What the DPA covers
- Roles. Your organization is the data controller. Sembr is the data processor, and processes member records, dues, event data and communications only as your organization instructs, solely to run your workspace.
- Confidentiality. Anyone at Sembr with access to your data is bound by confidentiality obligations.
- Security. Every connection is over TLS. Storage is encrypted at rest by DigitalOcean with full-volume LUKS encryption. Tenant isolation is enforced in the database by row-level security rather than in application code, so one organization cannot read another's rows even if the application is wrong. Sensitive operations are written to a hash-chained audit log.
- Where it lives. Canada. Database, member files and backups are all in Toronto.
- Subprocessors. The authorized list is at /subprocessors, with 30 days' notice before any addition or change.
- Data subject rights. Sembr gives your organization the tooling to answer access, deletion and correction requests. See /dsar.
- Breach notification. We notify your organization within 72 hours of a confirmed breach affecting your data.
- Term. Runs alongside your subscription, and survives it for any data still retained.
Requesting a signed copy
Use the contact link in the footer and we will send you the current text to review and sign. There is no self-serve signature flow yet; a person sends it, which for an organization our size is the honest arrangement rather than a worse automated one.
About this page
Sembr is a small Canadian company and this agreement was written by us, not by counsel. It is shaped by the standard processor obligations under PIPEDA and GDPR Article 28. We would rather publish something accurate and plain now than a longer document that says less. It will be reviewed by a lawyer, and the version history will show what changed when it is.