Bearings · Legal

Privacy Addendum

Version 1.0Last updated 2026-08-07Effective 2026-08-14
This addendum describes how Bearings — a paid analytical workspace product operated by Nerdrums, Inc. — processes data uploaded to a customer workspace. It supplements the Portolan Privacy Policy for customers on the Bearings SKU and takes precedence for Bearings-specific handling where the two overlap.

1. Roles

For content a customer uploads to its Bearings workspace (Evidence, Hypotheses, Judgments, Intelligence Assets, Navigator queries, and audit metadata) the customer is the data controller and Nerdrums is the data processor. Nerdrums processes that content only to deliver the Bearings service to the customer and as described in this Addendum.

2. What Bearings processes

2a. Evidence + derived artifacts

  • Raw uploaded files (PDF, Word, PowerPoint, plain text at MVP) — stored in a Google Cloud Storage bucket keyed to the customer's workspace, encrypted at rest with a Nerdrums-managed CMEK (KMS-backed).
  • Extracted text — produced by unstructured.io (or Google Document AI on scanned content), stored in the workspace's Postgres tables under Row-Level Security.
  • Text chunks + embeddings — 500-token semantic chunks embedded with OpenAI text-embedding-3-large; the vectors land in a workspace-scoped Qdrant collection.
  • Extracted entities — Anthropic Sonnet 5 extracts named entities (people, organizations, systems, places, dates) from chunks; entities land in Postgres + projected into Neo4j scoped to the workspace.
  • Navigator turns — every question + retrieved context + LLM response is written to the immutable `bearings_ws_navigator_turn` audit ledger.

2b. Fields marked excluded from AI

Evidence that a customer flags with `excluded_from_ai=TRUE` goes through Stage 1 (malware scan) only. It is NOT extracted, chunked, embedded, or exposed to the Navigator LLM. Zero Qdrant points are ever written for that Evidence. This exclusion is enforced at the service layer, not the UI.

3. LLM data flow

Bearings uses two LLM providers at MVP, both as sub-processors:

  • Anthropic (Claude Sonnet 5) — Navigator Q&A + entity extraction. Nerdrums is enrolled in Anthropic's Zero-Data-Retention (ZDR) program: prompts and completions are not retained by Anthropic beyond the inference transaction (no training use, no logging).
  • OpenAI (text-embedding-3-large) — evidence chunk embedding. Nerdrums operates under OpenAI's enterprise no-training-on-API-data commitment. Embedding inputs are not retained by OpenAI beyond the inference transaction.

A per-workspace org-isolation salt is mixed into every LLM system prompt so a prompt-injection attempt in one workspace's content cannot smuggle another workspace's context. This is a technical control, not a legal one, but is documented here so customers can reference it in their own DPIAs.

4. Isolation

Every Bearings tenant is isolated at three layers:

  • Application-level. A permission matrix gates every action against role × resource × context (documented in Doc 3 §1.2). Zero-trust between workspaces: no route path can read Workspace B data from a Workspace A session.
  • Database-level. Postgres Row-Level Security keyed to `app.current_bearings_workspace_id`. Neo4j queries scoped via BearingsCypher helper that injects the workspace filter automatically.
  • Vector-store level. Qdrant collection per workspace; retrieval filter always includes `workspace_id = ?`.

5. Retention

  • Evidence + derived artifacts — retained for the life of the workspace. On workspace deletion, purged from Postgres, Neo4j, Qdrant, and GCS within 30 days.
  • Audit events — retained for the workspace's configured `audit_retention_years` (default 7 years). Archived to a WORM (Object Retention Lock) GCS bucket keyed to the workspace. Audit rows are immutable in Postgres via database trigger and, once archived, cannot be deleted before their retention date.
  • Navigator turn ledger — retained for the same window as audit events. Contains prompt + retrieved context + response for every turn.
  • Billing + subscription metadata — retained for 10 years to satisfy tax and accounting obligations, as described in the Portolan Privacy Policy.

6. Sub-processors

Current sub-processors:

  • Google Cloud Platform — hosting (GKE, Cloud SQL, Memorystore, GCS, KMS, Cloud Load Balancing, Cloud Armor). Region: us-central1.
  • Anthropic PBC — Navigator LLM + entity-extraction LLM (Claude Sonnet 5), ZDR enrolled.
  • OpenAI — evidence embedding (text-embedding-3-large), enterprise no-training commitment.
  • Neo4j Aura — hosted graph database (Business Critical tier), region: us-central1.
  • Qdrant — hosted vector database.
  • Stripe — billing + subscription lifecycle.
  • Keycloak (self-hosted on GKE) — identity + SSO. Not a third-party processor; listed for completeness.

Nerdrums will provide 30 days' notice before adding a new sub-processor with access to workspace content. Notice is delivered to the workspace Owner via email and via the in-workspace notification matrix.

7. Location of processing

All customer workspace content is processed and stored in the United States (GCP region us-central1) at MVP. International-region availability and a FedRAMP-authorized boundary are on the post-launch roadmap and are NOT part of this Addendum until separately announced.

8. Security

  • Every uploaded file is scanned with ClamAV before any extraction, chunking, or embedding step runs. Malware is quarantined and surfaced in the admin moderation queue.
  • All data at rest is encrypted with Nerdrums-managed CMEK. All data in transit is TLS 1.2+.
  • Nine boot-time gates fail the API pod closed if any Bearings-critical secret or dependency is missing in production.
  • Session and API-key management follows the platform security posture documented in the Portolan Security page.
Bearings is not FedRAMP-authorized at launch and does not accept Controlled Unclassified Information (CUI), Controlled Defense Information (CDI), ITAR-controlled technical data, or classified information. See the Acceptable Use Policy for the full posture and see the Portolan roadmap for FedRAMP status.

9. Data-subject requests + customer requests

For content a customer controls, the customer is the first line of response to any data-subject request. Nerdrums will cooperate with a controller-directed request to export, rectify, or delete content on request, at no additional charge, within a reasonable time (typically 30 days for deletion; sooner where technically feasible).

Requests directed at Nerdrums as a data controller (billing contacts, portal user accounts) go to privacy@nerdrums.com.

10. Breach notification

Nerdrums will notify the workspace Owner without undue delay (target: within 72 hours of confirmation) upon becoming aware of a confirmed personal-data breach affecting customer workspace content, and will provide the information reasonably required for the customer to meet its own notification obligations.

11. Changes

Material changes are announced via email to the workspace Owner and via the in-workspace notification matrix. Version + Effective date on this page always reflect the current binding text.