Trust & Compliance | The Jason Logic Group

Data Processing Agreement (DPA)

For enterprise customers requiring a Data Processing Agreement under GDPR Article 28, we provide a standard, pre-executed DPA that covers the processing of decision inputs and outputs.

To execute our standard DPA: Email thejasonlogicgroupllc@gmail.com with the subject line "DPA Request" and your company details. We will return a signed copy within 24 hours.

Note: This standard DPA covers the API engine. Payment processing is handled independently by our Merchant of Record, Gumroad, under their own DPA.

Subprocessors

To provide the Decision Security Layer API, we engage the following subprocessors. We will provide 30 days' notice before adding any new subprocessor that processes customer data.

Subprocessor	Purpose	Location
Render	Infrastructure hosting and API execution	United States
Gumroad	Payment processing, billing, and license generation	United States

Security Controls

The Decision Security Layer is built on a deterministic, stateless architecture designed to minimize data exposure.

Encryption in Transit: All API traffic is served over HTTPS/TLS 1.2+.
Authentication: API access requires a valid, license-verified API key.
Data Minimization: The engine does not store raw customer data beyond the decision record. No model training is performed on customer inputs.
Retention: Decision records are retained for 90 days by default, after which they are permanently purged.
Access Control: Infrastructure access is restricted to the founding operator via authenticated dashboard access.