Data Processing Agreement

DRAFT — PENDING LEGAL REVIEW. This text is not yet in force. It was prepared from a verified facts register (docs/legal/FACTS.md) and must be reviewed by a qualified lawyer before it takes effect.

Version 0.1-draftEffective date 2026-10-14 (upon approval)ChangelogOperator: SynaptoSec · Antwerpen (Antwerp), Belgium

DRAFT summary — incorporated into the Terms of Service once finalized

Download the full draft template (Markdown, for your lawyer to finalize):DPA draft template (.md)

1. Parties

Controller: The customer (name, address, contact).

Processor: SynaptoSec, operating from Antwerpen, Belgium (BV registration in progress).

2. Subject matter

Processing of personal data for the purpose of scanning API requests and training datasets for security threats (prompt injection, tool injection, MCP poisoning, memory poisoning, data leakage, and backdoor detection).

3. Duration

This DPA is effective for the duration of the Service subscription or customer agreement.

4. Nature and purpose of processing

Processing is strictly limited to security threat detection. No processing for marketing, profiling, resale, or model training.

5. Type of personal data

Content: May include PII in prompts, tool inputs, or responses. Handling and retention of content is covered by our privacy documentation (statement being finalized).
Metadata: timestamps, endpoints, verdict, latency, IP addresses.
Account data: email, name, company name, billing records.

6. Categories of data subjects

Customer's end users
Customer's employees and contractors

7. Processor obligations (Art. 28(3))

The Processor shall:

(a) Process personal data only on documented instructions from the Controller.
(b) Ensure that persons authorized to process the data are bound by confidentiality obligations.
(c) Implement all security measures required by Art. 32 (see the security page).
(d) Respect the conditions for engaging sub-processors (Art. 28(2) and 28(4)).
(e) Assist the Controller in responding to data subject requests.
(f) Assist the Controller in ensuring compliance with Art. 32–36 (security, breach notification, DPIA).
(g) Delete or return all personal data at the end of the provision of services.
(h) Make available all information necessary to demonstrate compliance and allow audits.

8. Sub-processors

The Processor engages sub-processors listed at . The Controller is notified 30 days before any change.

9. International transfers

No transfers outside the EEA occur without SCCs or an adequacy decision. Standard Contractual Clauses (SCCs) are incorporated by reference.

10. Liability

The Processor is liable for GDPR violations caused by its processing. Total liability is capped at the amount paid by the Controller in the 12 months preceding the claim.

11. Termination

Upon termination, personal data is deleted within 30 days. A certificate of deletion is available on request.

12. Signatures

Both parties sign. Electronic signature via DocuSign, Adobe Sign, or qualified electronic signature (QES) under eIDAS Regulation (EU) No 910/2014 is accepted.

Data Processing Agreement (DPA)