DOC — PM-LEG-02
LEGAL · SHEET 1/1
A plain-English summary of our standard DPA. The executed version — signed before any document changes hands — is the binding instrument.
LAST REVISED — JULY 2026 · 07 CLAUSES
You are the controller — the documents, the customers, and the rates are yours. PortMark is the processor: we handle that data only on your written instructions, only for the workflows you’ve engaged, and for nothing else.
Shipping documents — commercial invoices, packing lists, bills of lading and AWBs, arrival notices, ISF data — and the TMS records they become. Processing means extraction, draft entry, status lookups, and deadline tracking. Your data is never used for any other purpose.
Document processing runs on enterprise AI APIs under commercial no-training terms — your documents never train public AI models. The current subprocessor list ships with the executed DPA, and we give written notice before it changes.
Encryption in transit (TLS 1.2+) and at rest. Least-privilege access on named accounts, read-only where possible, revocable in one click, with an access log kept. Operator access is per-client, under confidentiality terms.
If an incident touches your data, you hear it from us first — within 24 hours, in writing, with what happened, what’s affected, and what we’re doing about it.
Retention runs on your schedule. On termination, your data is returned or deleted on your instruction and purged post-engagement — we don’t keep a shadow archive.
The executed DPA is signed before any access is granted — Day 0 of the 14-Day Pilot, alongside the NDA. This page is the summary; the signed document is the one that binds.
END OF SUMMARY — 07 / 07
OURS OR YOURS — REVIEW WITH COUNSEL
REPLIES WITHIN ONE US BUSINESS DAY