Data Processing Addendum

• Acceptance. This DPA applies automatically, without signature, when you accept the Terms, and it applies for as long as we process Customer Personal Data. Accepting the Terms is also your signature of the Standard Contractual Clauses and the UK Addendum incorporated in section 11. A countersigned copy is not needed for it to be binding.
• Countersigned copy. An Enterprise customer may ask privacy@intramedial.com for a copy of this DPA countersigned by us, with its legal name and address in Annex 1. The countersigned copy has the same text as this page on the date it is signed.
• What it covers. It applies to Customer Personal Data, as defined in section 2. It does not apply to personal data for which we are the controller, such as our own website visitors, account and billing administration, the website assistant, and security and abuse records of our own. The Privacy Policy covers those.

2. Definitions#

• "Data Protection Law" means the laws that apply to the processing of Customer Personal Data under the Terms, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom and the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), and United States state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
• "Customer Personal Data" means personal data that you, your users, your agents or the people you direct to the Service submit to the Service, or that the Service generates from that use, and that we process on your behalf under the Terms.
• "Service" means Intramedial, the Agent Coordination Plane operated by Avonao, Inc., as described in the Terms: the REST API, the MCP server, the dashboard, the enforcement points, the audit chain and ledger, and the assistant.
• "Sub-processor" means a processor we engage to process Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Sub-processors.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force from 21 March 2022, as amended or replaced by the Information Commissioner.
• "Record" means an entry the Service keeps about your agents and their work, such as an agent identity, a lease, a mandate, an admission decision, an enforcement decision, or an entry in the audit chain or the witnessed ledger. "Ledger bundle" means a set of ledger entries signed by us for an auditor. "Witness entry" means the hash-only entry, such as a Merkle root, that the Service files outside the workspace database to make the ledger tamper-evident, described in Annex 1, section C.
• "Agent" means a software agent, including an AI agent, that you register with, or that acts through, the Service.
• "Account owner" means the person whose email address is recorded as the owner of your account or workspace in the dashboard.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, or the equivalent terms in the other Data Protection Law. Where a US state law applies, "controller" includes "business", and "processor" includes "service provider" and "contractor".

3. Roles and instructions#

• Roles. You are the controller of Customer Personal Data, or its processor where you process it for your own customer. In that case you confirm that your instructions, including your engagement of us, are authorised by that controller, and you are our single point of contact for it. We are your processor, or your sub-processor.
• Your instructions. We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country. Your documented instructions are the Terms, this DPA, your use and configuration of the Service, including the leases, mandates, packs and policies you set, and other written instructions that are consistent with them. An instruction outside these needs our prior written agreement, and may carry a fee we tell you in advance.
• Your agents. An Agent acts for you, not for us. What an Agent sends to the Service, what a lease or a mandate permits it to do, and what an enforcement point lets through are your instructions and your decisions. We record and enforce them as you configured them; we do not review whether the personal data an Agent handles is lawful to process. You remain responsible for the purposes and lawful basis of what your Agents do with personal data, and for any decision that affects people made by or with the help of your Agents, including human oversight and the information owed to the people concerned. You act as provider or deployer of your Agents under any AI regulation that applies to them. We are not the provider of your Agents.
• Unlawful instructions. We will tell you without delay if, in our opinion, an instruction infringes Data Protection Law, and we may suspend the affected processing until you confirm or change it.
• Legal requirements. If a law to which we are subject requires us to process Customer Personal Data otherwise than on your instructions, we will tell you of that requirement before processing, unless that law forbids it on important grounds of public interest.
• Your responsibilities. You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving the notices and obtaining the consents the law requires from the people the Service records or serves on your behalf, and for the accuracy and quality of the data you submit. You will not submit special categories of personal data, criminal-offence data or data about children in readable fields of the Service (see Annex 1). You are responsible for the security of your own systems, credentials and Agent keys and for configuring the Service securely.
• Avonao ID. The Service has no sign-in methods of its own: seat holders sign up and sign in only through Avonao ID, operated by Avonao, Inc. at id.avonao.com. Avonao ID collects their email address, name, sign-in methods, security log, country and age confirmation. The Service receives only the claims Avonao ID sends (identifier, confirmed email, name, language) and uses them on your behalf to give those seat holders access to your workspace. For the account data Avonao ID itself holds, Avonao, Inc. acts as controller under its own terms and not as your processor. The Service's pointer directory holds only the link between a sign-in identifier and the home region of the account.
• Details of the processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Our obligations#

We will:

1. process Customer Personal Data only as set out in section 3;
2. confidentiality: ensure that everyone we authorise to process Customer Personal Data is bound by a written duty of confidentiality or a statutory one, and give access only to those who need it to provide, secure or support the Service. Support staff see a workspace only through the time-limited access you grant in the dashboard, which is recorded in your audit log;
3. security: implement the technical and organisational measures in section 7 and Annex 2;
4. respect the conditions for engaging Sub-processors in section 5;
5. assist you as set out in sections 6, 7 and 8;
6. delete or return Customer Personal Data as set out in section 10, and make available information and allow audits as set out in section 9;
7. keep the record of processing activities that Data Protection Law requires of a processor, and cooperate with supervisory authorities on request as that law requires;
8. US state privacy laws: not sell Customer Personal Data or share it for cross-context behavioural advertising; not retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with you; not combine it with personal data we receive from or on behalf of others or collect from our own interactions with a person, except as Data Protection Law permits a service provider or contractor; give it the level of privacy protection that law requires; tell you if we determine that we can no longer meet these obligations; and allow you, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions;
9. no training on your data: not use Customer Personal Data to train models, and not use it for any secondary purpose.

5. Sub-processors#

You give us general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA, with their purpose, location, the personal data involved and the transfer safeguards, are listed on the Sub-processors page, which is Annex 3.

• Flow-down and liability. We will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, as Article 28(4) GDPR requires, and we remain fully liable to you for the performance of each Sub-processor's obligations.
• Notice. We will give you at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data, or an existing one changes its processing materially, by updating the Sub-processors page with the new date at the top and emailing the account owner and any address that asked us at privacy@intramedial.com to be told.
• Objection. You may object on reasonable data protection grounds by writing to privacy@intramedial.com within those 30 days. We will then work with you in good faith to avoid the problem, for example by not using the new Sub-processor for your data, by changing the configuration or by recommending another way to use the Service. If we cannot resolve the objection within 30 days of receiving it, you may terminate the affected subscription by notice, and we will refund prepaid fees for the period after termination. If you do not object in time, you are taken to have authorised the change.
• Urgent replacement. We may replace a Sub-processor immediately, with the same protections, where needed to protect the Service from an urgent security or continuity risk. We will tell you as soon as we can, and your objection right then applies afterwards.
• Not Sub-processors. Public timestamping or transparency services that receive only a hash, a signature or a public key from us receive no Customer Personal Data. The systems your Agents act on, the connectors you configure, the destinations of audit-log streams you set up (for example a log platform you choose) and the external systems an enforcement point protects are chosen by you and receive what you send them; they are your recipients. None of these is a Sub-processor.

6. Assistance#

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations to:

• Respond to data subjects. If a data subject writes to us about Customer Personal Data, we will tell them to ask you, and tell you without undue delay, unless the law requires otherwise. We will not answer the request ourselves except on your instruction. The Service gives you self-service tools to access, export and delete Customer Personal Data: record and audit-log exports, the exit export, and account and workspace deletion (Data controls, Retention and erasure). We will give further reasonable help on request to privacy@intramedial.com.
• Handle requests about the audit chain and ledger. The audit chain and the ledger are append-only, hash-linked records that cannot be edited without breaking the chain. A request to remove personal data from them is met by erasing or replacing the identifier in the stored entry and keeping the hash and the reason, as set out in section 10; a copy that you or a third party already holds, such as an exported ledger bundle, is outside our control. The Witness entry holds no readable personal data (Annex 1, section C).
• Carry out data protection impact assessments and prior consultation of supervisory authorities, and the assessments that artificial-intelligence rules may require of you, by giving you the information we reasonably hold about the Service. The documentation, the Security model, the Record Practice Statement and the security overview describe how it works.
• Keep the processing secure and handle Personal Data Breaches, as set out in sections 7 and 8.

Assistance that the Service and its documentation provide is free of charge. We may charge a reasonable fee for other assistance that is not needed because of our breach of this DPA, after telling you the fee in advance.

7. Security#

We implement and maintain technical and organisational measures that ensure a level of security appropriate to the risk, as Article 32 GDPR requires, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons. They include the measures in Annex 2. We may update them as the Service and the threats to it change, provided the update does not reduce the overall level of protection.

You are responsible for using the security features the Service offers, such as narrowly scoped and short-lived keys, dual control for the sensitive scopes, IP binding of tokens, and for what you place in readable fields.

8. Personal data breach#

• Notice. We will notify the account owner by email without undue delay and in any case within 72 hours of becoming aware of a Personal Data Breach.
• Content. The notice will, to the extent known, describe the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and to mitigate its possible adverse effects; and a contact point for more information. Where not all of this is known at once, we will provide it in phases, without undue further delay, as we learn it.
• Response. We will take reasonable steps to contain, investigate and remedy the breach, and give you the information we hold that you reasonably need to notify supervisory authorities and data subjects. Where you are the controller, those notices are your responsibility, and we will not notify data subjects or authorities on your behalf about Customer Personal Data unless you instruct us to or the law requires it.
• What is not a breach. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, refused sign-in attempts and denial-of-service attacks that expose no data, are not Personal Data Breaches.
• Our notice, or our response to a breach, is not an admission of fault or liability.

9. Audits#

We will make available to you the information needed to show that we comply with this DPA and Article 28 GDPR. In the first instance we do this through our documentation, the security description in Annex 2 and the security overview, our published Sub-processor list, our Sub-processors' public compliance reports that we are entitled to share, and written answers to a reasonable security questionnaire sent to privacy@intramedial.com, which we answer within 30 days.

If that information is not enough to show compliance, or a supervisory authority requires it, or a Personal Data Breach has occurred, you may carry out an audit, including an inspection, yourself or through an independent auditor bound by confidentiality, on these terms:

• no more than once in any 12 months, unless a supervisory authority or a Personal Data Breach requires otherwise;
• on at least 30 days' written notice, with the scope, timing and duration agreed in advance;
• at your cost, during business hours, without disrupting the Service and without access to other customers' data or to our other confidential information;
• limited to the systems and records we use to process Customer Personal Data. Audits of Sub-processors are carried out through the reports and audit rights we have under our contracts with them;
• an auditor that competes with us may be refused, in which case you may appoint another. You will give us a copy of the audit report, which is our confidential information.

If an audit finds that we do not comply with this DPA, we will remedy the non-compliance at our own cost without undue delay. Audits under Clause 8.9 of the SCCs are carried out as set out in this section.

10. Return and deletion#

• During the term. You can export your records and other data, and delete workspaces or the account yourself at any time, at no charge, as described in Retention and erasure and on the EU Data Act page. Exporting is how you choose the return of Customer Personal Data under Article 28(3)(g) GDPR; deletion follows as set out below.
• The end of the Service. The provision of the Service ends when you delete your account or workspace. After you schedule account deletion there is a 30-day grace period. Nothing is erased during it, the account keeps working, and you can cancel the deletion or export your data. A paid plan that ends does not end this DPA: the account keeps working on the Free plan.
• Erasure. At the end of the deletion grace period we erase Customer Personal Data held in the workspace: agent identities and keys, leases, mandates, packs, admission and enforcement records, connector data and credentials, stored third-party secrets, support tickets and the dashboard assistant's conversations. Telemetry is deleted on its own cycle, 30 days by default. Database recovery copies (Cloudflare D1 Time Travel) roll off within a further 30 days. Cold archive copies are deleted from the archive with the workspace.
• Retained records. These are retained after the end, and you instruct us accordingly:
  • Append-only audit-chain and ledger entries that other entries depend on are kept so that the rest of the chain still verifies. A person's identifier in such an entry is replaced where erasure is required, and the hash and the reason for keeping it stay.
  • Witness entries (Merkle roots and hashes filed outside the workspace database) cannot be changed or deleted before their lock date, if any. They hold no workspace content and no readable personal data.
  • Records we must keep by law, such as billing records, for as long as the law requires; and the security audit log, abuse flags and appeals, as set out in Annex 1.
  • For personal data in these records we continue to protect it under this DPA, use it only for the stated purpose, and consider requests for removal under section 6.
• Confirmation. On written request we confirm in writing that deletion is complete. The certification of deletion under Clauses 8.5 and 16(d) of the SCCs is given on your written request.

11. International transfers#

The Service is operated by a United States company. Customer workspace data is stored and processed in the data region of the workspace. Seven regions are deployed today: US East, US West, Europe Central, Europe West, Europe North, Asia-Pacific and Oceania; the wider catalogue of locations on Regions becomes available as capacity is turned on. The three European regions store data under Cloudflare's EU jurisdiction (the data stays in the EU; Cloudflare chooses the datacenter, so no European region guarantees a particular country). US East, US West, Asia-Pacific and Oceania use a location hint, which is a request to Cloudflare and not a guarantee. Account data, sign-in pointers and the dashboard are kept in the home region of the account, and each workspace has its own data region, which can differ from the home region. The Control Plane and billing are operated from the United States and are not regional. Sign-in is through Avonao ID, and payments and invoices are handled by Avonao Billing, with Stripe as merchant of record behind it, in the United States. The public website and documentation hold no Customer Personal Data. Cloudflare terminates network connections at the location nearest the caller, which can be outside the region; stored data stays in the region, but we do not guarantee that traffic never passes a network edge outside it. The assistant reads workspace records only for workspaces in the US regions; for other regions it answers from documentation only. See Data regions and Data and privacy.

Where Customer Personal Data subject to the GDPR, the UK GDPR or the FADP is transferred to us, or by us to a Sub-processor, in a country without an adequacy decision, the transfer is covered as follows.

• EU: the SCCs. The SCCs are incorporated into this DPA by reference and completed as follows:
  • Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer;
  • Clause 7 (docking clause) applies;
  • Clause 9(a): Option 2 (general written authorisation) applies, with the 30-day notice period in section 5. Copies of Sub-processor agreements under Clause 9(c) may have commercial information removed;
  • Clause 11(a): the optional language does not apply;
  • Clause 13: the competent supervisory authority is the one set out in Annex 1, section D;
  • Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland;
  • Clause 18(b): disputes are resolved before the courts of Ireland;
  • Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and the list of Sub-processors by Annex 3.
• United Kingdom: the UK Addendum. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties' details in Annex 1; Table 2 with the SCCs, modules and options selected above; Table 3 with Annexes 1 to 3; and for Table 4, neither party may end the UK Addendum when the Approved Addendum changes. The Mandatory Clauses of the UK Addendum apply, including its rules on governing law and courts and the Information Commissioner as supervisory authority.
• Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" in Clause 18(c) is read so that data subjects in Switzerland can bring claims in their place of habitual residence.
• Data Privacy Framework. We are not ourselves certified under the EU-US Data Privacy Framework, so the SCCs are the mechanism for transfers to us. Where a Sub-processor is certified under it, its UK Extension or the Swiss-US Data Privacy Framework, transfers to that Sub-processor may rely on that certification as well as on the SCCs in its own data processing terms.
• Onward transfers. Our contracts with Sub-processors in third countries include the SCCs (Module Three) or another transfer mechanism that Data Protection Law recognises.
• Changes. If a transfer mechanism is invalidated or replaced, we will without undue delay put a valid replacement in place, and the SCCs, the UK Addendum and the Swiss adaptations then continue in the form the law requires. The SCCs prevail over the rest of this DPA in a conflict on a matter they govern.

12. Requests from public authorities#

If we receive a legally binding request from a public authority, including a court, for access to Customer Personal Data, we will:

• review the request for its legal basis and scope, and challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful, too broad or in conflict with EU or Member State law;
• tell you before we disclose anything, unless the law forbids it, and in that case use reasonable efforts to obtain a waiver of the prohibition;
• disclose only the minimum the request lawfully requires; and
• keep a record of the requests we receive and our response, which we share with you on request where the law permits.

The measures in section 5 of the EU Data Act page also apply. This section is in addition to Clause 15 of the SCCs.

13. Liability and order of precedence#

• Liability. Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Terms, which apply in aggregate to the Terms and this DPA, except where Data Protection Law or the SCCs do not allow a limitation. Nothing in this DPA limits the rights of data subjects under the SCCs or Data Protection Law, or either party's liability to them.
• Order of precedence. In a conflict on the processing of Customer Personal Data: the SCCs and the UK Addendum (where they apply) prevail, then this DPA, then the Terms, then any other document. A signed Enterprise agreement prevails over this DPA only where it expressly refers to this DPA.

14. Term and changes#

• Term. This DPA takes effect when you accept the Terms, and remains in force for as long as we process Customer Personal Data, including after the Terms end. Sections 6, 9, 10, 12 and 13 survive for as long as we hold any Customer Personal Data.
• Changes. We may update this DPA where needed to comply with Data Protection Law, to follow guidance or a decision of a supervisory authority or a court, to reflect a new or updated transfer mechanism, or to reflect changes to the Service, provided the update does not reduce the overall protection of Customer Personal Data. We tell account owners about material changes by email at least 30 days before they take effect, as in the Terms. We will not change the SCCs or the UK Addendum other than by adopting a version the European Commission or the Information Commissioner issues.

15. General#

• Governing law and venue. This DPA is governed by the law and venue that govern the Terms, except where the SCCs or the UK Addendum provide otherwise.
• Contact points. For the Processor, questions and notices about this DPA go to privacy@intramedial.com, which is also our data-protection contact. For the Customer, we use the account owner's email address, which you keep up to date in the dashboard.
• Representative and data protection officer. Our representative in the European Union under Article 27 GDPR, and our data protection officer for the European Union, is NUICORN, Chausseestraße 86, 10115 Berlin, Germany. It may be contacted through privacy@intramedial.com on all matters about this DPA.
• Severability. If a provision of this DPA is invalid or unenforceable, the rest of it remains in force, and the provision is read so as to give effect, as far as the law allows, to its intent.

Annex 1: Description of the processing#

This Annex is also Annex I of the SCCs.

A. List of parties#

Data exporter

• Name and address: the Customer, as named in its account and billing details.
• Contact person: the account owner, at the email address in the dashboard.
• Activities relevant to the data transferred: use of Intramedial under the Terms.
• Role: controller (Module Two) or processor (Module Three).
• Signature and date: by accepting the Terms, on the date of acceptance.

Data importer

• Name and address: Avonao, Inc., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (legal address). Mailing address, for general correspondence only: Avonao, Inc. • 2261 Market Street PMB 10671, San Francisco, CA, 94114, United States. Legal correspondence, including notices under this Addendum, must be sent to the legal address in Delaware.
• Contact: privacy@intramedial.com. EU representative and data protection officer: NUICORN, Chausseestraße 86, 10115 Berlin, Germany.
• Activities relevant to the data transferred: provision of Intramedial.
• Role: processor.
• Signature and date: by making the Service available under the Terms, on the date the Customer accepts them.

B. Description of the processing and transfer#

Categories of personal data, by kind of data:

What each module stores is described in Data and privacy and in each module's documentation.

C. Retention#

D. Competent supervisory authority#

The supervisory authority of the EU Member State in which the Customer is established. Where the Customer is not established in the EU but falls within Article 3(2) GDPR and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which that representative is established. Where the Customer has not had to appoint one, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located. For the UK Addendum, the Information Commissioner; for Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex 2: Technical and organisational measures#

This Annex is also Annex II of the SCCs. The measures describe how the Service works today. Detail is in the Security model and the security overview. We hold no security certification or audit attestation, and nothing in this Annex says otherwise.

• Authentication and credentials. Every request carries a credential that the gateway resolves to a workspace before any module code runs. API keys and session tokens are stored only as SHA-256 hashes, and secrets are compared in constant time. Keys can be scoped, expire, be rotated or be revoked with effect on the next request. The Service holds no passwords: sign-up and sign-in happen at Avonao ID, which sends the Service OpenID Connect claims (authorisation code with PKCE). Second factors (TOTP, recovery codes, passkeys) and enterprise single sign-on and SCIM are available where your plan includes them. Dashboard sessions are HttpOnly, Secure and SameSite=Lax, with a 12-hour absolute lifetime and a 30-minute idle timeout, and only a hash of the session token is stored.
• Roles and dual control. Organisation and workspace roles limit who can manage keys, members, billing and data. Eight sensitive scopes require two different administrators to approve.
• Short-lived access for Agents. Agents hold no standing cloud keys: credentials the Service issues to an Agent are short-lived and bounded by its lease.
• Tenancy isolation. The gateway, not the caller, decides the workspace. Calls between our services are signed and carry an anti-replay nonce, and a service rejects a request without a valid signature. Each workspace has its own data store, and every read and write carries the workspace id. A regional service reads only its own region's database, and a call is never answered from another region.
• Admission and enforcement. Admission decisions are made by Intralock, a pure function that makes no network call and uses no model, so the same inputs give the same decision. Decisions and their reasons are appended to the ledger.
• Integrity of records. The audit chain is a per-workspace hash chain over RFC 8785 canonical JSON with SHA-256, so a removed or altered entry breaks the chain, and it can be re-verified offline. The witnessed ledger files Merkle roots outside the workspace database. Ledger bundles are signed with Ed25519, and the open-source verifier intramedial-verify checks them offline.
• Key custody. Ledger-bundle signing keys are held as protected secrets in the Worker environment of the service that signs, one per jurisdiction. They are not held in a hardware security module or a key management service, and no API route returns private key material. The service refuses to issue an unsigned bundle or to fall back to another key. Public keys are published for verifiers.
• Encryption. Traffic between you and the Service uses TLS, and HSTS is set on the dashboard. We rely on the platform encryption at rest of our infrastructure providers as they document it, and our cold archive buckets use AES-256 server-side encryption with versioning and with public access blocked. Third-party credentials and connector secrets you store are additionally sealed with AES-256-GCM, bound to your workspace and the secret's name, and are never returned.
• Minimisation and pseudonymisation. Request and response bodies that pass through an enforcement point are hashed and, unless you configure otherwise, not stored. The assistant receives a pseudonymous identifier, not your email address or IP address, and the IP address is used only as a day-salted hash for rate limiting.
• Outbound request controls. Connectors and enforcement points call only destinations you configure, and requests are bounded in time and size.
• Rate limiting and abuse controls. Per-IP rate limits before authentication and per-account limits after it, limits on the public forms and the assistant, bot checks on sign-up and public forms, and fraud and abuse signals that raise flags for review by a person.
• Logging and monitoring. Security-relevant events (sign-ins, key and role changes, denied access, deletions, support sessions) are written to an append-only audit log with the source IP address and user agent. Workspace administrators can read the workspace audit log in the dashboard.
• Access by our personnel. Access to production systems and secrets is limited to the personnel who deploy and operate the Service, who are bound by confidentiality. Support staff cannot open a session as a customer; they see a workspace only through time-limited access the customer grants, and each such session is recorded in the workspace's audit log.
• Resilience and recovery. The Service runs on Cloudflare's distributed platform, with a database per data region. Every database can be restored to any minute of the last 30 days with Cloudflare D1 Time Travel, and we export the databases to dated copies as an additional step. Deployments are versioned and can be rolled back without touching data. We publish a recovery time and recovery point for each data class in Exit objectives and report a class as unverified until it has been measured. Ledger bundles you hold stay verifiable whether or not the Service is available. We do not offer an uptime commitment on self-serve plans (see the Terms); Enterprise service levels are in the Enterprise SLA.
• Vulnerability handling. We accept and act on reports under our Responsible disclosure policy. We run no paid bug bounty.
• Sub-processors. We engage Sub-processors under written contracts as set out in section 5, and the measures they apply to Customer Personal Data are described in their own data processing terms.

Annex 3: Sub-processors#

The Sub-processors are those listed on the Sub-processors page, which sets out each one's purpose, location, the personal data involved and the transfer safeguards. The list in force on the date of this DPA, and each change notified under section 5, forms this Annex. On the date of this DPA, the Sub-processors that process Customer Personal Data in the Service include Cloudflare, Inc. (hosting, Workers, databases, Durable Objects, storage, queues, email delivery, bot checks, and help-text search for the assistant), Amazon Web Services EMEA SARL and Amazon Web Services, Inc. (cold archive in Amazon S3 Deep Archive, and Amazon Aurora for workspaces placed in an AWS location), Resend, Inc. (fallback transactional email) and Anthropic, PBC (the assistant, which reads workspace records only for workspaces in the US data regions). Avonao ID and Avonao Billing are operated by Avonao, Inc. itself and are described in section 3 and on the Sub-processors page, with Stripe as merchant of record behind Avonao Billing. Providers on the page that process only personal data for which we are the controller, such as website analytics and fonts, are listed there for transparency.

EU notices

• Digital Services Act
• EU Data Act
• EU AI Act
• Right of withdrawal

Receipt practices

• Record Practice Statement
• Verifier Terms
• Key management
• Verifying ledger bundles
• Format versions and long-term verification
• Cryptographic agility and post-quantum status
• If Intramedial stops operating

Program terms

• Startup Program Terms
• Nonprofit Program Terms
• Education Program Terms
• Public Sector Program Terms