1. Roles#
For personal data in Customer’s workspace, Customer is the controller and Tabla the processor. Annex A sets out the processing.
2. Instructions#
Tabla processes Customer Personal Data only to provide the service as Customer configures and uses it. Tabla won’t sell it, use it for advertising, or use it to train AI models. Tabla will tell Customer if an instruction appears unlawful. If a government asks for Customer’s data, Tabla will refer it to Customer where the law allows, and tell Customer unless the law forbids it.
3. Personnel#
- Who. Access is limited to personnel who need it to provide the service.
- Content. Personnel don't access the content of Customer's email or calendar except: (a) at Customer's request, such as for support; (b) to investigate a security incident or abuse; or (c) as required by law.
- Mail connection. Tabla's mail-connection provider, Nylas, holds its own access to connected accounts, and one named person at Tabla can reach it through Nylas's console.
- Controls. Access uses least-privilege permissions and multi-factor authentication.
4. Security#
Tabla maintains the measures in Annex B and won’t materially weaken them.
5. Subprocessors#
- List. Customer authorizes those listed at worktabla.com/subprocessors.
- Notice and objection. Tabla gives 30 days' email notice before adding one. Customer may object on reasonable data-protection grounds; if no reasonable alternative exists, Customer may end the affected service with a pro-rated refund.
- Flow-down. Each subprocessor is bound by terms at least as protective, and Tabla remains responsible for it.
6. Assistance#
The service lets Customer’s admins export, disconnect and delete. Tabla will help with requests the service doesn’t cover, with impact assessments, and with regulators.
7. Breaches#
Tabla notifies Customer of a personal data breach without undue delay, and within 72 hours of becoming aware. It provides what Customer needs to meet its own obligations.
8. Deletion#
Customer can export before deletion. After the workspace is deleted, Tabla deletes Customer Personal Data from live systems within 30 days and from backups within 7 days after that, unless law requires otherwise.
9. Audits#
Tabla answers reasonable security questionnaires, and shares summaries of its independent assessments once completed. If those aren’t sufficient, Customer may audit once a year, on 30 days’ notice, at its cost and under confidentiality.
10. Transfers#
Where required, the EU Standard Contractual Clauses (Module 2) and the UK Addendum apply, with Customer as exporter.
11. Liability#
Subject to the limits in the Terms of Service, except where the law forbids.
Annex A: the processing#
- Data subjects: Customer's users, and people in their mail, calendars and contacts.
- Data: names and email addresses; message content and headers; attachments; calendar events; contacts; what Tabla produces from these; what users add; and counts of how the app is used (ids, counts and timings). Special categories only where they happen to appear in mail.
- Purpose: providing Tabla's features as Customer's users use them, continuously while a source is connected.
- Duration: as in the Privacy Policy's "How long we keep it".
Annex B: security measures#
Everything in the Privacy Policy's "How we protect it", and also:
- Accounts: individual accounts with multi-factor authentication; no long-lived access keys.
- Separation: production, the content-encryption keys and logs in separate AWS accounts. The database is not reachable from the internet.
- Audit trail: an organization-wide record of account and key activity that can't be altered, with alerts on sensitive changes.
- Backups: encrypted, and rolled off within 7 days.
- Changes: reviewed and tested before release. Changes to code that can open content need an additional approval. Secrets are scanned on every branch push.
- Testing: access rules and disconnect deletion are covered by automated tests that run against a real database.