Kortyx Cloud Data Processing Agreement

1.1 This Data Processing Agreement (“DPA”) forms part of the Cloud agreement between the Customer identified in the applicable account or contract records and Kortyx. It applies to personal data contained in Customer Content that Kortyx processes on the Customer's behalf to provide Cloud (“Customer Personal Data”).

1.2 The Customer acts as controller or, where it processes for another controller, as processor. Kortyx acts respectively as processor or subprocessor. A Customer acting as processor must have the authority required to appoint Kortyx and communicate the relevant controller's lawful instructions. The parties' actual activities and Applicable Data Protection Law determine their roles; a contractual label does not alter those activities.

1.3 “Applicable Data Protection Law” means the data-protection laws applicable to the processing under this DPA, including the GDPR where applicable and relevant national implementing law. “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have their applicable statutory meanings. “Subprocessor” means another processor engaged by Kortyx to process Customer Personal Data for the Customer.

1.4 The DPA does not govern processing for which Kortyx independently determines the purposes, such as its own account administration or necessary contractual-evidence records. Those activities are described in the Cloud Privacy Notice. Kortyx may not reclassify Customer Content as its own operational information to avoid the restrictions in this DPA.

1.5 If documents conflict, a mandatory transfer instrument takes precedence to the extent required by that instrument, followed by this DPA for Customer Personal Data, then the remaining Cloud agreement. A privacy notice cannot authorize an additional processing purpose contrary to this DPA. The annexes are part of the DPA and must be versioned with the operative agreement.

2.1 Annex 1 describes the subject matter, purpose, nature, duration, categories of people, data types and processing operations. Processing is limited to delivering, supporting and securing the Customer's service, including the supported features and lifecycle described there.

2.2 Processing continues during the service relationship and the limited return, deletion and other lawful retention periods specified in Annex 1. Termination of ordinary product access does not end the safeguards applicable to remaining copies. No indefinite processing authorization arises from service termination.

2.3 Customer Personal Data may include ordinary personal information in observability and evaluation content. The standard service excludes passwords, private keys, authentication tokens and payment-card information from that content. Identifiable health information, special-category data, criminal-offence information and other data requiring additional regulated arrangements are not authorized unless the parties first complete the required review and execute an appropriate written agreement. A generic DPA signature does not provide that approval.

3.1 The Cloud agreement, this DPA, supported configurations and properly authorized written requests constitute the Customer's documented instructions. Instructions include collection, storage, retrieval, display, customer-requested evaluation transmission, supported exports and deletion within the agreed service.

3.2 Kortyx will not sell Customer Personal Data, use it for advertising, train models on it or use it for unrelated product research. Access to investigate a fault or security incident does not authorize reuse of the content for a separate commercial purpose.

3.3 Where European Union or Member State law applicable to Kortyx requires processing outside the Customer's instructions, Kortyx will inform the Customer before processing unless that law prohibits notice on important public-interest grounds. Any other proposed legally compelled processing must be assessed under Applicable Data Protection Law and the relevant transfer arrangements; this clause is not unrestricted permission to comply with every foreign request.

3.4 If Kortyx considers an instruction to infringe Applicable Data Protection Law, it will promptly inform the Customer, explain the concern to the extent lawful and seek clarification. The parties will cooperate to resolve it. Kortyx may suspend the affected instruction while the issue is unresolved where necessary to avoid unlawful processing, without treating the suspension as permission for unrelated use.

3.5 A request requiring a material change to the service or an additional processing purpose must be assessed and agreed before implementation. No separate agreement may remove a mandatory statutory duty. Identity and authority checks for sensitive instructions must be proportionate and must not be used to obstruct valid requests.

3.6 If Kortyx cannot carry out a lawful instruction within the agreed processing scope, it will promptly notify the Customer, explain the material obstacle and cooperate on an appropriate resolution. It will not silently substitute a different purpose or assume consent to additional processing. If lawful performance cannot be restored, the parties will address cessation of the affected processing and the applicable return, deletion and exit arrangements. This does not postpone a mandatory notification or other statutory duty.

4.1 The Customer determines the purpose of its application processing and is responsible for the lawfulness, accuracy and relevance of the data it supplies, the instructions within its control, required notices and lawful grounds, and the authority of its users. Where appropriate, the Customer must implement minimization and redaction before transmission.

4.2 The Customer must review whether its intended processing requires an impact assessment, additional safeguards or sector-specific arrangements before using the standard service. It must keep appropriate privacy and incident contacts current and communicate relevant instructions from an upstream controller.

4.3 These responsibilities do not transfer Kortyx's statutory or contractual obligations to the Customer. Kortyx remains responsible for applying its own safeguards, honoring documented instructions and meeting its processor duties.

5.1 Kortyx will limit access to persons who require it to perform authorized duties and who are bound by contractual confidentiality obligations or an appropriate statutory duty. Personnel permissions must correspond to the work required and be withdrawn when that need ends.

5.2 Access to Customer Personal Data is permitted only where necessary for requested support, operating or recovering the service, or investigating security or abuse. It does not permit casual browsing, marketing research or unrelated product experimentation. Support requests should use controlled channels and minimize copied content.

5.3 Staff access is restricted to authorized personnel working within the EU for this service release. Any change to that operating arrangement requires assessment before access is granted. Provider processing and access are separately described in Annex 3. Annex 2 describes the access controls and records; staff location is not a representation that every provider operation is EU-only.

6.1 Kortyx will implement and maintain the technical and organizational measures specified in the Annex 2, taking account of the processing risks and the sensitivity, scale and context of the data. The measures must address unauthorized disclosure or access, accidental or unlawful destruction, loss and alteration.

6.2 Security procedures will be reviewed in light of material service changes and identified risks. A replacement measure must preserve an appropriate level of protection; a broad right to change technology does not permit abandonment of an agreed safeguard without review and any required customer agreement or notice.

6.3 The parties will cooperate where a security measure depends on Customer configuration, including user access, application credentials, minimization and integration endpoints. A Customer-configurable control does not eliminate Kortyx's responsibility for the measures assigned to it.

6.4 The measures in Annex 2 apply to this service. Kortyx does not represent that it holds ISO 27001, SOC 2 or HIPAA certification, or offer a contractual recovery-time or recovery-point objective. Third-party assurance does not automatically constitute assurance of Kortyx’s whole service.

7.1 The Customer gives general written authorization to the subprocessors identified in the versioned Subprocessor List for the functions and data specified there.

7.2 Before a subprocessor receives Customer Personal Data, Kortyx will assess the proposed processing and enter into a written agreement imposing the applicable data-protection obligations required for that activity. Kortyx remains responsible to the Customer for the subprocessor's performance of those obligations as required by Applicable Data Protection Law.

7.3 For an intended addition or replacement, Kortyx will give designated customer contacts at least 30 calendar days’ advance notice identifying the recipient, function, data, locations and relevant safeguards. The notice will explain the proposed start date and how to raise an objection on reasonable data-protection grounds. A silent edit to a web list is not the entire notification process.

7.4 An objecting Customer should identify the affected processing and the grounds for concern through the verified legal channel during the notified period. Kortyx will assess the concern and discuss a reasonable resolution, which may include additional safeguards, a supported alternative or excluding the affected function. Neither party is required to agree to an unlawful arrangement.

7.5 If the parties cannot resolve a reasonable objection before the proposed change, the Customer may terminate the affected service without a termination penalty, with the applicable return/deletion and switching arrangements. Kortyx will respond to the objection before the proposed processing starts. While an objection is unresolved, it will not send the affected Customer Personal Data to the proposed new provider unless another lawful, agreed basis permits it. The customer may end the affected service before the change takes effect.

7.6 If urgent security or legal circumstances make the ordinary notice process impracticable, Kortyx will explain the circumstances promptly and seek specific written authorization for an earlier appointment where required. The general authorization does not create a blanket right to appoint any provider without a meaningful objection opportunity. Affected processing may be suspended where necessary to avoid an unauthorized appointment.

7.7 Subprocessor notifications are necessary service communications. They do not require marketing signup, and an objection is not the same as declining Cloud Terms or withdrawing browser analytics consent.

8.1 Kortyx will not transfer Customer Personal Data outside the applicable permitted territory except on documented instructions and with a valid legal mechanism where required. Annex 3 and the Subprocessor List describe the locations and recipient roles; transfer arrangements must cover the actual processing and onward access.

8.2 Where transfer standard contractual clauses are required, the parties must complete the applicable instrument, modules, party details, selections and annexes. The use of an EU hosting region is not itself a transfer mechanism. A provider's marketing statement or certification must not be substituted for verification of the relevant legal entity and covered activity.

8.3 Kortyx will assess lawful requests for access by public authorities and limit disclosure to what the applicable law permits or requires. Where permitted, it will notify the Customer and provide information needed for an appropriate response. Additional obligations in an applicable transfer instrument remain controlling.

8.4 This DPA is a bespoke processing agreement and does not itself incorporate international-transfer standard contractual clauses. Where a particular transfer requires them, the applicable parties must put the correct instrument and completed particulars in place before the transfer. Provider-specific arrangements are identified in Annex 3 and the associated provider records.

9.1 Taking account of the nature of processing, Kortyx will assist the Customer through appropriate measures to respond to requests concerning Customer Personal Data. Supported retrieval, correction, restriction and deletion functions may form part of that assistance; unavailable functionality must not be represented as existing.

9.2 If Kortyx receives a request relating to Customer-controlled content, it will notify or direct the requester to the Customer as appropriate and will not independently decide the request unless instructed or legally required. It will protect the requester's information when identifying the relevant Customer and must not disclose content to an unrelated organization.

9.3 The Customer remains responsible for its substantive response and statutory deadlines. Kortyx will provide the assistance required of it in time to support those duties, taking account of the request and available information. Disagreement about optional work must not suspend assistance that the law already requires.

10.1 Kortyx will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. A notification will be sent through the agreed incident contact process and supplemented as reliable information becomes available.

10.2 To the extent known, the notification will describe the nature of the breach, affected data and people, approximate scope, likely consequences, containment or remedial steps, and a contact for further information. Incomplete initial information will not be a reason to postpone all notice where a notification is due.

10.3 Kortyx will take appropriate steps to contain and investigate the incident, preserve relevant evidence, reduce harm and address the cause. It will cooperate with the Customer's assessment and notification duties. The Customer determines its own notifications to people and authorities unless law assigns a direct duty to Kortyx.

10.4 An incident notice does not by itself constitute an admission about liability or final causation. This does not reduce the duty to communicate facts accurately.

11.1 Taking account of the processing and information available to it, Kortyx will assist with the Customer's relevant security obligations, impact assessments and prior consultation with supervisory authorities. The Customer should explain the requested information and the processing being assessed so that assistance is appropriately scoped.

11.2 Assistance may include the completed processing and security annexes, relevant information about subprocessors and transfers, and explanations of supported lifecycle controls. Information concerning other customers, live credentials or exploitable security details must be protected while providing sufficient evidence.

11.3 Any agreement about separately requested implementation or advisory work must distinguish that work from assistance already required under this DPA or law. This DPA contains no pre-approved fee schedule for statutory assistance.

12.1 Kortyx will make available the information necessary to demonstrate compliance with its processor obligations and allow and contribute to appropriate audits, including inspections by the Customer or its mandated auditor.

12.2 The parties will coordinate the scope, timing and manner of an audit to protect confidentiality, other customers' information and service security. Existing current evidence may answer particular questions efficiently, but an unverified certification or an absolute prohibition on inspection cannot replace the applicable audit right.

12.3 Reasonable advance notice and confidentiality arrangements may apply where appropriate. They must not defeat urgent incident investigation, statutory rights or a competent authority's powers. The auditor must not receive unrelated Customer Content or secrets unnecessary to the assessment.

12.4 Kortyx will assess material deficiencies and take appropriate corrective steps. Ordinary audits should start with a written request identifying the processing and information needed. Where that information does not adequately demonstrate compliance, the parties will arrange an appropriate further audit or inspection. Each party bears its own ordinary cooperation costs; additional voluntary services require separate agreement. Costs or confidentiality arrangements will not obstruct statutory assistance, urgent investigation or a supervisory authority.

13.1 At the Customer's choice, Kortyx will return or delete Customer Personal Data after the services involving processing end, and delete remaining copies unless applicable European Union or Member State law requires storage. Any additional retention claim must be reviewed against Applicable Data Protection Law and documented; a general commercial preference is insufficient.

13.2 Annex 1 sets out retention and residual-copy handling. Cloud Terms Schedule B describes authorized retrieval and switching. A choice to close the service is not consent to retain content indefinitely. The parties will distinguish deletion of customer-controlled content from separately justified controller records.

13.3 Copies awaiting expiry remain subject to this DPA, protected against ordinary access and prohibited reuse. If a restore reintroduces erased information, the defined restoration procedure must preserve applicable deletion instructions. Legal holds must be scoped, access-restricted and ended when their justification no longer applies.

13.4 The 30-day workspace archive-recovery feature is distinct from a valid erasure request, an account-closure process and a legally required switching period. The lifecycle and retrieval schedules preserve those separate rights; acceptance of new Terms is not a condition of exercising an applicable return, deletion or switching right.

13.5 On an authorized request, Kortyx will provide written confirmation of the deletion steps completed and identify any residual copies, purpose and applicable expiry or review criteria. Confirmation will distinguish logical deletion, queued physical cleanup and backup expiry; it will not certify destruction that has not occurred.

14.1 This DPA continues for as long as Kortyx retains Customer Personal Data for the Customer. A service suspension does not suspend confidentiality, security or applicable assistance duties.

14.2 A change to this DPA must follow the applicable contractual process and may not retrospectively alter the instructions or obligations governing earlier processing. Mandatory transfer instruments may have their own amendment rules. Versioned annexes and provider notices must remain consistent with actual processing.

14.3 The Cloud Terms’ allocation of responsibility applies only to the extent lawful. Nothing limits a data subject’s statutory rights or liability that Applicable Data Protection Law does not permit the parties to exclude.

A. Parties and instructions

The Customer is the individual or organization identified in the accepted Cloud agreement. Its authorized representative supplies the organization, privacy and incident contact details through the account or a verified written instruction. If the Customer is itself a processor, it must have the upstream controller’s authority to appoint Kortyx. The processor is the operator identified in the Legal Notice, using the Kortyx trading name. Privacy and processing instructions: legal@kortyx.io. Security reporting: security@kortyx.io. Processing begins when authorized data is first supplied and continues through the applicable return and deletion lifecycle.

B. Nature, purpose and categories

The service provides hosted observability, prompt management and customer-requested application evaluation. Processing includes receipt, storage, organization, retrieval, display, supported transmission to configured endpoints, evaluation-related processing, necessary support and security access, backup, authorized export and deletion. Frequency follows the Customer’s applications and use of the service, including continuous event ingestion where configured.

People concerned may include Customer personnel, application users, customers, business contacts and other people lawfully represented in permitted content. Information may include identifiers, ordinary correspondence and personal or business information in prompts, outputs, traces, tool events, stored prompt versions, datasets, evaluation records and associated metadata. Customer configuration determines the actual information submitted. Section 2 excludes secrets and restricted regulated categories from ordinary content processing. The purpose is solely delivery, support and security of that Customer’s service, not advertising, model training or unrelated research.

C. Lifecycle

Backup rotation is distinct from consent, staff-audit and correspondence retention. Kortyx’s own minimum controller records are described in Cloud Privacy section 9 and cannot be used as a justification to retain all Customer Content.

Identity, authorization and separation

Cloud uses individual authenticated accounts, organization/project permission checks and server-side authorization. Privileged internal Admin access uses dedicated granular permissions and mandatory multifactor authentication. Staff membership is separately administered and is not a default customer-signup entitlement. Application database access is scoped with PostgreSQL row-level security, including forced enforcement on the covered tenant tables, and runtime database roles do not have unrestricted administrator or row-security-bypass privileges.

Communications, credentials and stored information

Public service and authentication connections use HTTPS. Production inter-host database traffic uses an encrypted private tunnel with source-restricted access; databases are not exposed as public services. Protected authentication grants and designated integration secrets use application-level encryption and access controls. Off-site recovery copies are encrypted before storage. These measures are specific: Kortyx does not represent that all active trace fields or every host volume are separately encrypted at rest. Customers must not place credentials in ordinary trace content.

Operational controls and records

Changes pass source review and automated checks, with separate staging and production configuration. Deployment checks cover service authentication, relevant tenant isolation and representative product functions. Identity authentication and administration events are retained for 30 days in the customer realms. Container logs have bounded size and file-count rotation. Admin actions and exports have audit records. These records do not amount to a claim that every direct database read or every viewing of customer content has a complete per-record audit trail.

Access to content is limited by purpose and permission to support, service operation/recovery or security/abuse investigation. Exceptional access must have a recorded purpose and authorized operator, with credentials kept outside customer-visible interfaces and ordinary application logs. Personnel and any authorized contractors are subject to the confidentiality requirements in section 5. Changes to staffing or access countries require prior review.

Recovery, monitoring and response

Encrypted backups run daily and maintenance and isolated restore checks are scheduled weekly. Availability checks and a separate backup/lifecycle heartbeat provide alerts, including missing reports. Deletion-worker failures and stale cleanup queues are monitored. A successful health check is not a promise of uninterrupted service. Incident handling covers containment, investigation, preservation of necessary evidence, customer notification without undue delay where required, provider coordination and corrective action. Security reports can be sent privately to security@kortyx.io.

Minimization and customer controls

Customers select capture and should redact unnecessary personal data before transmission. SDK prompt/output capture is configurable; these controls are not a universal detector or scrubber for health, financial, employment or other sensitive information. Product usage analytics uses allowlisted classifications and aggregate measurements, excluding customer prompts, outputs and trace content. Session replay is outside this service release. Authorized export and deletion requests use authority checks and protected delivery rather than disclosure in public support discussions.

Assurance and maintenance

The controls are maintained and reviewed as risks and features change. No certification, independent penetration-test opinion, fixed recovery objective or uptime SLA is represented. Information needed for an Article 28 assessment can be requested under section 12 without disclosure of unrelated customer data, live secrets or exploitable infrastructure configuration.

Core Cloud hosting, databases, identity and consent storage are in Helsinki, Finland, operated on Hetzner infrastructure. Encrypted off-site recovery data uses Cloudflare R2’s EU jurisdiction. Internal staff access for this release is from the EU. Cloudflare edge processing for proxied internal administration and providers’ authorized support/onward processing are assessed separately; those core locations do not constitute an EU-only guarantee for all processing.

The named Subprocessor List is the appointment schedule for customer-content processing. It distinguishes hosting and backup/edge functions from account email and product telemetry. The list version presented with the accepted agreement identifies initial authorization; later additions or replacements use section 7. Customer-appointed application or model endpoints follow Customer instructions and their separately arranged terms, rather than becoming Kortyx appointments solely by configuration.

For a restricted transfer, Kortyx must establish the applicable safeguards before the transfer and provide information on request, with only necessary redactions. A provider’s public DPA describes its offered safeguards; the actual account agreement and covered legal entity determine which instrument applies. EU primary storage alone is not a substitute for that assessment. Any additional destination, contractor or provider must be assessed before access and notified under the relevant procedure.

Section 3.6 adapts the processing-instruction notification concept in section 2.2 of the Common Paper Data Processing Agreement, version 1.1, by Common Paper, Inc., available under CC BY 4.0. The wording, resolution process and preservation of statutory duties have been modified for Kortyx. Common Paper has not endorsed these changes. Its other standard terms, cover-page defaults and international-transfer instruments are not incorporated by this attribution. Preserve this credit with any published version retaining the adaptation.