Data processing addendum

The binding terms under which Core Skill processes personal data on behalf of a customer organization: scope, instructions, security, sub-processors, international transfers, breach notification, assistance, audits, and return or deletion at the end.

Effective 22/9/2026

This Data processing addendum (the DPA) applies whenever Core Skill, registered at coreskill.app, processes personal data on behalf of a customer organization (the Customer) through CoreSkill. It forms part of the Terms of service. It is intended to meet the requirements of Article 28(3) of the EU and UK GDPR and of other data protection laws that apply to the processing (together, Data Protection Law). Terms such as controller, processor, personal data, data subject and personal data breach have the meaning given in Data Protection Law.

1. Roles

Controller: The Customer, which decides who is a member, which department they belong to, which skills exist and who may read them. Where the Customer acts as a processor for another party, Core Skill is its sub-processor and the Customer is responsible for passing on that party's instructions.
Processor: Core Skill, which stores and delivers the Customer's data and acts only on the Customer's documented instructions.
Data subjects: Members of the Customer's business, key holders, and any identifiable person described inside a skill or attached file.

2. Subject matter, duration, nature and purpose

Subject matter: Providing the CoreSkill service to the Customer, including delivering the Customer's skills to the AI assistants of the people it authorizes.
Duration: The term of the Terms of service, plus the period needed to return or delete the data under section 13.
Nature: Collection, storage, organization, retrieval, transmission to authorized keys, access logging, backup and deletion. No profiling, no sale, and no training of AI models.
Purpose: Operating, securing and supporting the Service, and producing the access logs the Customer uses to supervise its own people.

3. Categories of data subjects and personal data

Data subjects	Personal data
Members of the business	Name, email address, role, department, position, level, job title, membership status, language.
Key holders	Key name and prefix, key hash, issuer, issue, expiry and revocation dates, and the member the key belongs to.
Anyone making an MCP call	IP address, client name and user agent, timestamps, tool called, status, duration, a short summary of the request, and the member and department at the time.
People described in content	Whatever the Customer puts into a skill or attached file. Core Skill does not inspect this content. Special categories of data should not be included unless Data Protection Law permits it.

4. Instructions

Core Skill processes personal data only on the Customer's documented instructions, including with regard to international transfers. The Terms of service, this DPA and the settings the Customer configures in the product are those instructions.
If Core Skill is required by law to process data otherwise, it will inform the Customer before doing so, unless the law prohibits it on important grounds of public interest.
Core Skill will promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that processing until the instruction is confirmed or changed.
Core Skill will not sell the Customer's personal data, use it for its own purposes, combine it with data from other sources except as needed to provide the Service, or use it for advertising or to train AI models.

Analytics and advertising are outside this DPA

If the operator of CoreSkill enables analytics and advertising tools in the signed-in app, the browsers of the Customer's Users may send page views and similar events to Google, Meta or TikTok, as described in the Privacy policy and the Cookie policy. That concerns account and usage data, which Core Skill processes as a controller for measuring its own marketing, not on the Customer's behalf; it runs only as each User's cookie choices allow. It does not cover Customer Data: page addresses are reduced to a generic pattern without business, server or skill identifiers, the tools are never loaded on administrative pages or on the API and MCP endpoints, and skill content, attached files, keys, member lists and MCP logs are never sent to them.

5. Confidentiality

Core Skill ensures that every person authorized to process the Customer's personal data is bound by a duty of confidentiality, contractual or statutory, and accesses the data only as needed for their role. Access by Core Skill staff is limited, logged in an audit trail, and reviewed.

6. Security

Core Skill implements the technical and organizational measures in Annex A, appropriate to the risk as required by Article 32 GDPR. Core Skill may update these measures, provided the overall level of protection is not reduced.

7. Sub-processors

The Customer gives general written authorization for Core Skill to engage sub-processors in the categories below. Core Skill imposes on each sub-processor, by written contract, data protection obligations no less protective than this DPA, and remains fully liable to the Customer for their performance.

Category	Purpose	When used
Cloud hosting infrastructure	Hosting the application, database and backups.	Always
Network and security services	Domain name service, content delivery, TLS and attack protection.	Always
Email delivery	Sending service email such as codes, invitations, keys and notices.	Always
Sign-in and payment providers	Third-party sign-in and payment processing.	Only when a user chooses to use them

The current list of sub-processors, with their locations, is kept up to date and provided on request at [email protected]. Core Skill will notify the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; the parties will then discuss it in good faith, and if no solution is found, the Customer may terminate the affected Service and receive a refund of any prepaid fees for the unused period.

8. International transfers

Personal data may be processed in countries other than the Customer's. Where Data Protection Law restricts a transfer, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference, with Core Skill as data importer; that the UK International Data Transfer Addendum applies to transfers from the United Kingdom; and that equivalent mechanisms apply to transfers from Switzerland or other countries. For the Clauses, Annex I is completed by sections 1 to 3 of this DPA, Annex II by Annex A, the optional docking clause and Clause 11 option do not apply, and the governing law and forum are those of an EU Member State chosen by the Customer, or Ireland if none is chosen. Core Skill will also carry out any transfer impact assessment or filing that Data Protection Law requires of it, and will assist the Customer with its own.

9. Personal data breach

Core Skill will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Customer's data.
The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available will be provided in stages without further undue delay.
Core Skill will take reasonable steps to contain and remedy the breach, and will assist the Customer with any notification it must make to supervisory authorities or data subjects.
Core Skill keeps a record of breaches, their effects and the remedial action taken. Notification of a breach is not an admission of fault or liability.

10. Assistance

Data subject requests. Taking into account the nature of the processing, Core Skill assists the Customer by appropriate technical and organizational measures in responding to requests to exercise data subject rights. If Core Skill receives such a request directly, it will not answer on the merits and will forward it to the Customer without undue delay.
Impact assessments. Core Skill provides reasonable information and assistance for the Customer's data protection impact assessments and any prior consultation with a supervisory authority.
Authority requests. Core Skill will notify the Customer of any legally binding request from a public authority for its data before disclosing anything, unless the law prohibits it, and will challenge requests that are unlawful or overbroad.

11. Audits

Core Skill makes available all information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, starting with this document, its security documentation and the product's own logs.
The Customer, or an independent auditor it appoints, may audit once in any 12 months, on 30 days written notice, during business hours and at the Customer's cost, and additionally where a supervisory authority requires it or after a breach.
Audits must not disrupt the Service, must not give access to other customers' data, and the auditor must be bound by confidentiality.

12. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, Core Skill acts as the Customer's service provider or processor and will not sell or share the personal information, will not retain, use or disclose it for any purpose other than providing the Service, will not combine it with personal information from other sources except as permitted by that law, and will comply with and notify the Customer if it can no longer meet its obligations under that law.

13. Return and deletion

The Customer can export its data at any time while the Service is running, including the MCP logs as CSV.
When the Service ends, Core Skill will, at the Customer's choice, return or delete the Customer's personal data within 30 days, and delete existing copies unless the law requires them to be kept.
Deleting a business deletes its servers, skills, files, keys, members and logs immediately. It cannot be undone.
Copies in routine backups expire on a rolling cycle of up to 14 days. Until then they remain protected by this DPA, are not accessed, and are restored only to recover the Service as a whole.

14. The Customer's obligations

To have a lawful basis and any required consent for all personal data it puts into the Service, including inside skills and files.
To give its people the information the law requires, including that every MCP call is logged under their name.
To keep its member list current and to remove or suspend people who leave, so their keys stop working.
To give instructions that comply with Data Protection Law.
To handle requests from its own data subjects, and to tell Core Skill promptly when it needs assistance.

15. Liability and precedence

Each party's liability under this DPA is subject to the limitation of liability in the Terms of service, except where Data Protection Law does not permit it, and nothing in this DPA limits the rights of data subjects under the Standard Contractual Clauses. In case of conflict: the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of service on questions of personal data. A data processing agreement signed separately by both parties prevails over this one.

Annex A: technical and organizational measures

Measure	How it is implemented
Encryption in transit	HTTPS (TLS) for all traffic to the application and the MCP endpoints, with HSTS enabled.
Password storage	bcrypt hashing. Plain-text passwords are never stored or logged.
Key storage	SHA-256 with a secret pepper, compared in constant time. The real key is shown once, when it is created.
Encryption of secrets	AES-256-GCM for two-factor secrets and stored third-party credentials, with keys held separately from the session signing key.
Encryption of content at rest	Skill content can be encrypted at rest with AES-256-GCM. This protects against a leaked backup, a stolen disk or a database read.
Network isolation	The database is not exposed to the public internet and is reachable only by the application over a private network. Containers run as a non-root user.
Access control	Role and department based, evaluated on every request. Resources outside a person's visibility respond as if they did not exist.
Authentication	Optional two-factor authentication with single-use recovery codes. Changing a password or a role revokes existing sessions.
Abuse resistance	Rate limits on sign-in, password reset, invitations and the MCP endpoints. Malformed keys are rejected before any database query.
Logging	Every MCP call is logged, including refused ones, and purged after the configured retention period (90 days by default). Administrative actions are recorded in an audit trail.
Backup and recovery	Regular database backups kept on a rolling cycle of up to 14 days.
Personnel	Access to production limited to authorized staff bound by confidentiality, on a need-to-know basis.

Acceptance and contact

This DPA takes effect when the Customer accepts the Terms of service and needs no separate signature. A Customer that needs a signed copy for its records can request one at [email protected]. Other questions go to [email protected], or by post to Core Skill, coreskill.app. Except as stated in section 8, this DPA is governed by the law of Core Skill. It takes effect on 22/9/2026.