Schedule of Confidentiality Agreements
Purpose. One register of the confidentiality and non-disclosure agreements
Soon has in place — with employees, contractors, customers, and suppliers — so
coverage and expiry can be checked at a glance and evidenced to auditors.
1. Scope
All agreements that impose confidentiality obligations on or towards Soon:
employee NDA clauses, contractor agreements, customer DPAs, and supplier
agreements. Reviewed at least annually as part of management review.
2. Register
| Party |
Agreement type |
Purpose |
Effective date |
Expiry / survival |
Record location |
| Suppliers — Category A sub-processors. Standard terms accepted by using the |
|
|
|
|
|
| service; copies captured 2026-09-04 and filed as evidence (SOC 2 rows 67/68). |
|
|
|
|
|
| Effective dates are the version dates of the copies held; blanks are versions that |
|
|
|
|
|
| carry no date on their face. |
|
|
|
|
|
| Party |
Agreement type |
Purpose |
Effective date |
Expiry / survival |
Record location |
| Amazon Web Services (incl. SES) |
GDPR DPA (in Service Terms) |
Hosting, database, storage, mail |
— |
Survives while the account is open |
S3 evidence store, rows 67/68 |
| Cloudflare |
Customer DPA |
DNS, CDN, front-end hosting |
3 April 2026 |
Survives termination |
S3 evidence store, rows 67/68 |
| Stripe |
DPA |
Subscription billing |
18 November 2025 |
Survives termination |
S3 evidence store, rows 67/68 |
| WorkOS |
DPA |
Enterprise SSO / SAML |
27 June 2023 |
Survives termination |
S3 evidence store, rows 67/68 |
| Intercom |
DPA |
In-app support |
9 April 2025 |
Survives termination |
S3 evidence store, rows 67/68 |
| Cloudinary |
DPA |
Image and media hosting |
June 2026 (version) |
Survives termination |
S3 evidence store, rows 67/68 |
| Sentry |
DPA |
Error monitoring |
— |
Survives termination |
S3 evidence store, rows 67/68 |
| Google (Workspace · Cloud · Maps) |
Cloud DPA — one covers all three |
Identity, mail, Drive, address lookup |
— |
Survives termination |
S3 evidence store, rows 67/68 |
| PostHog |
DPA |
Product analytics |
Not yet in force |
— |
TODO(owner): the public DPA is a preview; generate the countersigned copy at app.posthog.com/legal (S-411) |
| OpenAI |
API DPA |
AI features |
Not yet in force |
— |
TODO(owner): executed via OpenAI's form; confirm zero-retention terms at the same time (S-411, V-4) |
Customers. Soon is the processor; the DPA is part of the customer agreement.
| Party |
Agreement type |
Purpose |
Effective date |
Expiry / survival |
Record location |
| GXO (pilot) |
Signed DPA + sub-processor notice |
Pilot workforce data; restricted-processor configuration |
2026 |
Survives termination |
Google Drive → Legal → Customers |
| Other enterprise customers |
MSA + DPA |
Standard processing terms |
Per contract |
Survives termination |
Google Drive → Legal → Customers |
Founders and contractors. Founders sign the
Founder Confidentiality & Security Undertaking,
countersigned for Soon by another director. External parties sign the
NDA together with their engagement agreement.
| Party |
Agreement type |
Purpose |
Effective date |
Expiry / survival |
Record location |
| Olaf Jacobson |
Founder Undertaking (ISMS-DOC-A06-6-3 v0.2), countersigned by Thomas Picauly |
Founder, director; ISM |
13 October 2026 |
2 years after involvement ends |
S3 evidence store, rows 1–3 · Drive → Legal → People |
| Thomas Picauly |
Founder Undertaking, countersigned by Olaf Jacobson |
Founder, director; CTO |
13 October 2026 |
2 years after involvement ends |
S3 evidence store, rows 1–3 · Drive → Legal → People |
| Alessandro Cardinali |
Founder Undertaking, countersigned by Olaf Jacobson |
Founder, director; CPO |
13 October 2026 |
2 years after involvement ends |
S3 evidence store, rows 1–3 · Drive → Legal → People |
| Melvin Jacobson |
Founder Undertaking, countersigned by Olaf Jacobson |
Co-founder, shareholder; emergency backup access |
14 October 2026 (countersigned 13 October 2026) |
2 years after involvement ends |
S3 evidence store, rows 1–3 · Drive → Legal → People |
| Andrea Cardinali (CyberSquad, KvK 86522027) |
Consultancy Agreement (ISMS-DOC-A05-20-1 v0.3) + NDA, countersigned by Olaf Jacobson |
External security consultant, internal auditor |
14 October 2026 (Andrea), countersigned 16 October 2026 |
NDA: 2 years from signing; agreement: confidentiality survives 2 years after the engagement |
S3 evidence store, rows 1, 2, 4 · Drive → Legal |
3. Roles & responsibilities
- Owner — keeps this register current; checks new hires, contractors,
customers, and suppliers are added when agreements are signed.
Change log
| Version |
Date |
Author |
Comments |
| 0.1 |
2025-06-07 |
|
First draft (CertiKit spreadsheet skeleton) |
| 0.2 |
2026-07-18 |
Andrea Cardinali |
Rewritten lean and Soon-specific (ISMS overhaul). CertiKit licence text removed. |
| 0.3 |
2026-10-13 |
Olaf Jacobson |
Founders and contractors section: the three founder undertakings signed and countersigned on 13 October 2026; Melvin Jacobson and CyberSquad issued for signature. |
| 0.4 |
2026-10-16 |
Olaf Jacobson |
CyberSquad consultancy agreement and NDA signed (Andrea Cardinali 14 Oct, countersigned 16 Oct). Melvin Jacobson still pending. |
| 0.5 |
2026-10-21 |
Olaf Jacobson |
Melvin Jacobson's founder undertaking and policy acknowledgement received, signed 14 October 2026. Everyone with access is now covered. |