Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Agentry (“we”, “us”) and the customer that has agreed to the Terms of Service (“you”): a person, or an organization whose administrator accepted the Terms for it. It applies whenever we process Customer Personal Data in providing the Service, and lasts as long as we do. You do not need to sign it; using the Service under the Terms is agreeing to it.

It covers personal data inside the content you put into the Service. It does not cover the personal data we hold to run your account, bill it and keep the Service working (your sign-in details, payment records, operational logs and audit records): for that we are the controller, and the Privacy Policy applies.

• Data Protection Law means every law on personal data that applies to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it applies in the United Kingdom with the Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”) and its provincial counterparts, and the California Consumer Privacy Act as amended (“CCPA”) and the other US state privacy laws.
• Customer Content means what you put into the Service: QuickAgents and their versions, repositories, knowledge packs, voice files, the tasks, inputs and files you give a hosted run or session, its outputs, the secrets you keep with us, and anything else you upload.
• Customer Personal Data means personal data in Customer Content that we process on your behalf.
• Subprocessor means a third party we engage that processes Customer Personal Data.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data that we or a Subprocessor hold.
• SCCs means the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to them issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• “Controller”, “processor”, “data subject”, “personal data”, “processing”, “business” and “service provider” mean what Data Protection Law says they mean.

You are the controller of Customer Personal Data, or a processor acting for your own customer, in which case we are your subprocessor. We are your processor, and under the CCPA your service provider. You are responsible for having a lawful basis for the personal data you put into the Service, for giving any notice and getting any consent that requires, and for your instructions complying with Data Protection Law.

We process Customer Personal Data only on your documented instructions. Those instructions are the Terms, this DPA, what you direct through the Service (running a QuickAgent, building a knowledge pack, starting a draft, publishing a version) and any other written instruction we agree to. Publishing a QuickAgent publicly is an instruction to make it available to everyone and to keep each published version unchanged, as the Terms describe. We do not process Customer Personal Data for any other purpose, unless a law we are subject to requires it; then we tell you first, unless that law forbids it. If we think an instruction breaks Data Protection Law, we tell you.

We do not sell Customer Personal Data, and we do not use Customer Content to train AI models.

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only as far as their work needs it. We look at private Customer Content only to operate the Service, to deal with security or abuse, to answer your support request, or where the law requires it.

We keep the technical and organisational measures in Annex II in place, appropriate to the risk of the processing as Article 32 of the GDPR requires. We may change them as the Service changes, but not in a way that lowers the overall level of protection they give Customer Personal Data. You are responsible for the settings in your control: who holds your access tokens, who you invite to your organization, what you publish publicly, and which QuickAgents you run with which secrets.

You give us general authorisation to engage Subprocessors. The current list is in Annex III, the same list as the Privacy Policy's.

We add a new Subprocessor to that list, and move its date, at least 30 days before it starts processing Customer Personal Data. If you would like that notice by email, write to hello@secureagentry.net and we will send it to you. You may object to a new Subprocessor on reasonable grounds relating to data protection, by writing to us within that period. We will then work with you in good faith on an alternative; if we cannot offer one, you may end the affected part of the Service, and we will refund fees you paid in advance for the period after it ends.

We bind each Subprocessor by a written contract to data protection obligations no less protective than this DPA's, as far as they apply to the service it provides, and we remain responsible to you for its performance of them.

We run the Service in the United States, and some Subprocessors process in other countries (Annex III says where). Where Data Protection Law requires a transfer mechanism for Customer Personal Data leaving the European Economic Area, the United Kingdom or Switzerland, the following apply and are incorporated into this DPA:

• From the EEA: the SCCs, Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor, with you as data exporter and us as data importer. In them, clause 7's docking clause does not apply; under clause 9(a), option 2 (general written authorisation) applies with the notice period in the Subprocessors section; clause 11's optional language does not apply; under clause 17, option 1 applies with the law of Ireland; under clause 18(b), disputes go to the courts of Ireland; and Annexes I, II and III of the SCCs are completed by the annexes below. The competent supervisory authority under clause 13 is the one that would be competent for you.
• From the United Kingdom: the UK Addendum, completed with the information in the SCCs above and the annexes below, with either party able to end it as its section 19 allows.
• From Switzerland: the SCCs as above, with the FADP in place of the GDPR where the transfer is subject to it, the Federal Data Protection and Information Commissioner as the competent supervisory authority for those transfers, and “member state” read so that a data subject in Switzerland can bring a claim where they habitually reside.

Where we transfer Customer Personal Data on to a Subprocessor, we put in place a mechanism that Data Protection Law accepts for that transfer. If the SCCs conflict with this DPA, the SCCs prevail.

If a data subject asks us directly to exercise a right over Customer Personal Data, we pass the request on to you without undue delay and do not answer it ourselves, except to tell them we have done so. Most requests you can answer yourself: you can read, export, change and delete your Customer Content in the Service. Where you cannot, we help you, by appropriate technical and organisational measures and as far as the nature of the processing allows.

We also give you the information you reasonably need, about the Service and the processing we do, for your own data protection impact assessments and prior consultations with a supervisory authority.

We tell you of a Personal Data Breach without undue delay, and no later than 72 hours after we become aware of it, by email to the address on your account (for an organization, to its administrators). We tell you what we know of its nature, the categories and approximate number of data subjects and records concerned, its likely consequences, and what we have done and will do about it, and we send more as we learn it. We take reasonable steps to contain it and reduce its effects. Telling you of a breach is not an admission of fault.

While your account is open you can export and delete your Customer Content in the Service. When it is closed, or you ask us to, we delete Customer Personal Data, except where a law requires us to keep it, and except for the published versions and records the Terms say outlive an account, which are kept pseudonymised. Some data is deleted on its own schedule, as Annex I says. Copies in our backups are not restored into the Service and age out as the backups do, within 30 days.

We make available the information you reasonably need to show that we meet Article 28 of the GDPR and this DPA. We answer a reasonable written security questionnaire once a year, and when a supervisory authority asks you for something we can give. Much of the Service is open source, so you can read the code that runs the registry, the scanners and the runner.

If that information is not enough, or a supervisory authority requires it, you or an independent auditor you appoint may audit our compliance with this DPA, at your cost, on 30 days' written notice, during business hours, no more than once a year unless a Personal Data Breach or a supervisory authority calls for another, and under a duty of confidentiality. An audit does not extend to other customers' data or to our Subprocessors' premises; for those we pass on the reports and terms they give us.

Where the CCPA or another US state privacy law applies, we process Customer Personal Data as your service provider or processor, for the business purpose of providing the Service. We do not sell or share it (as the CCPA uses those words); retain, use or disclose it for any purpose other than providing the Service or outside our direct business relationship with you; or combine it with personal data we receive from anyone else, except as the CCPA permits a service provider to. We comply with the CCPA's obligations on us and give personal data the same level of privacy protection it requires, and we tell you if we can no longer meet them. You may take reasonable steps to stop and remedy any unauthorised use of Customer Personal Data. We certify that we understand these restrictions and will comply with them.

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow it to be limited. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails; if the SCCs conflict with this DPA, the SCCs prevail. This DPA is governed by the law that governs the Terms, except where the SCCs name another. We may change this DPA as the Terms allow; a change will not lower the protection it gives Customer Personal Data unless Data Protection Law requires it. The date at the top says which version is current.

Data exporter

You, the customer, as identified by your account or your organization in the Service, contactable at the email address on it. Role: controller (or processor).

Data importer

Agentry, contactable at hello@secureagentry.net, or for a security matter security@secureagentry.net. Role: processor (or subprocessor).

Data subjects

Whoever you put personal data about into the Service: your members and staff, your customers and contacts, and the people named in the documents, files and tasks you give it.

Categories of personal data

Whatever personal data Customer Content contains: typically names, contact details, user names, and the content of the documents, messages, files and records you give a run, a session, a draft or a knowledge pack, and of what they produce; and credentials and API keys you keep as secrets.

Special categories

None are intended. If you put special categories of data, or data about criminal convictions, into the Service, you are responsible for having a lawful basis for it; the measures in Annex II apply to it as to all Customer Content.

Frequency

Continuous, for as long as you use the Service.

Nature of the processing

Hosting, storage, transmission, scanning, AI analysis, running QuickAgents in hosted runs and sessions, building knowledge packs, drafting, encryption, backup and deletion.

Purpose

Providing the Service to you under the Terms: hosting and publishing QuickAgents, scanning them before they are installable, running them for you, and keeping the Service working and dealing with abuse of it.

Duration and retention

For as long as you use the Service, then as the Deletion and return section says. Within it: a hosted run's task and inputs are deleted when the run ends, and its output and record after 30 days; knowledge packs, voice files, secrets and repositories are kept until you delete them or close the account; published versions are kept as the Terms describe; backup copies age out within 30 days; service logs, which can carry identifiers but not Customer Content, are kept for 14 to 90 days by kind.

Subprocessors

Each Subprocessor in Annex III processes only the data, for the purpose and for the duration that its entry there states.

Competent supervisory authority

Under the SCCs, the one competent for you, as the International transfers section says.

The measures as built. The Trust & security page and the documentation describe the product's security model in more depth.

• Encryption in transit. Every connection to the Service, and between its parts across a network, uses TLS.
• Encryption at rest. A hosted run's task, inputs, uploads, outputs and record are sealed with AES-256-GCM under a data key of their own, which is wrapped for the account that owns them by a key service (OpenBao Transit) that never releases its keys. Knowledge packs are sealed under a data key per pack, wrapped to the owner's certificate. Secrets you keep with us are encrypted by the key service under a key derived for your account, and are never shown back.
• Isolation of runs. A hosted run executes in a gVisor sandbox on a sandbox host, with the platform's model endpoint as its only route out to a model and its tools in containers of their own. A secret goes to the tool that uses it, never to the QuickAgent's own container, and is deleted from the host when the run ends.
• Access control. Accounts sign in through our directory with a hashed password, a social sign-in or organization single sign-on, and can enrol two-factor authentication; joining Publisher Earnings requires it. Access tokens carry scopes and act only within them. Organization roles decide who can read and change an organization's content. Staff read a hosted run's sealed data withheld, and every staff read of the audit log is itself audited.
• Audit and logging. Sign-ins, token changes, publishes, review decisions and staff actions are recorded in an append-only audit log, written in the same transaction as the change. Service logs are collected into a log store of our own, with token-shaped values withheld before storage, and kept for 14 to 90 days by kind.
• Scanning. Every public QuickAgent version is scanned before it is installable, and files given to a run are checked for malware before the QuickAgent reads them; a risky file is also looked up by its SHA-256 hash alone, never sent.
• Backup and recovery. The database keeps point-in-time history, and it and the object store are copied to a backup in a second US region (nightly and hourly); backups are kept for 30 days. Restoring is rehearsed with a timed drill, against a recovery time objective of four hours.
• Hosting. The Service runs in Vultr's data centres, whose physical and environmental controls Vultr operates and audits.
• Change and vulnerability management. Every change passes automated tests and checks before it is merged and deployed, and dependencies are checked for known vulnerabilities on every change; releases of the command-line tool and desktop app are signed. Security reports are welcome at security@secureagentry.net.
• Incidents. Production is watched by alerts on failures and an outside uptime check, and Personal Data Breaches are handled as the section above says.
• People. Access to production is limited to the people who operate it, under a duty of confidentiality.

The Subprocessors we engage, with what each does, what it receives and where. The Privacy Policy shows the same list.