Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is concluded between you (the "Controller") and Promethean B.V. [TBD] (the "Processor"), and forms an integral part of the Terms of Service governing your use of Promethean. It takes effect on the date you accept the Terms or first ingest personal data through Promethean, whichever is earlier.

2. Subject matter and duration

The subject matter is the processing by Promethean of personal data on the Controller's behalf to provide the Service. The duration is the term of the Controller's workspace plus the 90-day post-termination retention period.

3. Nature and purpose of processing

Promethean processes the following categories of data on the Controller's behalf:

• SHA-256 input hashes. Computed by the Controller's SDK before transmission; the raw input is never transmitted to or stored by Promethean.
• Output metadata. SHA-256 output hash, schema-validation flag, latency, model identity, reviewer verdict (if any), fallback flag, spec hash.
• Optional reviewer identifiers. If the Controller's reviewer-gate configuration captures reviewer identity, those identifiers are stored alongside the verdict.

The purpose of processing is to generate the L12 receipt chain, the audit bundle, and the regulator handoff packets that the Controller may use to evidence its own compliance obligations.

4. Categories of data subjects

The Controller determines the categories of data subjects whose personal data flows through its AI feature. Typical categories include the Controller's customers, employees, or service users. Because Promethean stores only SHA-256 hashes of inputs, the categories of data subjects are not directly inferrable from the L12 chain.

5. Processor obligations

Promethean shall:

• process personal data only on documented instructions from the Controller, including with regard to transfers to third countries — the Controller's instructions are captured by its workspace configuration (spec definitions, retention policy, alert settings);
• ensure that persons authorised to process personal data have committed to confidentiality;
• implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (see Annex II);
• assist the Controller, taking into account the nature of processing, in fulfilling its obligations to respond to data subject requests and to ensure compliance with Articles 32–36 GDPR;
• at the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of services, and delete existing copies unless retention is required by Union or member-state law;
• make available to the Controller all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

6. Sub-processors

The Controller authorises Promethean to engage the following sub-processors. Promethean shall inform the Controller of any intended changes by email at least 30 days before the change takes effect, giving the Controller the opportunity to object.

Controllership note. Vercel Inc. and Upstash Inc. are Delaware-incorporated companies. Although the data processing for Promethean takes place in their EU regions (Frankfurt), each is wholly-owned by a US parent and may be subject to US legal process directed at the parent. Promethean has executed EU SCCs with each sub-processor and maintains a Transfer Impact Assessment (TIA) addressing the supplementary measures (encryption at rest and in transit, tenant isolation, the substrate's hash-only data model, and the absence of plaintext personal data in the L12 chain). The current TIA is available to Controllers on written request to dpa@promethean.software. Stripe Payments Europe Ltd. and Resend Inc. are addressed in the same TIA; Stripe is EU-resident, while Resend's EU region operates under EU SCCs.

LLM providers are not sub-processors. Promethean does not transmit Controller-supplied personal data to any LLM provider (Anthropic, OpenAI, Azure OpenAI, Google, Mistral, or any other model vendor) as part of operating the workspace dashboard, the substrate, the cron, the audit-bundle renderer, or customer support. LLM calls happen between the Controller's product and the model vendor of the Controller's choice; Promethean only sees the SHA-256 hashes the Controller's SDK emits afterwards. Internal use of LLM providers by Promethean staff (engineering tooling, internal documentation drafting, code review assistance) operates on Promethean's own data, not Controller data, and is therefore not a sub-processing relationship under GDPR Art. 28. If this position changes — for example, if Promethean introduces an optional hosted-LLM feature that ingests Controller data — we will give the prior notice required by Section 6 and afford the Controller a right to object.

7. International transfers

Where personal data is transferred to a country outside the EU/EEA without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) ("SCCs"), incorporated by reference. Promethean will conduct and document a transfer impact assessment for any such transfer and implement supplementary measures where necessary.

Applicable SCC modules. Between the operator (Controller) and Promethean (Processor), the SCCs apply in Module Two (Controller-to-Processor). Where Promethean engages an onward sub-processor located outside the EU/EEA without an adequacy decision, Promethean concludes back-to-back SCCs with that sub-processor in Module Three (Processor-to-Processor), with Promethean acting as the data exporter on behalf of the Controller. The optional docking clause (Clause 7) is selected; the optional Clause 11(a) independent dispute resolution body is not selected; Clause 17 (governing law) is filled with Dutch law; Clause 18 (forum and jurisdiction) is filled with the courts of Amsterdam, Netherlands. Annexes I and II of the SCCs are populated by reference to Annex I, Annex II, Annex III and Annex IV of this DPA. Where any conflict arises between the SCCs and this DPA in respect of cross-border transfers, the SCCs prevail.

8. Personal data breach

Promethean will notify the Controller without undue delay (and in any case within 48 hours of becoming aware) of any personal data breach affecting the Controller's data. The notification will include, to the extent known at the time, the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed.

9. Liability

Each party is liable for any damage caused by processing which infringes the GDPR, in accordance with Art. 82 GDPR. Liability between the parties under this DPA is subject to the limitations set out in the Terms of Service.

10. Termination

This DPA terminates automatically when the Terms of Service terminate, subject to the post-termination obligations in Section 5.

Annex I · Description of processing

Subject matter: generation of cryptographic evidence (hash-chained, signed, optionally Bitcoin-anchored) for the Controller's AI decisioning subsystem.

Duration: the workspace lifetime plus 90 days post-termination.

Nature and purpose: storage, signing, chaining, and (at Team tier and above) Bitcoin anchoring of metadata emitted by the Controller's SDK; generation of audit bundles and regulator handoff packets on demand.

Type of personal data: SHA-256 hashes of inputs and outputs (which are not themselves personal data once hashed); metadata about each AI decision; optional reviewer identifiers configured by the Controller.

Categories of data subjects: as determined by the Controller's deployment.

Annex II · Technical and organisational measures

Access control

API keys stored as SHA-256 hashes only. Session cookies are HTTP-only, Secure-flagged, with 30-day TTL. Workspace data is tenant-isolated at the application layer.

Cryptographic integrity

Every L12 entry is hash-chained (SHA-256) and signed (Ed25519). Tampering is detectable by re-verification. The verifier is plain Node 18+ stdlib code and runs entirely under the Controller's control.

Encryption in transit and at rest

All Service endpoints require TLS 1.2 or higher. Data at rest in Upstash Redis is encrypted by the underlying provider.

Logging and monitoring

Application logs retain authentication events, key rotations, and tier changes for 90 days. The L12 chain itself is the authoritative log of AI-decisioning events.

Personnel

Access to production systems is limited to engineering staff who have signed a confidentiality undertaking. Access is reviewed quarterly.

Incident response

Documented incident-response runbook; 24-hour internal escalation target; 48-hour Controller-notification commitment per Section 8.

Sub-processor due diligence

Each sub-processor is contractually bound by EU SCCs (where applicable) and a written processing agreement that flows down the obligations of this DPA.

Annex III · List of parties

For the purposes of the SCCs (Module Two and, where engaged, Module Three) and Art. 28 GDPR, the parties are:

Data exporter (Controller). The operator identified in the workspace billing record at the time of ingestion. Name, registered address, contact person, signature and date of accession are evidenced by the workspace's Terms-of-Service acceptance record and by the billing details on file with Stripe Payments Europe Ltd. Role: Controller. Activities relevant to the data transferred: operation of an AI-decisioning feature whose metadata is recorded in the L12 chain.

Data importer (Processor). Promethean B.V. [TBD], [TBD street, postcode, city], Netherlands, KvK [TBD KvK], VAT [TBD NL...B01]. Contact person for the purposes of the SCCs: dpa@promethean.software. Role: Processor. Activities relevant to the data transferred: provision of the substrate, the workspace dashboard, the L12 chain, the anchor cron, and the audit-bundle pipeline as described in Annex I.

Sub-processors. The sub-processors listed in Section 6 (and as updated from time to time on this page) act as data importers in respect of the relevant onward transfers, under Module Three SCCs back-to-back with this DPA.

Annex IV · Competent supervisory authority

For the purposes of Clause 13 of the SCCs, the competent supervisory authority of the data exporter is the supervisory authority of the EU/EEA member state in which the exporter is established. Where the exporter is not established in the EU/EEA but has designated a representative under Art. 27 GDPR, the competent authority is that of the member state in which the representative is established. Failing that — and in respect of the data importer (Promethean B.V. [TBD], established in the Netherlands) — the competent supervisory authority is the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, Netherlands.

Annex V · HIPAA scope statement

For US Covered Entities and Business Associates within the meaning of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations at 45 C.F.R. Parts 160 and 164 ("HIPAA"):

• A Business Associate Agreement ("BAA") meeting the requirements of 45 C.F.R. § 164.504(e) is available only on the Enterprise tier and must be executed in writing before any Protected Health Information ("PHI") is processed through the Service.
• The Dev, Team, Production, and Scale tiers are not authorised for the processing of US PHI; Covered Entities and Business Associates must upgrade to Enterprise and execute a BAA before any PHI flows through their workspace.
• The substrate's hash-only design generally avoids PHI entering the L12 chain itself (the SDK computes a SHA-256 hash before transmission to Promethean). The operator's source-data store and the upstream LLM provider, however, remain in scope for HIPAA and require independent BAA coverage by the operator.

Operators who require a BAA should contact legal@promethean.software.

Contact

DPA questions and audit requests: dpa@promethean.software.