legal
Last updated 2026-07-10. This is a template for a real product and not legal advice — have counsel review before commercial use.
For customer content, the customer is the data controller and headstreamer is the data processor, processing only on documented instructions.
Processing covers hosting, display, AI generation, and the intelligence layer, for the term of the agreement.
Listed on the trust page; we give notice of changes and flow down equivalent obligations.
TLS in transit; AES-256 secrets at rest; access controls (SSO, 2FA, RBAC); audit logging; EU residency; tested backups; incident response.
Where data leaves the EU (e.g. AI inference), Standard Contractual Clauses and supplementary measures apply.
We assist the controller with data-subject requests and notify without undue delay on a personal-data breach.
On termination, customer data is exported on request and deleted per the retention policy.
For financial-entity customers, we support the register of information, testing cooperation, and audit rights required under DORA.
Questions: [email protected]