Data Processing Agreement (DPA)
The Data Processing Agreement (DPA) governs how ISMS Copilot processes personal data on your behalf as a data processor under GDPR Article 28. It…
Вміст англійською
Цю сторінку ще не перекладено цією мовою. Нижче показано англійську версію, доки не з’явиться переклад.
The Data Processing Agreement (DPA) governs how ISMS Copilot processes personal data on your behalf as a data processor under GDPR Article 28. It automatically applies to all customers — no separate signature required.
Key Points
- EU-based storage: Your database is in Frankfurt, Germany; a daily encrypted backup copy is made by a job that runs in the United States and is kept in the EU (Amsterdam).
- AI provider routing: With Advanced Data Protection off, AI requests go to Anthropic Claude (US, about 30-day retention) or to vetted providers reached through OpenRouter (mostly US, zero data retention), with Mistral AI (EU) as failover; with it on, Mistral AI (EU, zero retention) processes them.
- No AI training: All AI providers are contractually prohibited from using your data to train models.
- 30-day advance notice: We give at least 30 days' notice of materially adverse changes to our sub-processors or this DPA.
- 48-hour breach notification: If a data breach affects your data, we notify you within 48 hours of confirmation.
Canonical Document
For the complete, legally binding Data Processing Agreement including sub-processor lists, SCCs, and audit rights, visit our Trust Center:
View the Data Processing Agreement on the Trust Center →
This is the authoritative source for all processor obligations, sub-processor arrangements, and legal terms.