Data Processing Addendum

1. Scope and acceptance#

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Avonao, Inc., a corporation formed in the State of Delaware, USA (Delaware entity file number 10121895), 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA ("Agined", "we", "us", the "Processor") and the customer that accepted the Terms ("Customer", "you"), each a "party".

• Acceptance. This DPA applies automatically, without signature, when you accept the Terms, and it applies for as long as we process Customer Personal Data. Accepting the Terms is also your signature of the Standard Contractual Clauses and the UK Addendum incorporated in section 11. A countersigned copy is not needed for it to be binding.
• Countersigned copy. An Enterprise customer may ask privacy@agined.com for a copy of this DPA countersigned by us, with its legal name and address in Annex 1. The countersigned copy has the same text as this page on the date it is signed.
• What it covers. It applies to Customer Personal Data, as defined in section 2. It does not apply to personal data for which we are the controller, such as our own website visitors, account and billing administration, the website assistant, and security and abuse records of our own. The Privacy Policy covers those.

2. Definitions#

• "Data Protection Law" means the laws that apply to the processing of Customer Personal Data under the Terms, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom and the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), and United States state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
• "Customer Personal Data" means personal data that you, your users or the people you direct to the Service submit to the Service, or that the Service generates from that use, and that we process on your behalf under the Terms.
• "Service" means the Agined Attestor service as described in the Terms.
• "Sub-processor" means a processor we engage to process Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Sub-processors.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force from 21 March 2022, as amended or replaced by the Information Commissioner.
• "Receipt" means a signed record the Service issues. "Write-once copy" means the hash-only entry of a Receipt of a workspace on the Scale or Enterprise plan, or with the isolation add-on, held in the write-once receipt ledger in that workspace's own database, described in Annex 1, section C. Receipts on the Free, Starter, Pro, Pro+ and Team plans have no Write-once copy.
• "Account owner" means the person whose email address is recorded as the owner of your account or workspace in the dashboard.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, or the equivalent terms in the other Data Protection Law. Where a US state law applies, "controller" includes "business", and "processor" includes "service provider" and "contractor".

3. Roles and instructions#

• Roles. You are the controller of Customer Personal Data, or its processor where you process it for your own customer. In that case you confirm that your instructions, including your engagement of us, are authorised by that controller, and you are our single point of contact for it. We are your processor, or your sub-processor.
• Your instructions. We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country. Your documented instructions are the Terms, this DPA, your use and configuration of the Service, and other written instructions that are consistent with them. An instruction outside these needs our prior written agreement, and may carry a fee we tell you in advance.
• Unlawful instructions. We will tell you without delay if, in our opinion, an instruction infringes Data Protection Law, and we may suspend the affected processing until you confirm or change it.
• Legal requirements. If a law to which we are subject requires us to process Customer Personal Data otherwise than on your instructions, we will tell you of that requirement before processing, unless that law forbids it on important grounds of public interest.
• Your responsibilities. You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving the notices and obtaining the consents the law requires from the people the Service records or serves on your behalf, and for the accuracy and quality of the data you submit. You will not submit special categories of personal data, criminal-offence data or data about children in readable fields of the Service (see Annex 1). You are responsible for the security of your own systems and credentials and for configuring the Service securely.
• Avonao ID. The Service has no sign-in methods of its own: seat holders sign up and sign in only through Avonao ID. Avonao ID collects their email address, name, sign-in methods, security log, country and age confirmation (minimum age 16); the Service receives only the claims it sends (identifier, confirmed email, name, language). Avonao ID is operated by Avonao, Inc. and is an independent controller for its own account data, including sign-up and sign-in data. It is not a sub-processor and is not covered by this DPA for that data.
• Details of the processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in .

4. Our obligations#

We will:

1. process Customer Personal Data only as set out in section 3;
2. confidentiality: ensure that everyone we authorise to process Customer Personal Data is bound by a written duty of confidentiality or a statutory one, and give access only to those who need it to provide, secure or support the Service. Support staff see a workspace only through the time-limited access you grant in the dashboard, which is recorded in your audit log;
3. security: implement the technical and organisational measures in section 7 and Annex 2;
4. respect the conditions for engaging Sub-processors in section 5;
5. assist you as set out in sections 6, 7 and 8;
6. delete or return Customer Personal Data as set out in section 10, and make available information and allow audits as set out in section 9;
7. keep the record of processing activities that Data Protection Law requires of a processor, and cooperate with supervisory authorities on request as that law requires;
8. US state privacy laws: not sell Customer Personal Data or share it for cross-context behavioural advertising; not retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with you; not combine it with personal data we receive from or on behalf of others or collect from our own interactions with a person, except as Data Protection Law permits a service provider or contractor; give it the level of privacy protection that law requires; tell you if we determine that we can no longer meet these obligations; and allow you, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.

5. Sub-processors#

You give us general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA, with their purpose, location, the personal data involved and the transfer safeguards, are listed on the Sub-processors page, which is Annex 3.

• Flow-down and liability. We will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, as Article 28(4) GDPR requires, and we remain fully liable to you for the performance of each Sub-processor's obligations.
• Notice. We will give you at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data, or an existing one changes its processing materially, by updating the Sub-processors page with the new date at the top and emailing the account owner and any address that asked us at privacy@agined.com to be told.
• Objection. You may object on reasonable data protection grounds by writing to privacy@agined.com within those 30 days. We will then work with you in good faith to avoid the problem, for example by not using the new Sub-processor for your data, by changing the configuration or by recommending another way to use the Service. If we cannot resolve the objection within 30 days of receiving it, you may terminate the affected subscription by notice, and we will refund prepaid fees for the period after termination. If you do not object in time, you are taken to have authorised the change.
• Urgent replacement. We may replace a Sub-processor immediately, with the same protections, where needed to protect the Service from an urgent security or continuity risk. We will tell you as soon as we can, and your objection right then applies afterwards.
• Not Sub-processors. Services from which a tool fetches public information (such as DNS resolvers, domain registries, package registries and the public randomness network, listed in section 2.1 of the Sub-processors page) receive no Customer Personal Data from us. The destination of a relayed call or a webhook delivery is chosen by you and receives what you send it; it is your recipient. None of these is a Sub-processor.

6. Assistance#

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations to:

• Respond to data subjects. If a data subject writes to us about Customer Personal Data, we will tell them to ask you, and tell you without undue delay, unless the law requires otherwise. We will not answer the request ourselves except on your instruction. The Service gives you self-service tools to access, export, redact and delete Customer Personal Data: receipt export, deletion and redaction, the record chain and case routes of the record tools, and account and workspace deletion (Data controls, Retention and erasure). We will give further reasonable help on request to privacy@agined.com.
• Handle requests about Receipts. Receipts are signed, append-only records that cannot be edited without breaking their signature. A request to remove personal data from a Receipt is met by redaction or deletion of the stored Receipt; a copy that you or a third party already holds is outside our control.
• Carry out data protection impact assessments and prior consultation of supervisory authorities, by giving you the information we reasonably hold about the Service. The documentation, the Security model, the Receipt Practice Statement and the security pack describe how it works.
• Keep the processing secure and handle Personal Data Breaches, as set out in sections 7 and 8.

Assistance that the Service and its documentation provide is free of charge. We may charge a reasonable fee for other assistance that is not needed because of our breach of this DPA, after telling you the fee in advance.

7. Security#

We implement and maintain technical and organisational measures that ensure a level of security appropriate to the risk, as Article 32 GDPR requires, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons. They include the measures in Annex 2. We may update them as the Service and the threats to it change, provided the update does not reduce the overall level of protection.

You are responsible for using the security features the Service offers, such as narrowly scoped and short-lived keys, IP binding of tokens and roles, and for what you place in readable fields.

8. Personal data breach#

• Notice. We will notify the account owner by email without undue delay and in any case within 72 hours of becoming aware of a Personal Data Breach.
• Content. The notice will, to the extent known, describe the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and to mitigate its possible adverse effects; and a contact point for more information. Where not all of this is known at once, we will provide it in phases, without undue further delay, as we learn it.
• Response. We will take reasonable steps to contain, investigate and remedy the breach, and give you the information we hold that you reasonably need to notify supervisory authorities and data subjects. Where you are the controller, those notices are your responsibility, and we will not notify data subjects or authorities on your behalf about Customer Personal Data unless you instruct us to or the law requires it.
• What is not a breach. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, refused sign-in attempts and denial-of-service attacks that expose no data, are not Personal Data Breaches.
• Our notice, or our response to a breach, is not an admission of fault or liability.

9. Audits#

We will make available to you the information needed to show that we comply with this DPA and Article 28 GDPR. In the first instance we do this through our documentation, the security description in Annex 2 and the security pack, our published Sub-processor list, our Sub-processors' public compliance reports that we are entitled to share, and written answers to a reasonable security questionnaire sent to privacy@agined.com, which we answer within 30 days.

If that information is not enough to show compliance, or a supervisory authority requires it, or a Personal Data Breach has occurred, you may carry out an audit, including an inspection, yourself or through an independent auditor bound by confidentiality, on these terms:

• no more than once in any 12 months, unless a supervisory authority or a Personal Data Breach requires otherwise;
• on at least 30 days' written notice, with the scope, timing and duration agreed in advance;
• at your cost, during business hours, without disrupting the Service and without access to other customers' data or to our other confidential information;
• limited to the systems and records we use to process Customer Personal Data. Audits of Sub-processors are carried out through the reports and audit rights we have under our contracts with them;
• an auditor that competes with us may be refused, in which case you may appoint another. You will give us a copy of the audit report, which is our confidential information.

If an audit finds that we do not comply with this DPA, we will remedy the non-compliance at our own cost without undue delay. Audits under Clause 8.9 of the SCCs are carried out as set out in this section.

10. Return and deletion#

• During the term. You can export your receipts and other data, and delete receipts, workspaces or the account yourself at any time, at no charge, as described in Retention and erasure and on the EU Data Act page. Exporting is how you choose the return of Customer Personal Data under Article 28(3)(g) GDPR; deletion follows as set out below.
• The end of the Service. The provision of the Service ends when you delete your account or workspace. After you schedule account deletion there is a 30-day grace period. Nothing is erased during it, the account keeps working, and you can cancel the deletion or export your data. A paid plan that ends does not end this DPA: the account keeps working on the Free plan.
• Erasure. At the end of the deletion grace period we erase Customer Personal Data held in watches, captures and targets and their history, record chains and the workspace salt, approvers, devices, inbound endpoints and mailboxes, stored third-party secrets, connector data and credentials, key-rotation requests, support tickets and the dashboard assistant's conversations. Operational logs are deleted on their own cycle of up to 30 days. Database recovery copies (Cloudflare D1 Time Travel, the only recovery copies of the databases; we keep no other backup copy) roll off within a further 30 days.
• Retained records. These are retained after the end, and you instruct us accordingly:
  • Receipts stay until the end of your plan's retention window (Annex 1, section C), because they are signed records whose value depends on being kept unchanged for that window. Account deletion does not delete them earlier; you can delete or redact them yourself first.
  • Write-once copy. On the Scale and Enterprise plans and with the isolation add-on, the hash-only entry of each Receipt stays in the write-once receipt ledger for the period in Annex 1, section C, also after the Receipt is deleted, unless the workspace's own database is deleted first when the workspace or account is erased.
  • SBOM escrow. A document you sent to sbom.notarize with escrow turned on is kept for the ten years the receipt states, in your data region, and is not removed when receipts or the workspace are deleted. Escrow is off unless you ask for it in the request.

11. International transfers#

The Service is operated by a United States company. Customer workspace data is stored and processed in the data region you choose for the workspace: on Free, always US West on Cloudflare, with no region choice; on Starter, Pro, Pro+ and Team, one of seven Cloudflare regions; on Scale and Enterprise, an AWS region. The seven Cloudflare regions are US West, US East, Europe Central, Europe West, Europe North, Asia-Pacific and Oceania. The three European regions store data under Cloudflare's EU jurisdiction: Cloudflare keeps it inside the EU and chooses the datacenter. Receipts are customer data. On the Free, Starter, Pro, Pro+ and Team plans they are stored on Cloudflare in the workspace's data region, one of the seven Cloudflare regions: on Free and Starter in the region's shared Cloudflare D1 database, and on Pro, Pro+ and Team in the workspace's own separate store on Cloudflare there, one per workspace, with strict tenant isolation. On the Scale and Enterprise plans, and with the isolation add-on, they are stored in the workspace's own Amazon Aurora database on Amazon Web Services, in the AWS region the workspace chose; when a workspace moves to one of these plans or buys the add-on, its existing receipts are moved into that database, and when it moves back to a plan on Cloudflare D1, they are copied back into the D1 database of its region and checked before the Aurora database is retired after the grace period. Account data, sign-in, the dashboard and the billing records are stored in the region the customer chose at sign-up, which can differ from the data region of a workspace; the account and billing records are stored in the same region. Payments, invoices and tax are handled by Avonao Billing, Avonao's central billing service, in the United States. The public website and documentation are served from the United States and hold no Customer Personal Data. Cloudflare terminates network connections at the location nearest the caller, which can be outside the region; stored data stays in the region. Avonao ID is only an identity provider and holds sign-up and sign-in data in the data region of the member's Avonao ID account. See Data regions and Data and privacy.

Where Customer Personal Data subject to the GDPR, the UK GDPR or the FADP is transferred to us, or by us to a Sub-processor, in a country without an adequacy decision, the transfer is covered as follows.

• EU: the SCCs. The SCCs are incorporated into this DPA by reference and completed as follows:
  • Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer;
  • Clause 7 (docking clause) applies;
  • Clause 9(a): Option 2 (general written authorisation) applies, with the 30-day notice period in section 5. Copies of Sub-processor agreements under Clause 9(c) may have commercial information removed;
  • Clause 11(a): the optional language does not apply;
  • Clause 13: the competent supervisory authority is the one set out in Annex 1, section D;
  • Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland;
  • Clause 18(b): disputes are resolved before the courts of Ireland;
  • Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and the list of Sub-processors by Annex 3.
• United Kingdom: the UK Addendum. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties' details in Annex 1; Table 2 with the SCCs, modules and options selected above; Table 3 with Annexes 1 to 3; and for Table 4, neither party may end the UK Addendum when the Approved Addendum changes. The Mandatory Clauses of the UK Addendum apply, including its rules on governing law and courts and the Information Commissioner as supervisory authority.
• Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" in Clause 18(c) is read so that data subjects in Switzerland can bring claims in their place of habitual residence.

12. Requests from public authorities#

If we receive a legally binding request from a public authority, including a court, for access to Customer Personal Data, we will:

• review the request for its legal basis and scope, and challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful, too broad or in conflict with EU or Member State law;
• tell you before we disclose anything, unless the law forbids it, and in that case use reasonable efforts to obtain a waiver of the prohibition;
• disclose only the minimum the request lawfully requires; and
• keep a record of the requests we receive and our response, which we share with you on request where the law permits.

The measures in section 5 of the EU Data Act page also apply. This section is in addition to Clause 15 of the SCCs.

13. Liability and order of precedence#

• Liability. Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Terms, which apply in aggregate to the Terms and this DPA, except where Data Protection Law or the SCCs do not allow a limitation. Nothing in this DPA limits the rights of data subjects under the SCCs or Data Protection Law, or either party's liability to them.
• Order of precedence. In a conflict on the processing of Customer Personal Data: the SCCs and the UK Addendum (where they apply) prevail, then this DPA, then the Terms, then any other document. A signed Enterprise agreement prevails over this DPA only where it expressly refers to this DPA.

14. Term and changes#

• Term. This DPA takes effect when you accept the Terms, and remains in force for as long as we process Customer Personal Data, including after the Terms end. Sections 6, 9, 10, 12 and 13 survive for as long as we hold any Customer Personal Data.
• Changes. We may update this DPA where needed to comply with Data Protection Law, to follow guidance or a decision of a supervisory authority or a court, to reflect a new or updated transfer mechanism, or to reflect changes to the Service, provided the update does not reduce the overall protection of Customer Personal Data. We tell account owners about material changes by email at least 30 days before they take effect, as in the Terms. We will not change the SCCs or the UK Addendum other than by adopting a version the European Commission or the Information Commissioner issues.

15. General#

• Governing law and venue. This DPA is governed by the law and venue that govern the Terms, except where the SCCs or the UK Addendum provide otherwise.
• Contact points. For the Processor, questions and notices about this DPA go to privacy@agined.com. For the Customer, we use the account owner's email address, which you keep up to date in the dashboard.
• Representative. Our representative and data protection officer in the European Union under Article 27 GDPR is NUICORN, Chausseestraße 86, 10115 Berlin, Germany. It can be contacted, and so can we, through privacy@agined.com on all matters about this DPA. We have no other representative.
• Severability. If a provision of this DPA is invalid or unenforceable, the rest of it remains in force, and the provision is read so as to give effect, as far as the law allows, to its intent.

Annex 1: Description of the processing#

This Annex is also Annex I of the SCCs.

A. List of parties#

Data exporter

• Name and address: the Customer, as named in its account and billing details.
• Contact person: the account owner, at the email address in the dashboard.
• Activities relevant to the data transferred: use of the Agined Attestor service under the Terms.
• Role: controller (Module Two) or processor (Module Three).
• Signature and date: by accepting the Terms, on the date of acceptance.

Data importer

• Name and address: Avonao, Inc., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (legal address). Mailing address, for general correspondence only: Avonao, Inc. • 2261 Market Street PMB 10671, San Francisco, CA, 94114, United States. Legal correspondence, including notices under this Addendum, must be sent to the legal address in Delaware.
• Contact: privacy@agined.com. EU representative: NUICORN, Chausseestraße 86, 10115 Berlin, Germany.
• Activities relevant to the data transferred: provision of the Agined Attestor service.
• Role: processor.
• Signature and date: by making the Service available under the Terms, on the date the Customer accepts them.

B. Description of the processing and transfer#

Categories of personal data, by kind of data:

What each tool stores is described in Data and privacy and in each tool's documentation:

C. Retention#

D. Competent supervisory authority#

The supervisory authority of the EU Member State in which the Customer is established. Where the Customer is not established in the EU but falls within Article 3(2) GDPR and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which that representative is established. Where the Customer has not had to appoint one, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located. For the UK Addendum, the Information Commissioner; for Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex 2: Technical and organisational measures#

This Annex is also Annex II of the SCCs. The measures describe how the Service works today. Detail is in the Security model and the security pack.

• Authentication and credentials. Every request carries a credential that the gateway resolves to a workspace before any tool code runs. API keys, personal access tokens, and session tokens are stored only as SHA-256 hashes, and secrets are compared in constant time. Keys can be scoped to read, write or manage groups and to specific tools, expire, be rotated with a grace period, or be revoked with effect on the next request. Tokens can be bound to an IP range. The Service holds no passwords and no sign-in methods: sign-up and sign-in happen at Avonao ID, which sends the Service OpenID Connect claims. Dashboard sessions are HttpOnly, Secure and SameSite=Lax, with a 12-hour absolute lifetime and a 30-minute idle timeout.
• Roles. Organisation and workspace roles limit who can manage keys, members, billing and data.
• Tenancy isolation. The gateway, not the caller, decides the workspace. It forwards the workspace to the regional service in headers covered by a signature that only our services can produce, and the service rejects requests without a valid one. Every read and write carries the workspace id. Separation is logical, by workspace id on every query, in a regional database. A regional service reads only its own region's database, and a call is never answered from another region.
• Integrity of receipts. Receipts are Ed25519 signatures over RFC 8785 canonical JSON and are stored in a table whose database triggers reject updates and deletes; deletion passes only through audited routes. Receipts, and everything recorded about them, are stored on Cloudflare in the workspace's data region on the Free, Starter, Pro, Pro+ and Team plans (in the region's shared Cloudflare D1 database on Free and Starter; on Pro, Pro+ and Team in the workspace's own separate store on Cloudflare, one per workspace, with strict tenant isolation), and on the Scale and Enterprise plans and with the isolation add-on in the workspace's own Amazon Aurora database, in the AWS region the workspace chose. In that Aurora database, a hash of each receipt is also filed hourly in the write-once receipt ledger, a batch row in the same Amazon Aurora database, under a Merkle root signed with the region's receipt key; database triggers refuse any change to that copy, and refuse its deletion before its retain-until date. Chained records name the previous receipt and the hash of its body, so a record cannot be removed from the middle of a chain unnoticed.

Annex 3: Sub-processors#

The Sub-processors are those listed on the Sub-processors page, which sets out each one's purpose, location, the personal data involved and the transfer safeguards, together with the public sources the tools query, which are not Sub-processors. The list in force on the date of this DPA, and each change notified under section 5, forms this Annex. On the date of this DPA, the Sub-processors that process Customer Personal Data in the Service include Cloudflare, Inc. (hosting, databases, storage, email delivery and inbound mail), Amazon Web Services EMEA SARL and Amazon Web Services, Inc. (Amazon Aurora: customer data, including receipts, for workspaces on Scale, Enterprise or the isolation add-on, in the AWS region the workspace chose), Resend, Inc. (fallback transactional email) and Anthropic, PBC (the dashboard assistant, which reads workspace records only for workspaces in the US data regions). Providers on the page that process only personal data for which we are the controller, such as website analytics and fonts, are listed there for transparency.