Data processing agreement
Effective October 2, 2026
This data processing agreement ("DPA") forms part of the CAIObarn terms and conditions between Vibe Cohort LLC ("CAIObarn", "processor") and the customer that purchases or uses CAIObarn for a workspace ("customer", "controller"). By using CAIObarn for a workspace, the customer agrees to this DPA. Questions: crewchief@vibecohort.com.
1. Roles and scope of processing
The customer determines the purposes and means of processing personal data it enters into CAIObarn (for example client names, stakeholder details, and engagement material). CAIObarn processes that data only to provide the service: storing and displaying engagement content, operating requested AI features, securing workspaces, managing subscriptions, and supporting users. Account and usage data that CAIObarn holds about the customer's individual users (names, emails, roles, login events) is processed as described in the privacy policy.
2. Customer obligations
The customer is responsible for the lawfulness of the personal data it submits, for obtaining any consents required from data subjects (including clients, meeting participants, and recording participants), for configuring workspace roles and access appropriately, and for not submitting categories of data the customer is not authorized to process.
3. Confidentiality and personnel
CAIObarn limits access to customer data to personnel who need it to operate and support the service, under confidentiality obligations, and reviews that access periodically.
4. Security measures
CAIObarn maintains: (a) workspace-level isolation enforced by database row-level security; (b) encryption in transit (TLS) and at rest; (c) required email confirmation, optional multi-factor authentication, SAML single sign-on, and role-based access control; (d) encryption of stored third-party integration credentials with server-side-only access after a membership check; (e) audit histories of roadmap changes, AI system changes, control attestations, and decision approvals; (f) least-privilege server operations and logging of service events. Details are summarized on our trust page.
5. Subprocessors
CAIObarn uses subprocessors for managed cloud hosting, database, authentication, AI model processing (only when AI features are used), billing (Paddle), and transactional email delivery. A current list is maintained on the trust page and available on request. CAIObarn imposes data protection obligations on subprocessors no less protective than this DPA and remains responsible for their performance.
6. Data subject requests
CAIObarn provides workspace owners with the means to access, export, correct, and delete workspace content. Where CAIObarn receives a request directly from a data subject whose data the customer submitted, CAIObarn will, to the extent legally permitted, refer the request to the workspace owner and assist the customer in responding.
7. International transfers
Subprocessors may process data in countries other than the customer's own, including the United States. CAIObarn relies on the safeguards required by applicable law for such transfers Customer data is currently hosted in the United States (North America).
8. Retention, return, and deletion
CAIObarn processes workspace data while the workspace is active and as needed to provide the service. AI analyst sessions are purged after 90 days. On workspace deletion or termination, CAIObarn deletes workspace engagement data in accordance with the privacy policy; limited data may persist in encrypted backups for a bounded disaster-recovery window and where retention is required by law. The customer may export workspace content at any time before deletion.
9. Security incidents
CAIObarn will notify the affected workspace owner without undue delay after becoming aware of a personal data breach affecting customer data and will provide information reasonably necessary for the customer to meet its own notification obligations.
10. Audit and cooperation
CAIObarn makes the in-app Audit pack (AI register, controls, attestations, and change history, exportable as CSV or PDF) available to support the customer's compliance program, and will respond to reasonable additional audit requests, such as completed security questionnaires, on request.