Data Processing Agreement

Every Vindex customer can have a signed DPA, on any plan. We send it, you review and sign, we countersign, and a copy stays with your account. It is not a click-through document.

What it covers

• Roles: you are the controller of your users' prompts and ids; Vindex is your processor.
• Scope: prompt text and the metadata you send, processed only to return, explain and log decisions against your policy.
• Sub-processors: hosting and payments named; the screening-engine, email and identity providers described by category and named in the annex. 30 days' notice before any change.
• Security: encryption in transit and at rest, least-privilege access, audit logging, prompt redaction for minors blocks with an audited reveal.
• Breach notice within 72 hours. Deletion on termination. Standard Contractual Clauses for transfers out of the EU and UK.
• No training on your data. Retention per your plan.

Usually back to you within one business day. Questions: hello@getvindex.com.