Data Processing Agreement (DPA)
The Data Processing Agreement (DPA) governs how ISMS Copilot processes personal data on your behalf as a data processor under GDPR Article 28. It…
英文内容
本页面尚未翻译为此语言。在翻译可用之前，下方显示英文版本。
The Data Processing Agreement (DPA) governs how ISMS Copilot processes personal data on your behalf as a data processor under GDPR Article 28. It automatically applies to all customers — no separate signature required.
Key Points
- EU-based storage: Your database is in Frankfurt, Germany; a daily encrypted backup copy is made by a job that runs in the United States and is kept in the EU (Amsterdam).
- AI provider routing: With Advanced Data Protection off, AI requests go to Anthropic Claude (US, about 30-day retention) or to vetted providers reached through OpenRouter (mostly US, zero data retention), with Mistral AI (EU) as failover; with it on, Mistral AI (EU, zero retention) processes them.
- No AI training: All AI providers are contractually prohibited from using your data to train models.
- 30-day advance notice: We give at least 30 days' notice of materially adverse changes to our sub-processors or this DPA.
- 48-hour breach notification: If a data breach affects your data, we notify you within 48 hours of confirmation.
Canonical Document
For the complete, legally binding Data Processing Agreement including sub-processor lists, SCCs, and audit rights, visit our Trust Center:
View the Data Processing Agreement on the Trust Center →
This is the authoritative source for all processor obligations, sub-processor arrangements, and legal terms.