Data processing terms (GDPR Article 28)
These terms apply when you send us data for a pilot, an audit or a re-test and that data may contain personal data. They form part of our terms of service. On request we sign them as a separate agreement, filled in for your engagement.
1. Roles
You are the controller. We (the legal entity named in the legal notice of our terms) are the processor. We process personal data only to perform the engagement you ordered and only on your documented instructions, which are these terms and the written scope of the engagement.
2. What we process
- Subject matter and purpose: running your tasks through AI models to measure cost and quality, and writing the report.
- Data: the tasks, expected answers, configurations and model outputs you send or that the run produces. We ask for anonymised or synthetic data; personal data is processed only if you tell us in advance that it is unavoidable.
- Data subjects: as described by you in the scope (for example, your customers or staff appearing in example tasks).
- Duration: the engagement plus up to 14 days, then deletion (section 8).
3. Confidentiality
Only the people who perform your engagement can access your data, and they are bound by confidentiality. We do not use your data for any other client, for public reports, or to train any model.
4. Security measures
- A separate working environment and a separate API workspace per client; your data is never stored with another client's data.
- Encrypted storage, multi-factor authentication on all accounts that can reach client data, least-privilege access.
- API keys only in the process environment, never written to files, logs or code repositories. Client data is never committed to a code repository.
- Logs keep run metadata (time, model, tokens, cost, pass/fail); task content is kept only as long as the engagement needs it.
5. Sub-processors
We use only the sub-processors needed for your engagement and name them in the written scope. Our current list:
| Sub-processor | Purpose | Location | Retention (provider terms) |
|---|---|---|---|
| Anthropic (Claude API) | Running tasks on Claude models | United States | No training on API data by default; deleted within 30 days unless zero retention is agreed |
| OpenAI (API) | Running tasks on OpenAI models, only if in scope | United States (EU data residency where offered) | No training on API data by default; per OpenAI API data terms |
| Google (Gemini API / Vertex AI) | Running tasks on Gemini models, only if in scope | Per selected region (EU regions available on Vertex AI) | Per Google Cloud terms for paid services |
| Mistral AI | Running tasks on Mistral models, only if in scope | European Union | Per Mistral API terms |
| EU cloud server (named in the scope) | Isolated working environment for your engagement | European Union | Deleted with your data (section 8) |
We inform you before adding or replacing a sub-processor for your engagement, and you may object. Transfers outside the EEA rely on the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework, as stated in their terms.
6. Your rights and our assistance
We help you answer data subject requests and meet your obligations on security, breach notification and impact assessments, to the extent that relates to our processing. We give you the information needed to show compliance with these terms and allow audits by you or an auditor you appoint, with reasonable notice and confidentiality.
7. Breaches
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.
8. Deletion
We delete all your data, including copies in the working environment, within 14 days of delivering the report (or of the end of a re-test subscription), and confirm deletion in writing. We keep only aggregate numbers without personal data, and invoices as accounting law requires.
9. California and other US state laws
Where US state privacy laws apply (for example the CCPA/CPRA), we act as your service provider: we do not sell or share personal information, and we use it only for the business purpose of the engagement.
Version 1.0. A template for business clients; terms are agreed per engagement. Questions: hello@agenttrustapi.com.