DORA addendum

This addendum adds the terms the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554, Article 30) asks of an ICT service provider to the data processing agreement and the end user terms for Rainbook and Rainbook Mail Sync. It applies when the customer is a financial entity under that regulation and uses the Regulated pack. Where this addendum and those documents differ, this addendum governs for that customer.

1. The service

Human Renaissance Corporation ("we") provides Rainbook, a CRM that runs inside the customer's Jira Cloud site, and Rainbook Mail Sync, which captures the customer's email and meetings onto Rainbook's records, as Atlassian Forge apps on Atlassian's cloud. With the Regulated pack the service includes the regulated store for email bodies and files, sealed history with offline verification, the sensitive-data detectors, the Confidential space and ethical walls, as described on the Regulated pack page.

2. Where data is processed and stored

• The customer's records are Jira work items in the customer's Jira site, and Rainbook's own data is in the Forge storage Atlassian hosts for that site, in the site's data residency region.
• Rainbook's AI runs on Forge LLM, in Atlassian's AI processing locations.
• Rainbook Mail Sync reads mail and calendars from the customer's own Google Workspace or Microsoft 365 tenant.
• Every provider and where it processes data is in the register below. We tell the customer at least 30 days before a new provider receives data.

3. Data protection, availability, integrity and confidentiality

We protect the customer's data as the data processing agreement sets out. Data is encrypted at rest and in transit, every request is checked against the caller, the licence and Jira permissions, and each site's data is kept apart by Atlassian's Forge platform; Encryption at Rest and Data Handling give the details. Sealed history lets the customer prove that activity history has not been changed.

4. Access, recovery and return of data

The customer's records stay in its own Jira site, where its admins can export them at any time. The pack's Download full regulated export gives the customer every regulated email body and file and its sealed history, in an open format, whenever it asks, during the contract and when it ends.

5. Service levels

Our service levels, including response times by severity and our availability targets, are on our service levels page. We tell the customer before any change that lowers them.

6. Incident assistance

We tell the customer without undue delay, and within 72 hours, about any incident that affects its data, help it handle and report ICT-related incidents that involve the service, and give it the facts it needs for its own reports, at no extra cost. Our process is on Incident Response.

7. Cooperation with authorities

We cooperate fully with the customer's competent authorities and resolution authorities, including any person they appoint.

8. Termination rights

The customer may end the agreement for the service if we materially breach applicable law, regulation or these terms; if its monitoring finds circumstances that could change how the service performs; if we show weaknesses in our ICT risk management, including in how we keep data available, authentic, intact and confidential; or if a competent authority can no longer supervise the customer effectively because of this agreement.

9. Exit support

When the agreement ends, we keep the service running for a transition period agreed with the customer, so it can move to another provider or bring the service in-house, and we help it export its data in full.

10. Audit, access and inspection

The customer, an auditor it appoints and its competent authority may access, inspect and audit the service, our premises and the information they need, on reasonable notice, and may take copies of the relevant documents. Where many customers ask for the same thing, we may offer a pooled audit or a third-party report instead, as the regulation allows.

11. Testing

On request, we take part in the customer's ICT security awareness programmes and digital operational resilience training, and in its threat-led penetration testing.

12. Subcontracting

The service runs on Atlassian's cloud; Atlassian is our principal subcontractor for every function the service supports. The other providers in the register below support parts of the service, several only when the customer's admin turns them on. We tell the customer before a material change to these providers, and the customer may object as the data processing agreement sets out.

ICT third-party service providers

Register of information

The data a financial entity records about this arrangement in its register of information:

To sign this addendum or ask for our completed register template, write to privacy@rainbook.humanr.ai.