Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between EpochCore LLC ("Processor") and the Customer ("Controller") and governs Processor's processing of Personal Data on behalf of Controller in connection with the Envelope service (the "Service") as required by Article 28 of Regulation (EU) 2016/679 ("GDPR") and equivalent UK / Swiss law.

1. Definitions

"Personal Data", "process", "Controller", "Processor", "Sub-processor", and "Data Subject" have the meanings given in the GDPR. "SCCs" means the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller-to-processor).

2. Subject matter, duration, nature and purpose

• Subject matter: Processor's processing of Personal Data submitted to the Service by or on behalf of Controller for the purpose of producing hybrid-signed, chain-anchored envelopes for AI agent decisions.
• Duration: the term of the underlying agreement, plus any post-termination period required to return or delete Personal Data.
• Nature and purpose: hashing, signing, chain-anchoring, and storing envelope metadata associated with AI agent decisions submitted by Controller.

3. Types of Personal Data and categories of Data Subjects

• Types of Personal Data: contact details (Controller's authorized users); operational metadata associated with envelopes (agent identifiers, timestamps, decision hashes); to the extent Personal Data is contained in a decision payload submitted by Controller, the hash of that payload (not the plaintext unless payload retention is explicitly enabled).
• Categories of Data Subjects: Controller's authorized personnel; Controller's end users (where Controller submits content concerning them).

4. Obligations of the Processor

• Process Personal Data only on documented instructions from the Controller, including the underlying agreement and this DPA.
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
• Implement technical and organizational measures described in the Annex below.
• Assist the Controller, taking into account the nature of the processing, in fulfilling its obligations to respond to Data Subject rights requests.
• Assist the Controller in ensuring compliance with Articles 32 to 36 of the GDPR.
• At the choice of the Controller, delete or return Personal Data at end of provision of services, save where retention is required by law (e.g., SEC 17a-4 retention for sealed records).
• Make available all information necessary to demonstrate compliance and allow for audits as set out in Section 8.

5. Sub-processors

Controller authorizes Processor to engage Sub-processors. The current Sub-processors are:

• Cloudflare, Inc. — edge compute, DNS, request termination (United States).
• Resend, Inc. — transactional email (United States).
• Stripe, Inc. — payment processing (United States).

Processor will provide Controller with at least 30 days' prior notice of new Sub-processors via email. Controller may object on reasonable grounds related to data protection.

6. International transfers

Where Personal Data of EEA, UK, or Swiss Data Subjects is transferred outside an adequate jurisdiction, the SCCs (Module 2) are incorporated by reference and apply between Controller (as data exporter) and Processor (as data importer). Where the UK Addendum applies, it is incorporated by reference. For Swiss data, the SCCs are deemed adapted in accordance with FDPIC guidance.

7. Personal Data breach

Processor will notify Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data breach affecting Controller's Personal Data, with the information required by Article 33(3) GDPR insofar as it is then available.

8. Audit rights

Controller may, no more than once in any 12-month period and subject to reasonable advance notice, audit Processor's compliance with this DPA. Audits may be conducted by Controller or by an independent third-party auditor bound by appropriate confidentiality obligations. Processor's responses to audit, certification, and questionnaire programs (e.g., a SIG-Lite) satisfy this requirement absent reasonable cause to require more.

9. Liability and order of precedence

In the event of a conflict between this DPA and the underlying agreement, this DPA prevails as to the subject matter of Article 28 GDPR. Liability under this DPA is subject to the liability cap in the underlying agreement.

10. Term and termination

This DPA takes effect on the effective date of the underlying agreement and continues for so long as Processor processes Personal Data on behalf of Controller. Within 90 days of termination, Processor will at Controller's option return or delete Personal Data, save where retention is required by law.

Annex — Technical and organizational measures

• Cryptography: Hybrid Ed25519 + ML-DSA-65 (NIST FIPS 204) signing. SHA-256 decision hashing. Keys held under FIPS-aligned procedures.
• Access control: Least-privilege role assignments. Tenant-scoped API keys.
• Logging and monitoring: Tamper-evident audit logs. Server logs retained 30 days.
• Encryption in transit and at rest: TLS 1.3 for all customer-facing endpoints. Cloudflare-managed at-rest encryption.
• Backup and recovery: Chain-anchored envelope metadata replicated across Cloudflare regions.
• Personnel: Confidentiality obligations in employment agreements.
• Incident response: 72-hour breach-notification target; escalation to security@epochcoreqcs.com.
• Vendor management: Sub-processor diligence including SOC2 / ISO 27001 reports where available.

Signatures

By executing the underlying agreement, Controller and Processor are deemed to have executed this DPA. A counter-signed standalone copy is available on request to privacy@epochcoreqcs.com.