DRAFT – not in effect until the owner sets version 1.0 and an effective date.

Trust Center

1. Posture Statement

DataChimp Labs is committed to data protection, tenant isolation, and transparent security. We build for regulated environments, we document our controls, and we make our compliance materials available to customers and prospects on request. This Trust Center is the single source of truth for the documents that describe how we protect customer data and how we contract with customers who process regulated data through our platform.

2. Documents

The public compliance documents below govern DataChimp Labs’ service delivery. Internal-only policies are cross-referenced where relevant.

terms-of-service.md – terms governing use of the Services.
privacy-policy.md – how DataChimp Labs collects, uses, and protects personal information.
business-associate-agreement-template.md – HIPAA BAA template for customers processing Protected Health Information.
data-processing-addendum.md – GDPR Article 28 DPA for customers processing Personal Data of EU, UK, or Swiss data subjects.
security-disclosure.md – public summary of DataChimp Labs’ security posture.
information-security-policy.md – internal reference; authoritative source of record for the security program.

3. Compliance Frameworks

DataChimp Labs’ compliance posture is:

SOC 2-aligned – security, availability, and confidentiality controls designed against the AICPA Trust Services Criteria.
HIPAA-aligned – administrative, physical, and technical safeguards for engagements involving Protected Health Information, supported by a Business Associate Agreement.
GDPR-informed – via the Data Processing Addendum for processing of Personal Data of EU, UK, or Swiss data subjects.
CCPA-informed – via the Privacy Policy and the DPA for processing of personal information of California residents.

DataChimp Labs uses the phrase “aligned” – not “certified” or “audited” – until a third-party report is published under NDA. When such a report becomes available, this section will be updated to name it explicitly.

4. Contact

Security disclosures and vulnerability reports:
Privacy inquiries and data subject requests:
Legal notices and contract requests:

5. Change log

2026-09-28 – v0.1 DRAFT initial set drafted by agent-os for owner review.