Enortic uses a lawful transfer mechanism such as Standard Contractual Clauses or an adequacy decision, together with the measures in this DPA. Data residency is available on Enterprise.
10. Assistance
Taking into account the nature of processing, Enortic will help Customer respond to data subject requests, DPIAs, and consultations with authorities, at Customer’s reasonable request. Customer is responsible for requests it can fulfill in the product (access, deletion, project wipe).
11. Breach notice
Enortic will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content, and will provide information reasonably available to help Customer meet its own notice duties.
12. Return and deletion
When the service ends, or earlier on written request, Enortic will delete Customer Content from cloud components or return it in a reasonable format, unless law requires retention. Backups age out on a rolling schedule. Local-first copies remain under Customer’s control.
13. Audits
Enortic will make available information reasonably necessary to demonstrate compliance with this DPA. SOC 2 Type II is in progress. Enterprise customers may agree a custom audit right, including a 4-hour critical incident SLA where contracted.
14. Liability and order of documents
Liability under this DPA follows the Terms, except where data-protection law says otherwise. If there is a conflict about processing Customer Content, this DPA controls.
15. Contact
Enortic, Inc., Dover, DE 19904 · [email protected] · (302) 546-5141 · Request a signed DPA