Vendor security review for Brightline Design:

• SOC 2 Type II current to March 2027.
• Data stays in the US; no sub-processors touch customer data.
• Verdict: low risk, approve with standard DPA.

No. Brightline uses a hosted email provider for notifications, but only for message delivery and with no customer data fields. I counted that as outside the data path.

Two things to check before signing:

• Breach notification window: their DPA says 72 hours; our standard is 48.
• Data deletion: 30 days after termination, which matches ours.

Subject: Brightline Design - DPA change request

Hi, we are ready to proceed. Please amend section 6 so security incidents are reported within 48 hours instead of 72. All other terms are acceptable.