Data Processing Addendum
Data Processing Addendum
Last Updated: 12th Nov, 2026
This Data Processing Addendum, including any Appendixes and any documents incorporated therein by reference, including the Standard Contractual Clauses and ICO Addendum, as applicable (“DPA”) is entered into by and between Hiver, Inc. (“Company”, “Data Processor”) and an entity that entered into an Agreement (“Customer”, “Data Controller”) (each referred to individually as a “Party” and collectively as the “Parties”). This DPA is incorporated into the Agreement.
The Parties have entered into the Agreement that involves the processing of personal data. The Parties seek to implement a data processing addendum that complies with the requirements of the current legal framework in relation to the processing of personal data. The Parties wish to set forth their rights and obligations herein.
In consideration of the mutual covenants and agreements of the Parties as set forth in this DPA, the Parties agree as follows:
1. DEFINITIONS
1.1 Defined Terms. All defined terms used in this DPA with initial capital letters have the meaning as set forth in Appendix A, unless defined elsewhere in this DPA or as otherwise set forth in this Section 1. “Section” and “Appendix” means a section and appendix of this DPA. The singular meaning of a defined term shall have the same meaning as the plural meaning and vice versa.
1.2 Additional Defined Terms. The terms “controller”, “data subject”, “personal data”, “personal data breach”, “processor”, “processing”, “subprocessor”, and “supervisory authority” used in this DPA will have the same meaning as set forth in the Data Protection Laws and their cognate (related) terms shall be construed accordingly.
1.3 Terms without Definition. Capitalized terms used without definition in this DPA will have the same meaning as set forth in the Agreement.
2. PROCESSING OF PERSONAL DATA
2.1 Data Processing. The Data Controller is allowing the Data Processor to perform data processing activities as specified in Appendix B. Appendix B describes the subject matter, nature and purpose of the Personal Data processing, its duration and the applicable retention periods, the frequency of transfer, the categories of data subjects, the categories and types of Personal Data processed, any special categories of Personal Data, the geographic locations of processing, and the Subprocessors engaged. Where Section 11 applies, Appendix B also constitutes Annex I.B of the Standard Contractual Clauses.
2.2 Instructions. Data Processor agrees to comply with all applicable Data Protection Laws in the processing of the Personal Data; and not process the Personal Data other than based upon Data Controller’s’s instructions, as set forth in this DPA, Data Processor’s business obligations, or as otherwise agreed by the Parties. Further, unless otherwise instructed by the Data Controller or otherwise set forth in this DPA and/or the Agreement, Data Processor will not (a) retain, use, or disclose Personal Data for any purpose, including any commercial purposes; (b) retain, use, or disclose Personal Data outside the direct business relationship between Company and Customer; (c) combine the Personal Data with any information received from or on behalf of any other person or entity; or (d) sell or share the Personal Data.
3. DATA PROCESSOR’S PERSONNEL
Access to Personal Data. Data Processor agrees to take reasonable steps to ensure the reliability of any of their Personnel who may have access to Personal Data, ensuring in each case that (a) access is limited to those Personnel who have a need to know the Personal Data, as necessary for the purposes of the Agreement, and (b) all such Personnel have a signed written agreement with Data Processor requiring such Personnel to be subject to and comply with obligations of confidentiality.
4. SECURITY
4.1 Security Implementation. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing, as well as, the risk of varying likelihood and severity for the rights and freedoms of natural persons, Data Processor agree to, in relation to the Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in the Data Protection Laws.
4.2 Appropriate Levels of Security. In assessing the appropriate level of security, Data Processor will take into account the risks that are presented by processing the Personal Data, in particular from a personal data breach.
4.3 Technical and Security Measure. Data Processor maintains technical and security measures as specified in Appendix C.
5. SUBPROCESSORS
5.1 Engaging with Subprocessors. To the extent that Subprocessors are applicable, Data Controller acknowledges and agrees that Data Processor may engage with Subprocessors in connection with the fulfillment of their obligations under the Agreement; provided, that, Data Processor agrees to (a) restrict Subprocessors’ access to Personal Data only to the extent necessary to fulfill Data Processor’s obligations under the Agreement; and (b) enter into a written agreement with each Subprocessor containing data protection obligations at least as protective as those set forth in this DPA with respect to the protection of the Personal Data.
5.2 List of Subprocessors. Data Processor’s list of Subprocessors can be found on Data Processor’s website at https://hiverhq.com/third-party-subprocessors (or successor URL). If Data Processor engages with a new or replacement Subprocessor(s), then Data Processor agrees to provide the Data Controller with a list of any new or replacement Subprocessor(s) at least ten (10) days prior to any such change. Within five (5) days of any such notice from Data Processor with regard to new or replacement Subprocessors, Data Controller will provide to Data Processor any objection to such change. If Data Controller fails to object to such change within such a five (5) day period, then Data Controller is deemed to have consented to such change.
5.3 Responsible for Subprocessors. Data Processor will remain responsible for any acts or omissions of their Subprocessors that cause Data Processor to breach any of Data Processor’s obligations under this DPA.
6. DATA SUBJECT RIGHTS
Requests from Data Subjects. Data Processor agrees to promptly notify Data Controller if it receives a request from a data subject in respect to their Personal Data and is protected under any Data Protection Laws. Data Processor agrees that they will not respond to any such requests, except on the written instructions of the Data Controller.
7. PERSONAL DATA BREACH
7.1 Notice of Personal Data Breach. Data Processor agrees to notify Data Controller within seventy-two hours of when Data Processor becomes aware of a personal data breach affecting their Personal Data. Further, Data Processor agrees to provide Data Controller with sufficient information to allow Data Controller to meet any obligations to report or inform data subjects of the personal data breach under the Data Protection Laws.
7.2 Cooperation. Data Processor agrees to cooperate with Data Controller and take reasonable commercial steps as directed by Data Controller to assist in the investigation, mitigation, and remediation of each such personal data breach.
8. DATA PROTECTION IMPACT ASSESSMENT AND CONSULTATION
Reasonable Assistance. Data Processor agrees to provide reasonable assistance to Data Controller with any data protection impact assessments, and consultations with supervising authorities or other competent data privacy authorities, which Data Controller reasonably considers to be required by the Data Protection Laws, if applicable, in each case solely in relation to processing of the Personal Data by, and taking into account the nature of the processing and information available to Data Processor.
9. DELETION OR RETURN OF PERSONAL INFORMATION
9.1 Deletion of Personal Data. Data Processor promptly and in any event within fourteen (14) calendar days of the date of termination of the Agreement involving the processing of Personal Data (the “Termination Date”), delete and procure the deletion of all copies of Personal Data. Further, Data Processor may retain Personal Data to the extent required by applicable laws, but only to the extent and for the period of time as required by applicable law.
9.2 Notice to Data Controller. Data Processor will provide written certification to Data Controller that it has complied with the terms of Section 9.1 within ten (10) business days of the Termination Date.
10. AUDIT RIGHTS
Compliance. Data Processor will make available to Data Controller, upon written request and no more than once per twelve (12) month period (unless a personal data breach has occurred or a supervisory authority requires additional audits), all information reasonably necessary to demonstrate compliance with this DPA and Data Protection Laws, and will allow for and contribute to audits, including inspections, by Data Controller or an auditor mandated by Data Controller (provided such auditor is not a competitor of Data Processor), at Data Controller’s expense, upon thirty (30) days’ prior written notice, during normal business hours,in relation to the processing of Personal Data, as set forth in this DPA. Data Processor may satisfy audit requests by providing Data Controller with copies of its then-current SOC 2 Type 2 report and ISO 27001 certification; provided, that, if such reports do not reasonably address Data Controller’s concerns, Data Controller retains the right to conduct an on-site audit subject to the terms of this Section
11. DATA TRANSFER
11.1 Transfer of Personal Data. To the extent that Personal Data originating from the EU, the EEA or the United Kingdom is transferred by Data Controller to Data Processor in an Inadequacy Decision Country, the Parties agree as follows.
- Data Privacy Framework. Where and for so long as Data Processor maintains an active certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, transfers to Data Processor in the United States are made in reliance on that certification.
- Standard Contractual Clauses. Where paragraph (a) does not apply, the Standard Contractual Clauses are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where Data Controller is a controller; Module Three (processor to sub-processor) applies where Data Controller is itself a processor acting on behalf of a third-party controller. The optional clauses are elected as set out in Section 11.2.
- ICO Addendum. For transfers subject to the UK GDPR, the ICO Addendum is incorporated into this DPA by reference and applies to the Standard Contractual Clauses as modified by it, completed as set out in Section 11.3.
- Precedence. In the event of a conflict between this DPA and the Standard Contractual Clauses or the ICO Addendum, the Standard Contractual Clauses or the ICO Addendum prevail.
11.2 Elections under the Standard Contractual Clauses. Clause 7 (docking clause): applies. Clause 9(a): Option 2 (general written authorisation) applies, with the notice period set out in Section 5.2. Clause 11(a) (independent dispute resolution): the optional wording does not apply. Clause 13: the competent supervisory authority is identified in Annex I.C. Clause 17: Option 1 applies, and the Standard Contractual Clauses are governed by the law of Ireland. Clause 18(b): disputes are resolved before the courts of Ireland.
11.3 Completion of the ICO Addendum. Table 1 is completed with the Parties’ details as set out in Annex I.A. Table 2 identifies the Approved EU SCCs as the version incorporated under Section 11.1(b), including the Appendix Information below. Table 3 is completed by Annexes I, II and III to this DPA. In Table 4, neither Party may terminate the ICO Addendum when the Approved Addendum changes.
11.4 Annexes. For the purposes of the Standard Contractual Clauses and the ICO Addendum: Annex I.A and Annex I.C are set out below; Annex I.B is Appendix B to this DPA; Annex II is Appendix C to this DPA; and Annex III is the list of Subprocessors referred to in Section 5.2.
12. TERM AND TERMINATION
12.1 Term of this DPA. This DPA will remain in effect until terminated in accordance with its terms, as set forth in this DPA.
12.2 Material Breach. If Data Controller determines that Data Processor has violated or breached a material term and/or condition of this DPA or Data Processor can no longer meet their obligations under this DPA, then Data Controller may immediately terminate this DPA and the Agreement with written notice to Data Processor.
12.3 Termination in Connection with Subprocessors. In the event that Data Controller does not agree with any new or replacement Subprocessor(s) as provided by Data Processor under Section 5.2 (List of Subprocessors), then Data Controller will have the right to terminate the Agreement pursuant to the terms of the Agreement.
12.4 Termination of the Agreement. If the Agreement is terminated pursuant to the terms of the Agreement, then this DPA will immediately and automatically terminate, unless another agreement is entered into by and between the Parties where personal information is being processed.
13. GENERAL
13.1 Modifications to this DPA. From time to time, the Company may modify the terms of this DPA. If Company makes changes to this DPA, Company will provide Customer with notice by displaying a prominent notice on Company’s website, located at https://hiverhq.com (or successor URL) (“Website”) or by sending Customer an email. The customer agrees to read any such notice carefully. Having received notice of any changes to this DPA, if Customer continues the relationship between the Parties for more than fifteen (15) calendar days after such notice, then Customer is deemed to have agreed to the terms of the updated DPA. If Customer does not wish to continue the relationship with Company pursuant to the terms of an updated DPA, then Customer may terminate this DPA and the Agreement with thirty (30) days written notice to Company. Neither the course of conduct between the Parties nor trade usage will act to modify or alter the provisions of this DPA.
13.2 Provisions of the Agreement. Except as expressly set forth in this DPA, this DPA is subject to each and every provision of the Agreement, all of which are incorporated in this DPA by reference. Except as expressly set forth in this DPA, all other provisions of the Agreement will remain in full force and effect.
APPENDIX A
DEFINITIONS
- “Agreement” means the subscription agreement, including any amendments and any other documents incorporated therein by reference, by and between Company and Customer.
- “Contractors” means a person or entity that enters into a written agreement with a Party to perform services for such Party. For purposes of clarification, Contractors include consultants, agents, and advisors.
- “Data Controller” means a person or entity that decides the purpose of the processing of personal information and how personal information is processed.
- “Data Processor” means a person or entity that processes personal information on behalf of a data controller, and under the instructions of the data controller.
- “Data Protection Laws” means the laws of the applicable country and state to which Company and Customer are subject, including (a) to the extent the EU GDPR applies, the privacy law of the EU which relates to the protection of personal data; and (b) to the extent the UK GDPR applies, the privacy law of the United Kingdom which relates to the protection of personal data.
- “EU” means the European Union and European Economic Area.
- “EU GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal information and on the free movement of such data (also known as the General Data Protection Regulation), and repealing Directive 95/46/EC.
- “European Commission” means the EU’s supervisory authority that establishes the data privacy rights of individuals.
- “ICO” or “Information Commissioner’s Office” means the UK’s supervisory authority that establishes the data privacy rights of individuals.
- “ICO Addendum” means the ICO’s international data transfer addendum to the Standard Contractual Clauses pursuant to the UK GDPR.
- “Inadequacy Decision Countries” means countries located outside of the EU and the UK where it has been determined by the European Commission and the United Kingdom’s Information Commissioner’s Office that such countries do not have adequate data protection laws compared to the rights and freedoms protected under the EU GDPR and UK GDPR, respectively.
- “Order Form” means an ordering document, including any exhibits to an Order Form, signed by both Parties, that references the Agreement, and specifies terms between the Parties.
- “Personnel” means the employees and Contractors that are hired by a Party.
- “Privacy Policy” means a document that explains how a Party collects, uses, stores, and shares personal information of various users, and informs users about their rights with respect to their personal information. Data Processor’s Privacy Policy can be found here.
- “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data from the EU to Inadequacy Decision Countries, pursuant to the EU GDPR.
- “Subprocessor” means any entity engaged by the Data Processor that processes Personal Data on behalf of the data processor.
- “UK” or “United Kingdom” means England, Wales, Scotland, and Northern Ireland.
- “UK GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), as it forms part of the law of the UK by virtue of section 3 of the European Union (Withdrawal) Act 2018.
Annex I.A — List of Parties
| Field | Data exporter | Data importer |
| Name | The Customer identified in the Agreement | Hiver, Inc. |
| Address | As set out in the Agreement or the applicable Order Form | 2880 Zanker Rd, #203, San Jose, CA, United States |
| Contact person | As set out in the Agreement or the applicable Order Form | Pranav Panat, Lead Information Security & Compliance Engineer, security@hiverhq.com |
| Activities relevant to the transferred data | Use of the Services as described in Appendix B | Provision of the Services as described in Appendix B |
| Role | Controller, or processor where the Customer acts on behalf of a third-party controller | Processor |
Annex I.C – Competent supervisory authority
Where the data exporter is established in an EU Member State, the supervisory authority of that Member State. Where the data exporter is not established in an EU Member State but falls within the territorial scope of the EU GDPR under Article 3(2) and has appointed a representative under Article 27, the supervisory authority of the Member State in which that representative is established. Where the data exporter is not established in an EU Member State but falls within the territorial scope of the EU GDPR under Article 3(2) without being required to appoint a representative, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located. For transfers subject to the UK GDPR, the Information Commissioner’s Office.
APPENDIX B
DESCRIPTION OF DATA PROCESSING
Subject-matter | Data Processor’s provision of the Services to the Data Controller under the Agreement. The Services include: (a) Hiver in Gmail, a shared inbox and helpdesk extension to Data Controller’s Google Workspace; (b) Hiver Omni, a standalone omnichannel helpdesk platform for email (Google Workspace, Microsoft 365 and other providers), live chat, WhatsApp, Slack, Microsoft Teams, voice and SMS; and (c) related Add-Ons that Data Controller enables, including the help center, customer portal, AI features, AI assistant (MCP) connectors and third-party app integrations. |
Purpose of processing the Personal Data | Solely to provide, maintain, secure and support the Services in accordance with the Agreement, this DPA and Data Controller’s documented instructions, including resolving technical issues and support requests raised by Data Controller. Data Processor will not use Personal Data to train AI models that are shared across customers. |
Nature of processing the Personal Data | Collection through authorised connections (Gmail API and Microsoft Graph OAuth, channel webhooks and widgets); recording, organisation, structuring and storage; synchronisation of conversations across Users; retrieval, display and search; assignment, tagging, status and SLA tracking; workflow automation; reporting and analytics; recording, transcription and summarisation of voice calls; AI-assisted drafting, summarisation, classification and quality review, which includes sending prompts to AI subprocessors and creating vector embeddings; real-time exchange of identifiers and lookup data with third-party apps that Data Controller connects; backup and restoration; support and troubleshooting access; and deletion. Data Processor does not engage in automated decision-making that produces legal or similarly significant effects. |
Duration of processing the Personal Data | For the term of the Agreement, and afterwards until deletion in accordance with Section 9 and the retention periods set out below. |
Frequency of transfer | Continuous, for the duration of the Agreement. |
Retention period | Active Personal Data is retained for the term of the Agreement, subject to deletion by Data Controller through the Services. For Hiver in Gmail, email bodies and attachments are deleted within one (1) hour of collection. Following the Termination Date, Personal Data is deleted from production systems within fourteen (14) calendar days in accordance with Section 9.1. Residual copies held in encrypted backups are isolated from further processing and purged within sixty (60) days. AI activity logs are retained for ninety (90) days. Service logs are retained for thirty (30) days and thereafter archived for ninety (90) days. Access records are retained as set out in Appendix C. |
Geographic location of processing the Personal Data | Primary hosting and storage: Amazon Web Services, us-west-2 region (Oregon, United States). Encrypted backup copy: Google Cloud in United States. Remote support and engineering access: India, by Data Processor’s affiliate Grexit Software Pvt. Ltd., on a least-privilege basis. Subprocessors process Personal Data in the locations listed under “Subprocessors” below. |
Subprocessor | The Subprocessors listed at – https://hiverhq.com/third-party-subprocessors as of the effective date of this DPA, each processing Personal Data only for the purpose and in the country shown there. Subprocessors that process Personal Data include: Amazon Web Services, Inc. (hosting, US); Google LLC (infrastructure, email communication, backups, US); Microsoft Corporation (authentication, email sync, LLM APIs, Teams relay, US); OpenAI, Inc. (AI features, US); Pinecone Systems, Inc. (vector database, US); LangChain, Inc. (AI monitoring, US); Twilio Inc. (Hiver Omni voice, US); Tray.io, Inc. (integrations, US); Grexit Software Pvt. Ltd. (support and development, India). Subprocessors process Personal Data for the duration of the Agreement on the same terms as this DPA. Changes are notified under Section 5.2. |
Categories of Data Subjects | (a) Data Controller’s Users (employees, contractors and other individuals authorised to use the Services); (b) Data Controller’s customers, prospective customers, end users, suppliers, business partners and other individuals who communicate with Data Controller through a channel connected to the Services, including email, chat, WhatsApp, Slack, Microsoft Teams, telephone and SMS; (c) individuals who are named in, copied on, or whose information is contained in such communications or their attachments; (d) members of Microsoft Teams channels connected to the Services, including members from other organisations in shared channels; and (e) individuals whose records Data Controller makes available from connected third-party apps. |
Categories of Personal Data | (a) Identity and contact data; (b) communication content; (c) communication metadata; (d) voice data; (e) customer feedback; (f) technical and usage data; (g) authentication data; (h) AI-feature data; (i) integration data. Each category is detailed in the next row. |
Types of Personal Data that is processed | (a) name, username, email address, telephone number, job title, company, postal or business address; (b) email message bodies and subject lines; attachments (documents, images, audio and video); chat, WhatsApp, Slack, Teams and SMS messages; internal notes, shared drafts and templates; (c) sender, recipient and CC addresses and display names, email headers, message IDs, labels and folders, timestamps, assignee, tags, status and SLA data; (d) for Hiver Omni voice only: call recordings, voicemail, transcripts, AI-generated call summaries and caller telephone numbers; (e) customer satisfaction ratings, free-text feedback and sentiment indicators; (f) IP address, device identifiers, browser and operating system type, approximate geolocation derived from IP address, and feature-usage logs; (g) encrypted OAuth access and refresh tokens and salted and hashed passwords for Hiver Omni accounts (no end-user passwords for Hiver in Gmail are stored); (h) AI request logs (request ID, User and account identifier, capability invoked, outcome, duration); (i) identifiers of records in connected apps (e.g., order, customer or ticket ID) and data retrieved from those apps in real time. For Hiver in Gmail, email bodies and attachments are held only transiently while syncing and are not stored permanently, except where Data Controller enables features that require storage. |
Special categories of Personal Data | Data Processor does not require special categories of personal data or criminal-offence data, and does not inspect communication content to identify them. Such data may nonetheless be included in communications that Data Controller, its Users or its correspondents submit. Where this happens, Data Processor applies the following safeguards such as Restricted classification, role-based least-privilege access, multi-factor authentication, encryption in transit (TLS 1.2+) and at rest (AES-256), access logging. Data Controller is responsible for deciding whether to submit such data and for any additional agreement required (for example, a HIPAA business associate agreement). The Data Processor does not use voice data to identify individuals uniquely by their biometric characteristics. |
APPENDIX C
DESCRIPTION OF DATA PROCESSING
The company maintains an Information Security Management System (ISMS) aligned with ISO 27001:2022 and undergoes annual SOC 2 Type 2 audits to ensure appropriate technical and organizational measures are implemented to protect Data Controller’s Personal Data, including maintaining its confidentiality, integrity, and availability.
The security measures implemented include:
- Governance and Compliance
Standards and Audits. Company maintains an Information Security Management System certified to ISO 27001:2022 and undergoes annual SOC 2 Type 2 audits. Company’s security and privacy program is designed to support compliance with the GDPR, HIPAA and the CCPA. Annual penetration testing and internal and external vulnerability assessments are conducted on production infrastructure.
Vendor Security. A documented risk assessment is conducted for all subcontractors with access to confidential or Personal Data, and a data protection impact assessment is conducted where required by applicable law. Subcontractors with such access are required to demonstrate SOC 2 Type 2 or ISO 27001 certification.
- Access Control and Authentication
Role-Based Access Control (RBAC): Implemented for all system components to ensure that only authorized personnel can access confidential information.
Authentication: All staff members must be authenticated. Remote access requires an approved Virtual Private Network (VPN) solution with mandatory Multi-Factor Authentication (MFA).
Logging: Access records are maintained for a maximum of 3 months to support investigations.
- Network and System Security
Network Segmentation: Implemented to isolate critical systems, production, development, and user networks, minimizing the scope of any security breach, in alignment with Zero Trust principles.
Firewall Protection: Firewalls isolate all non-public data hosts and are specifically configured to monitor and restrict unauthorized transmission of Personally Identifiable Information (PII) and Consumer Personal Information, in line with GDPR and CCPA obligations.
Data in Transit: All data transmitted over the Company’s networks is protected using strong cryptographic controls, with Transport Layer Security (TLS) version 1.2 or higher mandatory.
Endpoint Security: Anti-virus software is installed on all endpoints. Critical identified laptops utilize full disk encryption.
- Data Protection, Integrity, and Retention
Data Loss Prevention (DLP): DLP controls are in place to address risks of data theft, loss, and leakage. This includes URL filtering, G Suite download monitoring, and quarantine for external emails with attachments.
Storage and Encryption. Personal Data is stored in access-controlled managed database and object storage services within Company’s AWS production environment, segregated by customer account, with access granted on a least-privilege, need-to-use basis. Personal Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.
Disposal: Secure, documented sanitization methods are used for retired media to ensure unrecoverable deletion of data.
Backup and Recovery: Backup and system recovery procedures are in place and tested regularly. Backup data is retained for a period of 60 days for customer data.
Backups of data on AWS Cloud are scheduled daily and are available.
- Incident Management and Business Continuity
Security Incident Response: Company follows a formal Incident Management Policy (aligned with GDPR Articles 33 and 34) which defines severity/criticality scoring, containment, eradication, and recovery phases.
High Availability/Disaster Recovery: Critical IT infrastructure resides in the AWS Cloud with Multi-AZ deployment for database services (RDS, DocumentDB, DynamoDB) to handle failovers automatically.
RTO/RPO Objectives. The Recovery Time Objective for database services is two (2) hours, with a Recovery Point Objective of five (5) minutes.
Testing: Disaster recovery and incident response plans are tested annually via a table top drill followed by a simulated exercise.
For additional security information please refer to Data Processor’s security center on their website: https://hiverhq.com/security-center
