Data Processing Agreement

1. Definitions

"Data Protection Laws" means the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Australian Privacy Act 1988, as they apply. "Customer Personal Data" means personal data Archon processes on Customer's behalf in providing the Service. "Subprocessor" means a third party Archon engages to process Customer Personal Data. "Customer-Directed Service" means a service Customer connects or selects, such as its own AI model keys, code hosts, cloud accounts, integrations and MCP servers. Other terms (controller, processor, data subject, personal data breach, Data Fiduciary, Data Processor) have the meanings given in Data Protection Laws.

2. Roles and instructions

• Customer is the controller (or Data Fiduciary) and Archon the processor (or Data Processor) of Customer Personal Data. If Customer is a processor, Archon is its subprocessor.
• Archon processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, Customer's configuration of the Service (agent autonomy modes, tool rules, connections, approvals) and its requests in the product, unless law requires otherwise; Archon will then tell Customer unless the law forbids it. Archon will tell Customer if it believes an instruction breaks Data Protection Laws.
• Archon is a separate controller for account administration, billing, security of its own service and legal compliance, as described in the Privacy Policy.
• Customer is responsible for the lawfulness of its instructions and data and for its choice and use of Customer-Directed Services, which are not Archon Subprocessors. A zero-retention setting on an AI provider does not cover tools or MCP servers its agent calls.
• CCPA: Archon is a service provider and will not sell or share Customer Personal Data, retain, use or disclose it outside the business purpose of providing the Service, or combine it with other data except as the CCPA allows.

3. Archon's obligations

• Make sure everyone authorised to process Customer Personal Data is bound by confidentiality.
• Keep the technical and organisational measures in Annex 2 (GDPR art. 32), which Archon may improve but not materially weaken.
• Help Customer answer data subject requests through the Service (export, correction, deletion) and otherwise on request.
• Help Customer with security, breach notification, data protection impact assessments and prior consultation (GDPR arts. 32 to 36), given the information Archon has.
• Not use Customer Personal Data to train AI models.

4. Subprocessors

• Customer authorises the Subprocessors listed on the Subprocessors page on the date Customer accepts this DPA.
• Archon gives at least 30 days' notice before adding or replacing a Subprocessor, by email to subscribed customers and by updating that page. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may end the affected service and receive a pro-rata refund of prepaid fees for it.
• Archon binds each Subprocessor to data protection terms no less protective than this DPA and remains responsible for its Subprocessors.

5. International transfers

• For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, with the notice in section 4); the optional language in Clause 11 does not apply; Clauses 17 and 18: the law and courts of Ireland. Annexes I to III of the Clauses are completed by Annexes 1 to 3 below.
• For the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner (version B1.0, in force 21 March 2022) applies, with Table 1 completed by the parties' details, Table 2 by the modules above, Table 3 by Annexes 1 to 3, and either party may end the Addendum as its Section 19 allows.
• For Switzerland, the Clauses apply with references to the GDPR read as the Swiss FADP and the Federal Data Protection and Information Commissioner as the competent authority.
• Archon will provide information Customer reasonably needs for a transfer impact assessment.

6. Personal data breaches

Archon will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, so Customer can meet its own deadlines (72 hours to the supervisory authority under GDPR art. 33; the Data Protection Board of India and affected Data Principals under the DPDP Act; the Notifiable Data Breaches scheme in Australia). The notice will describe, as far as known, the nature of the breach, the categories and approximate numbers of people and records, likely consequences, measures taken or proposed, and a contact. Information may be given in stages. Notice is not an admission of fault.

7. Information and audits

On request Archon provides its current security overview, Subprocessor list and, when available, penetration test summaries and independent audit reports. Archon does not currently hold a SOC 2 report or ISO 27001 certificate. If that information is not enough to show compliance, Customer may audit once a year on 30 days' notice, during business hours, at its own cost and under confidentiality, itself or through an independent auditor who is not an Archon competitor, or more often if a supervisory authority requires it.

8. Return and deletion

Customer can export and delete its data in the Service at any time. When the Service ends, Archon keeps Customer Personal Data available for export for 30 days, then deletes it from production systems within a further 30 days and from backups within [backup retention period], unless law requires Archon to keep it, in which case it stays protected and is used for nothing else. On request Archon confirms deletion in writing.

9. India (DPDP Act)

Where Customer is a Data Fiduciary, Archon processes personal data only under this contract and on Customer's instructions (s. 8(2)), keeps reasonable security safeguards (s. 8(5)), tells Customer of any personal data breach so it can notify the Board and Data Principals (s. 8(6) and the DPDP Rules, 2025), erases data on Customer's instruction (s. 8(7)), and helps Customer with Data Principal rights and grievances.

10. Acceptance, term and precedence

This DPA forms part of the Terms of Service (the "Agreement") between Customer and Archon and applies automatically whenever Archon processes Customer Personal Data subject to Data Protection Laws. It lasts as long as Archon does so. Liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the Clauses forbid it. For data protection matters this DPA prevails over the Agreement, and the Clauses prevail over both.

For a countersigned copy, email legal@joinarchon.com with your organisation's legal name, address and contact person.

11. Annex 1: Description of processing

12. Annex 2: Technical and organisational measures

• Access: role-based permissions enforced on the server and failing closed; agents are separate principals that cannot approve their own high-impact actions; optional two-factor sign-in, and single sign-on and SCIM on the Team plan.
• Authentication: bcrypt password hashes; short-lived access tokens; refresh and API tokens stored only as hashes; HttpOnly, Secure session cookies.
• Encryption: TLS in transit; AES-256-GCM application encryption for model keys, integration tokens, environment variables, two-factor secrets and infrastructure state.
• Isolation: hosted agent containers run as non-root with read-only file systems, no capabilities and egress only through a filtering proxy; customer model endpoints are checked against server-side request forgery.
• Logging: a hash-chained audit log of human and agent actions, kept at least 365 days, with export.
• Development: secret scanning, static analysis, dependency audits and tests on every change; pinned dependencies and base images.
• Incidents: a documented incident response process with severity levels and notification timelines.
• Availability and backups: [describe backup, restore testing and recovery objectives once in place].

13. Annex 3: Subprocessors

As listed on the Subprocessors page on the date of acceptance.