DPA readiness
Enterprise customers may require a Data Processing Addendum. The final DPA must be drafted or reviewed by counsel before use.
The DPA should identify roles, data categories, subprocessors, retention, deletion, breach notification, audit rights and transfer terms.
Subprocessors
The enterprise packet should identify Supabase, Vercel, Resend, Stripe and Tavily when those vendors process customer data for the enabled workspace.
Subprocessor changes should have a documented notice process and objection/escalation path before enterprise sales.
Security packet
The security packet should include architecture, authentication, RLS/tenant isolation, storage encryption posture, backup/restore, incident process, access controls and vendor list.
Evidence should reference actual tests and provider settings, not aspirational claims.
Enterprise launch gate
Enterprise sales should remain quote/order-form led until the DPA, SLA, support path, data export process and security questionnaire packet are approved.