Data Processing Agreement

"Controller" means the entity that determines the purposes and means of processing Personal Data (the Customer).

"Processor" means the entity that processes Personal Data on behalf of the Controller (Ciphyrs).

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, national identification numbers (Aadhaar, PAN, passport), IP addresses, financial data, and health data.

"Processing" means any operation performed on Personal Data, including detection, masking, tokenization, encryption, storage, retrieval, restoration, and deletion.

"Sub-processor" means any third party engaged by Ciphyrs to process Personal Data on behalf of the Customer.

"Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.

"Security Incident" means any unauthorized access to, or disclosure of, Personal Data processed by Ciphyrs on behalf of the Customer.

Ciphyrs processes Personal Data solely for the purpose of providing the PII Shield service to the Customer, which includes:

(a) Detecting personally identifiable information (PII) in text submitted via the API;

(b) Replacing detected PII with reversible cryptographic tokens;

(c) Storing original PII values in an encrypted vault with a time-limited TTL;

(d) Restoring original PII values when requested with a valid session token;

(e) Generating analytics and audit logs. Audit log entries record entity types, counts and identifiers rather than PII values. End-user identifiers on security detections and guard decisions are stored as a keyed hash (HMAC) under a key derived separately for each tenant; the actor label on an approval or tool call is stored as received and is removed by a data-subject erasure.

Ciphyrs shall not process Personal Data for any purpose other than providing the Service as described in this DPA and the Terms of Service.

Ciphyrs processes Personal Data for the duration of the Customer's subscription to the Service.

PII values stored in the vault are automatically and permanently deleted upon expiration of the vault TTL (1 to 24 hours, configurable per tenant; default 24 hours). The TTL bounds every copy of a value: values written through the API, the MCP connector and asynchronous scans, and the copy kept for a pending approval. The one exception is review retention: a Customer that enables it keeps a closed session's values for the review window it chose (at most 7 days). Asynchronous scan bodies are kept at most 1 hour and deleted when the scan finishes.

Detections, logs, approval argument snapshots, PII detection events and the SIEM export log are retained for per-tenant periods set in days. Tenants created after the retention controls were introduced default to 365 days for detections, 90 days for logs, 90 days for approval argument snapshots, 365 days for PII detection events and 365 days for the SIEM export log; tenants that existed before keep their data until they set a period. A SIEM export log entry is kept while the detection it records is held.

Upon termination of the Customer's subscription, all Personal Data in the vault is deleted within 30 days. Anonymized audit logs (which contain no Personal Data) may be retained for compliance purposes.

Ciphyrs shall:

(a) Process Personal Data only on documented instructions from the Customer, unless required by applicable law;

(b) Ensure that persons authorized to process Personal Data have committed to confidentiality;

(c) Implement and maintain appropriate technical and organizational security measures as described in Schedule 1;

(d) Not engage any Sub-processor without prior written consent of the Customer (see Section 6);

(e) Assist the Customer in responding to Data Subject requests (access, erasure, portability) within the capability of the Service;

(f) Assist the Customer in ensuring compliance with security, breach notification, and impact assessment obligations;

(g) At the Customer's choice, delete or return all Personal Data upon termination of the Service;

(h) Make available all information necessary to demonstrate compliance with this DPA and allow for audits.

The Customer shall:

(a) Ensure that there is a lawful basis for the processing of Personal Data submitted to Ciphyrs;

(b) Ensure that Data Subjects have been informed about the use of Ciphyrs as a data processor;

(c) Be responsible for the accuracy, quality, and legality of Personal Data submitted to the Service;

(d) Comply with all applicable data protection laws, including GDPR, DPDP Act 2023, and sector-specific regulations.

Ciphyrs uses the following Sub-processors to provide the Service:

The compliance report (/v1/compliance/report) lists the sub-processors configured for the Customer, including evaluation models the Customer selected.

Ciphyrs shall notify the Customer at least 30 days before engaging any new Sub-processor. The Customer may object to a new Sub-processor within 14 days of notification. If the objection is not resolved, the Customer may terminate the affected Service.

Ciphyrs shall impose equivalent data protection obligations on all Sub-processors via written contracts.

Ciphyrs processes Personal Data in the Customer's selected data residency region. The available regions are:

(a) India — Mumbai (asia-south1): Meets RBI data localization and DPDP Act requirements;

(b) European Union — Netherlands (europe-west4): Meets GDPR data residency requirements;

(c) United States — Iowa (us-central1): For US-based organizations.

Personal Data is not transferred to any country outside the selected region unless the Customer explicitly configures cross-region features. Where transfers occur, Ciphyrs relies on Standard Contractual Clauses (SCCs) or equivalent legal safeguards.

Ciphyrs implements the following technical and organizational measures to protect Personal Data:

(a) Encryption at rest: AES-256-GCM for all PII vault entries, bound to the tenant and the key they are stored under;

(b) Encryption in transit: TLS 1.3 for all API communications;

(c) Access control: API key authentication, multi-tenant Row-Level Security (PostgreSQL RLS);

(d) Infrastructure security: Private VPC networking, GKE Workload Identity, no static credentials;

(e) Minimised logging: application logs are designed to contain entity types and token IDs rather than PII values. Telemetry the Customer sends with masking off, or with raw capture enabled, is stored as received and shown only to the Customer's owners and admins;

(f) Mandatory vault TTL: PII is automatically and permanently deleted when the TTL expires;

(g) Key management: field-encryption keys are held in Google Cloud Secret Manager, versioned and rotatable — stored credentials are re-encrypted under the new key, and values in the in-memory vault are not re-encrypted but expire by their TTL; the key that indexes vault lookups and the key that hashes principal identifiers are separate from the field-encryption keys and stay stable across rotations; principal identifiers are hashed with a key derived separately for each tenant;

(h) Monitoring: Real-time anomaly detection, automated alerting, Security Command Center;

(i) Incident response: Documented process with <72 hour notification commitment.

Full details are available at https://www.ciphyrs.com/security.

Ciphyrs shall notify the Customer of any confirmed Security Incident without undue delay and in any event within 72 hours of becoming aware of the incident.

The notification shall include:

(a) The nature of the Security Incident, including the categories and approximate number of affected Data Subjects;

(b) The likely consequences of the Security Incident;

(c) The measures taken or proposed to address the Security Incident;

(d) The name and contact details of the Ciphyrs data protection contact.

Ciphyrs shall cooperate with the Customer and provide all reasonable assistance in investigating and remediating the incident.

Ciphyrs shall assist the Customer in fulfilling Data Subject requests, including:

(a) Right of access — The Customer can retrieve vault contents for a specific session via the API, and GET /v1/compliance/data-subject/{id} reports, per table, what is held about a data subject (counts, never content);

(b) Right to erasure — Vault TTL provides automatic deletion. DELETE /v1/compliance/data-subject/{id} (owner or admin) erases a data subject's rows in every table that holds them — content overwritten, the subject link removed — and their vault, review and approval copies; it runs in batches and can be resumed. Rows that only share a conversation with the subject are listed for review rather than erased; records the Service cannot alter (the append-only incident timeline and hash-chained audit logs) and recipients the data was already sent to (SIEM targets, ITSM tickets) are reported to the Customer;

(c) Right to data portability — Compliance reports can be exported via the /v1/metrics/compliance-report endpoint;

(d) Right to restriction — The Customer can revoke API keys to stop further processing immediately.

Ciphyrs shall respond to Data Subject requests forwarded by the Customer within 10 business days.

The Customer or an independent third-party auditor appointed by the Customer may audit Ciphyrs' compliance with this DPA.

Audits shall be conducted with reasonable prior notice (minimum 30 days) and during normal business hours.

Ciphyrs shall make available all information necessary to demonstrate compliance, including security documentation, penetration test results, and infrastructure configuration evidence.

Enterprise customers may request a SOC 2 Type II report or ISO 27001 certification evidence as an alternative to an on-site audit.

This DPA shall remain in effect for the duration of the Customer's subscription to the Service.

Upon termination, Ciphyrs shall:

(a) Cease all processing of Personal Data on behalf of the Customer;

(b) Delete all Personal Data from the vault within 30 days;

(c) Provide written confirmation of deletion upon request.

Sections 4(h), 8, 9, and 11 shall survive termination of this DPA.

This DPA shall be governed by:

(a) For Customers located in the European Economic Area: the laws of the Republic of Ireland;

(b) For Customers located in India: the laws of the Republic of India, with exclusive jurisdiction of the courts of Bengaluru, Karnataka;

(c) For all other Customers: the laws of the Republic of India.

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.