Data Processing Addendum (DPA)

1. Roles of the Parties (Controller & Processor)

With respect to Personal Data contained within Customer Inputs and Outputs processed through the Zopyr inference gateway, Customer acts as the Data Controller (or Data Processor on behalf of its own customers) and Zopyr acts as the Data Processor (or Sub-Processor).

Zopyr processes Personal Data solely on documented instructions from Customer—namely, routing API requests to the model endpoints specified by Customer’s API parameters.

2. Technical and Organizational Security Measures (TOMs)

Pursuant to Article 32 of the GDPR, Zopyr implements and maintains industry-leading security controls across its infrastructure:

• Zero-Data-Retention hot path: Prompt and completion bodies are processed ephemerally in memory unless opt-in Content Logging is enabled.
• Encryption in transit and at rest: TLS 1.3 for all external and upstream hops; AES-256-GCM envelope encryption for stored secrets and files.
• Strict tenant isolation: Every API key, file, request log, and ledger account is cryptographically and logically scoped to its Organization UUID.
• Immutable audit trail: Every administrative and security-sensitive action is recorded in append-only audit logs.

3. Authorization of Subprocessors

Customer provides general written authorization for Zopyr to engage the upstream AI model providers and infrastructure partners listed on /legal/subprocessors. Customers may restrict which upstream model providers process their requests on a per-call basis using the provider.only and provider.ignore routing parameters.

4. Personal Data Breach Notification & Audits

Zopyr will notify Customer without undue delay (and in any event within 48 hours) after becoming aware of any confirmed Personal Data Breach affecting Customer’s Organization, providing actionable forensic details and remediation steps.