Data Handling Addendum
HousingAI Recertification Determination Service
DRAFT for counsel review. Not legal advice. Bracketed items must be completed.
This Addendum is part of the Services Agreement between HousingAI LLC ("HousingAI") and [Housing Authority legal name] (the "Agency"), effective [date]. It governs how HousingAI handles information the Agency provides to the Recertification Determination Service (the "Service").
1. What the Service does and does not do
1.1 The Service reads income evidence submitted by assisted families at reexamination (pay stubs, benefit letters, statements) and produces a structured, sourced income determination for an Agency specialist to accept or correct.
1.2 The Service does not calculate rent, total tenant payment, family share, or housing assistance payments; does not generate, validate, or submit form HUD-50058; and does not maintain a tenant ledger. The Agency's property management system remains the system of record for all certification data.
1.3 EIV. The Service never ingests, stores, displays, or processes Enterprise Income Verification (EIV) data in any form. The Agency agrees not to upload EIV reports or printouts. Files whose names indicate EIV content are rejected automatically; the Agency remains responsible for not submitting EIV content under other names.
2. Categories of information
2.1 Agency-scoped identifiers. Household and member reference identifiers assigned by the Agency (never names or Social Security numbers as identifiers).
2.2 Evidence documents. Images or PDFs of pay stubs, benefit award letters, pension and unemployment statements, and similar documents. These may contain a family member's name, address, Social Security number (usually masked), employer, and employee or account numbers.
2.3 Determination records. Extracted figures, the method and rule applied, flags, the specialist's actions and reason codes, and the resulting annual income figures. Determination records never contain names, Social Security numbers, or account numbers.
2.4 Specialist account data. Name, work email, role, and activity log entries for Agency staff who use the Service.
3. How evidence documents are protected
3.1 Local redaction before any model processing. Every uploaded page is processed on HousingAI's own servers to remove the family member's name, address, Social Security number, and any account, employee, or check numbers before any part of it is sent to a machine-learning model. The redaction step fails closed: a page that cannot be redacted with confidence is not sent, and the specialist enters the figures manually from the original.
3.2 Model processing. Redacted page images are sent to Anthropic, PBC ("Anthropic") for text and table reading. What is sent contains no name, address, Social Security number, or account number, and no Agency or household identifier. Anthropic's commercial terms prohibit use of this data to train models. HousingAI has requested [or: maintains] zero-data-retention on its Anthropic account so that inputs are not retained after processing. [Confirm status before signing.]
3.3 Encryption. Evidence documents are encrypted at rest with a key unique to the Agency, and in transit with TLS. Database backups inherit the encryption.
3.4 Retention and deletion. Evidence documents are permanently deleted [90] days after upload, or sooner if the Agency configures a shorter period. Determination records (which contain no direct identifiers) are retained for [7] years or as the Agency directs, to support audits and tenant disputes. On termination, HousingAI deletes evidence documents within 30 days and returns or deletes determination records at the Agency's written direction.
3.5 Access. Access to the Agency's data is limited to Agency staff accounts the Agency authorizes and to HousingAI personnel who need access to operate or support the Service. Every view of a document and every action on a determination is logged with the acting user and time; the Agency may request its audit log at any time.
3.6 No secondary use. HousingAI does not sell Agency data, does not use evidence documents to train models, and does not combine the Agency's data with other agencies' data except as anonymous aggregate statistics that identify no household or agency. Specialist overrides and label corrections may be used to improve the Service's dictionaries in a form that contains no household information.
4. Subprocessors
| Subprocessor | Purpose | Data received | Location |
|---|---|---|---|
| Render Services, Inc. | Hosting and database | Encrypted documents, determination records, account data | United States |
| Anthropic, PBC | Reading redacted page images | Redacted page images only | United States |
HousingAI will give the Agency at least 30 days' written notice before adding a subprocessor that would receive Agency data, and the Agency may object in writing.
5. Security program
HousingAI maintains a written information security program consistent with 201 CMR 17.00 (Massachusetts Standards for the Protection of Personal Information), including designated responsibility, access controls, encryption in transit and at rest, employee training, vendor oversight, and incident response. A summary is available to the Agency on request. [If SOC 2 report available, reference here.]
6. Security incidents
6.1 HousingAI will notify the Agency without unreasonable delay, and in any event within 72 hours, after confirming a security incident that affects Agency data, and will provide the information the Agency needs to meet its own obligations, including under M.G.L. c. 93H.
6.2 HousingAI will cooperate with the Agency's investigation and take reasonable steps to contain and remediate the incident.
7. Agency responsibilities
7.1 Authorize and de-authorize its staff accounts promptly, and keep credentials confidential.
7.2 Submit only documents the Agency is permitted to collect under its Administrative Plan or ACOP and applicable HUD rules, and never EIV content.
7.3 Review each determination before relying on it. The Service presents figures with their sources and states its confidence; acceptance is a specialist decision.
7.4 Maintain the property management system as the system of record and enter accepted figures there according to Agency procedure.
8. Audits and regulators
The Agency may audit HousingAI's compliance with this Addendum once per year on 30 days' notice, and HousingAI will cooperate reasonably with HUD or state monitoring reviews that concern the Agency's use of the Service.
9. Order of precedence
If this Addendum conflicts with the Services Agreement on the handling of Agency data, this Addendum controls.
Signatures: [HousingAI] ______ Date ____ [Agency] ______ Date ____