# DPA outline (first house)

Not a signed DPA. Counsel papers the real one.

- **Roles:** Client = controller. Say Hi Apply = processor for hosted media and inbox.
- **Region:** United States in v1. No EU multi-region yet.
- **Instructions:** process intros the client collects via the button or the link. No independent marketing to candidates.
- **Subprocessors:** see `subprocessors.md`. Stream, Neon, Stripe (when live), email.
- **Security:** TLS, `account_id` isolation, signed playback URLs, origin-bound keys, scrubbed errors.
- **Retention:** 30-day host, then delete. Audit ~12 months.
- **Assistance:** client delete and export in inbox. Candidate rights via the client.
- **IP:** Say Hi Apply, Inc. owns the pipe. Assignment papers are a counsel item.

No SOC 2 Type II report exists. Do not print a logo.