Legal · v1.1
GDPR Article 28 · Template effective: 11 July 2026 · Last updated: 26 October 2026
This Data Processing Agreement (“DPA”) is entered into between InTheValley LLC, under the name ComplyEdge (“ComplyEdge”, “Processor”), and the organization identified in the signature block below (“Customer”, “Controller”). It supplements the ComplyEdge Terms of Service and governs ComplyEdge’s processing of personal data on the Controller’s behalf through the hosted Service (eu.api.complyedge.io, api.complyedge.io, dashboard.complyedge.io, trust.complyedge.io, and related properties), as required by GDPR Article 28.
How to execute: Email support@complyedge.io with subject “DPA Request” and your organization details. ComplyEdge will return a countersigned copy. Until a signed DPA is in place, do not transmit personal data through the hosted Service where a DPA is legally required for your use case.
Organization name:
Address:
Contact name:
Email:
1.1 Subject matter. ComplyEdge processes personal data on behalf of the Controller solely to provide the hosted compliance Service: including policy evaluation via /v1/check and related APIs, audit logging, dashboard access, TrustLint-related hosted features where applicable, and support: as described in the Terms of Service, the Privacy Policy, and this DPA.
1.2 Duration. This DPA is effective from the date of last signature below and continues for as long as ComplyEdge processes personal data on behalf of the Controller, or until the underlying Terms of Service are terminated, whichever comes first.
2.1 Nature. Receiving content and metadata submitted by the Controller; evaluating that content against configured compliance rules (including OPA/Rego); returning allow/block decisions with citations; writing audit events that hold no submitted content, each linked by hash to the one written before it so a later edit, deletion or reordering can be detected; authenticating tenant users; delivering transactional notices.
2.2 Purpose. Providing runtime AI-compliance enforcement and evidence tooling instructed by the Controller.
2.3 Prompt/content minimization and pseudonymisation. In standard production audit logs, ComplyEdge stores a keyed hash (HMAC-SHA-256) of evaluated text (text_hash), not the raw prompt/output, unless a separate written agreement states otherwise. The key is generated per Controller account by AWS KMS, stored only in wrapped form, and never disclosed; records written before the keyed hash reached production carry a plain SHA-256 until they expire. User and session identifiers the Controller sends (user_id, session_id) are stored as keyed pseudonyms under the same key; records written before pseudonymisation reached production may hold the identifier as sent until they expire. The Controller can check a text against a record (POST /v1/audit/verify) and obtain the pseudonym of an identifier (POST /v1/audit/pseudonym). Request metadata (timestamps, endpoint, jurisdiction/rules selection, latency, decision outcome, rule IDs, citations) may be retained as part of the audit trail. Application logs do not include request text. A field-by-field description is published at complyedge.io/legal/dpo-pack.html.
2.4 Retention. Audit events are kept for 184 days, then expire. The period is a ComplyEdge product term; it matches the six-month floor in EU AI Act Art. 26(6) for deployers of high-risk systems (binding from 2 December 2027 under Reg. (EU) 2026/1744) but is not a statutory term for other deployers. A longer period may be set by Enterprise tenants from their dashboard (applying to records written after the change), or agreed by written amendment. Your own retention obligations (for example under national commercial or tax law) remain yours. Other copies: a write-once archive of every change to an audit record (Object Lock 180 days, deleted after 400 days), database point-in-time recovery (35 days), weekly backups (210 days), and application logs without request text (90 days).
The Controller may transmit the following categories through the Service:
text_hash in standard audit logs)The Controller agrees not to transmit special categories of personal data (GDPR Art. 9) through the Service without a separate amendment to this DPA and appropriate safeguards.
ComplyEdge agrees to:
5.1 Instructions only. Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country: unless required to do so by Union or Member State law; in such case, ComplyEdge will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5.2 Confidentiality. Ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.3 Security. Implement appropriate technical and organizational measures (GDPR Art. 32) to ensure a level of security appropriate to the risk, including:
5.4 Sub-processors. Not engage another processor (sub-processor) without prior specific or general written authorization of the Controller. Current authorized sub-processors are listed in §6. ComplyEdge will notify the Controller of intended material changes to sub-processors, giving the Controller the opportunity to object.
5.5 Data subject rights assistance. Assist the Controller in responding to requests from data subjects exercising their GDPR rights (access, rectification, erasure, restriction, portability, objection), to the extent feasible given the hash-first audit design and account metadata held for the tenant.
5.6 Deletion/return. At the choice of the Controller, delete or return personal data to the Controller after the end of the provision of services, and delete existing copies: unless required to retain data by applicable law or the archive and backup windows in §2.4. Deleting the account deletes its audit key, so the keyed hashes and pseudonyms in any copy still held in those windows can no longer be linked to an input or a person.
5.7 Audit assistance. Make available to the Controller information reasonably necessary to demonstrate compliance with GDPR Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to confidentiality, security, and reasonable scheduling. ComplyEdge may charge reasonable fees for audit assistance beyond standard documentation.
5.8 Breach notification. Notify the Controller without undue delay (and, where feasible, within 72 hours) after becoming aware of a personal data breach involving the Controller’s data. Notification will include the information specified in GDPR Art. 33(3) to the extent available at the time.
The Controller chooses the region when the tenant is created: the EU region (Germany, eu-central-1), which is preselected, or the US region (United States, us-west-2). Moving an existing tenant to the other region is performed by ComplyEdge support on the Controller's request. Processing stays in the region where the tenant lives.
| Sub-processor | Country | Role |
|---|---|---|
| Amazon Web Services EMEA SARL (AWS) | United States (region: us-west-2) | Hosting, storage, compute for tenants that live in the US region |
| Amazon Web Services EMEA SARL (AWS) | Germany (region: eu-central-1) | Hosting, storage, compute for tenants that live in the EU region |
| OpenAI OpCo, LLC (and affiliates); EEA and Swiss data is processed by OpenAI Ireland Limited | United States | LLM evaluation. On a paid plan, after a clean phrase pass, the injection meaning check sends the evaluated text to OpenAI when the month's model budget covers it, including the default path, and a missing answer denies the request. If that budget is used up, the check does not run and the phrase rules decide. The wider legal review on a check receives the text when the Controller sets use_semantic_fallback to true for that request, or turns the account's Layer 2 setting on. On sensitivity detection that request flag does nothing. A model runs there only on a paid plan when the account setting is on, after the TrustLint rules come back clean. That endpoint does not run the injection check. The EU AI Act meaning classifier stays off until this row says it is on. |
| Brevo (Sendinblue SAS / affiliates) | EU / as operated by vendor | Transactional email (OTP / notices) |
| Cloudflare, Inc. | United States / global network | Bot check (Turnstile) on dashboard sign-in. Receives the IP address and browser signals of the Controller's users who sign in; receives no content submitted for evaluation. |
| Paddle.com Market Ltd (and affiliates) | United Kingdom / as operated by vendor | Merchant of record for paid plans. Paddle is the seller of the subscription and is responsible for collecting and remitting sales tax and VAT on that sale. Billing and payment data are collected by Paddle on its own checkout, where Paddle acts as an independent controller; ComplyEdge receives the subscription and customer identifiers required to activate the plan. |
Scope of this list. The table above is the complete set of sub-processors that may process Controller personal data submitted through the Service, which is what this DPA governs. ComplyEdge also uses vendors for its own corporate and website purposes where it acts as an independent controller rather than as your processor, including source-code hosting and website analytics. Those are not sub-processors under this DPA and are listed in the Privacy Policy. If a vendor ever begins processing Controller personal data, it is added to this table and the notice and objection rights in this section apply.
International transfer notice: Some sub-processors are US-based or process data outside the EEA. Where required, ComplyEdge relies on appropriate safeguards under GDPR Chapter V (including Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914) with those sub-processors. Copies of applicable SCCs may be provided to the Controller upon written request after counsel finalization of the executed pack. Tenants that live in the EU region have their submitted content processed in the EU (it is checked, never stored) and their audit records stored in the EU. Exceptions: (a) on a paid plan, the injection meaning check (OpenAI, US) after a clean phrase pass when the month's model budget covers it, and the wider legal review (OpenAI, US) when the Controller turns it on, which is the Controller's instructed transfer; (b) transactional email (Brevo); (c) billing (Paddle), which never receives content; (d) subscription-plan and account-identity metadata (plan tier, status, account email) exchanged between regions to route billing and sign-in; (e) the sign-in bot check (Cloudflare), which receives the signing-in user's IP address and browser signals.
The Controller agrees to:
For GDPR compliance interpretation, this DPA is governed by the laws of the Republic of Ireland as an EU reference jurisdiction. For all other purposes, governing law and venue follow the ComplyEdge Terms of Service / order form.
Signature:
Printed name:
Title:
Date:
Signature:
Printed name:
Title:
Date:
This is a template. The executed version governs. Consult qualified legal counsel before executing this agreement. Related: Terms of Service · Privacy Policy.