# DATA PROCESSING AGREEMENT — DRAFT TEMPLATE

> **DRAFT — PENDING LEGAL REVIEW. NOT FOR EXECUTION.**
> This template is provided for discussion with your legal counsel. It has not
> been reviewed by a lawyer. Nothing in it is agreed until a finalized version
> is signed by both parties. Timelines marked [PLACEHOLDER] are decisions for
> the parties; none are proposed as final.

Parties: SynaptoSec (operator; Belgian BV in registration — controller
identity per the live Privacy Policy) and the Customer.

## 1. Roles and scope

Customer acts as controller for personal data contained in prompts, tool
results and other content submitted through the API. SynaptoSec processes that
data only to provide the Service (detection verdicts, logging, security) on
the Customer's documented instructions, per GDPR Art. 28(3)(a).

## 2. Instructions

SynaptoSec processes personal data only on the Customer's instructions,
including for transfers to a third country, unless required by Union or
Member State law (Art. 28(3)(b)); SynaptoSec informs the Customer before
processing based on a legal requirement unless that law forbids it.

## 3. Confidentiality

Persons authorized to process the data are bound by confidentiality
obligations. Access is limited by least-privilege roles.

## 4. Security measures (as implemented and verified)

- TLS for data in transit; AES-256-GCM for stored audit reports
- API keys stored only as HMAC-SHA256 hashes with a root-only pepper
- HttpOnly, Secure, SameSite=Lax session cookies; CSRF double-submit
- IP addresses stored as keyed hashes (portal); signed, hash-chained audit trail
- Single-use, 15-minute, browser-bound sign-in links

[PLACEHOLDER: the customer and counsel should confirm whether Art. 32
requires anything beyond the above for the customer's use case.]

## 5. Sub-processors

The current processor list is published at
https://synaptosec.com/legal/subprocessors and includes (as of 2026-10-14):
UpCloud (hosting, NL), NVIDIA (LLM analysis of borderline requests, US),
Google (sign-in; operator notifications via Gmail), GitHub (sign-in).
SynaptoSec gives [PLACEHOLDER: notice period, e.g., 30] days' notice before
adding or replacing a processor; the Customer may object.

[PLACEHOLDER: transfer instruments for US processors — to be finalized.]

## 6. Assistance with data subject rights

SynaptoSec assists the Customer in responding to data subject requests
(access, rectification, erasure, etc.) taking into account the nature of the
processing, within [PLACEHOLDER: response window].

## 7. Breach notification

SynaptoSec notifies the Customer without undue delay after becoming aware of
a personal data breach likely to result in a risk to individuals, with the
information required by Art. 33(3). [PLACEHOLDER: notification window.]

## 8. Deletion and return

On termination, SynaptoSec deletes or returns all personal data processed for
the Customer within [PLACEHOLDER: period], except where storage is required
by law (documented). Logs are subject to the retention schedule published in
the Privacy Policy.

## 9. Audits

SynaptoSec makes available all information necessary to demonstrate compliance
and allows for and contributes to audits, including inspections, mandated by
the Customer or another auditor, at [PLACEHOLDER: frequency/cost terms].

## 10. Liability

[PLACEHOLDER: liability allocation to be negotiated.]

---
Version 0.1-draft — effective upon approval — 2026-10-14
Generated from the verified facts register (docs/legal/FACTS.md).