Data Processing Agreement

Roles

For personal data processed in the course of delivering services to you, you are the data controller and we are the data processor. We process such data only on your documented instructions.

Scope of processing

The subject matter, duration, nature and purpose of processing are defined by the applicable statement of work. Categories of data subjects and personal data vary by engagement and are documented before work begins.

Our obligations

We will:

• Process personal data only on your instructions, unless required otherwise by law
• Ensure personnel with access are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Not engage a sub-processor without notifying you and giving you a chance to object
• Assist you in responding to data subject requests
• Notify you without undue delay on becoming aware of a personal data breach
• Delete or return personal data at the end of the engagement, at your choice
• Make available the information needed to demonstrate compliance

Sub-processors

We use a small set of sub-processors, typically including cloud hosting, email delivery and — where the service requires it — language model providers. The current list for your engagement is provided on request and before processing begins.

Security measures

Measures we apply include:

• Encryption in transit for all data, and at rest where the platform supports it
• Role-based access control on the principle of least privilege
• Credentials stored in an encrypted secrets manager, never in plain text
• Access logging and audit trails on systems we operate
• Removal of our access at the end of an engagement

International transfers

Where processing involves a transfer outside India, we rely on the recipient's contractual safeguards. Where you require data to remain within India, we can deploy self-hosted infrastructure in an Indian region — tell us before design begins.