Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between the customer using Pseudora ("Controller") and the provider of the Pseudora service ("Processor"): [Ragione sociale / Titolare], VAT no. [P.IVA], [Indirizzo]. It supplements the Terms of Service and applies whenever Processor processes personal data on Controller's behalf. If this DPA and the Terms conflict on data protection, this DPA prevails.

Account, billing and website data that Processor processes for its own purposes are covered by the Privacy Policy, not by this DPA.

2. Subject matter, nature and purpose

Processor detects personal data in text and documents that Controller submits through the Pseudora web app, the browser and VS Code extensions, the API and the SDKs, and replaces it with placeholders, realistic substitutes or redactions. Where Controller asks for it, Processor keeps an encrypted mapping that lets Controller restore the original values (de-anonymization). Processor processes personal data only to provide this service.

• Documents (Documents web app, playground File tab) are processed in memory only and are never written to the database, to disk or to logs. The job is deleted as soon as the result is delivered, or after 15 minutes at most if it is abandoned.
• Text via the API: pseudonymization mappings are stored encrypted with a per-tenant key and expire after the TTL that Controller configures (1 hour by default). With dry_run no mapping is stored.
• Metadata: usage and audit records (sizes, number and types of entities, duration) contain no submitted text.

3. Duration

This DPA applies for as long as Processor processes personal data on Controller's behalf under the Terms of Service, and ends once that data has been deleted or returned under section 12.

4. Categories of data subjects and personal data

Data subjects: any natural person whose personal data appears in the content Controller submits, for example Controller's clients, employees, patients, counterparties or correspondents.

Personal data: any personal data contained in that content, such as names, contact details, national identifiers (e.g. tax codes), bank and payment details, addresses, dates and free text. The content may include special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) if Controller chooses to submit it. Controller decides what to submit; Processor does not require any of these categories.

5. Controller obligations

Controller warrants that it has a lawful basis for the personal data it submits and for instructing Processor to process it, and that its instructions comply with applicable data protection law. Controller is responsible for configuring retention, access and integrations in line with its own policies.

6. Processor obligations

• Process personal data only on Controller's documented instructions, including with regard to international transfers, unless Union or Member State law requires otherwise; in that case Processor informs Controller beforehand unless the law forbids it.
• Inform Controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
• Ensure that every person authorised to process the personal data is bound by confidentiality.
• Implement the technical and organisational measures described in Annex 1 (Art. 32 GDPR).
• Respect the conditions for engaging sub-processors in section 7.
• Assist Controller with data subject requests (section 9) and with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Processor.
• Delete or return personal data at the end of the service (section 12).
• Make available the information needed to demonstrate compliance with Article 28 GDPR and allow audits (section 11).

7. Sub-processors

Controller gives Processor general authorisation to engage sub-processors. The current list is in Annex 2 and on the Security page. Processor gives at least 30 days' notice by email to the account owner, and updates the list, before adding or replacing a sub-processor. Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Controller may terminate the affected service before the change takes effect.

Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and remains liable to Controller for their performance.

8. International transfers

The application, the detection engine and the database are hosted in a data centre in the European Union. Some sub-processors in Annex 2 are established in, or use infrastructure in, countries outside the EU/EEA (in particular the United States). For those transfers Processor relies on the EU-US Data Privacy Framework adequacy decision where the recipient is certified, and/or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, as provided in that sub-processor's terms. Processor does not otherwise transfer personal data outside the EU/EEA.

9. Data subject rights

Processor forwards to Controller, without undue delay, any request it receives directly from a data subject and does not answer it unless Controller instructs it to. The console lets Controller configure retention and export or erase the tenant's data; where these tools are not enough, Processor assists Controller on request.

10. Personal data breaches

Processor notifies Controller of any personal data breach affecting data processed under this DPA without undue delay and in any case within 48 hours of becoming aware of it. The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Processor provides further information in phases as it becomes available and assists Controller with its notifications under Articles 33 and 34 GDPR.

11. Audits

Processor makes available this DPA, the Security page and, on reasonable written request no more than once a year, written answers to Controller's security questionnaire. Where this documentation is not enough to demonstrate compliance, or where a supervisory authority requires it, Controller (or an independent auditor bound by confidentiality) may carry out an audit with at least 30 days' notice, during business hours and without disrupting the service. Each party bears its own costs. At the date of this DPA, Processor has not undergone any external security audit or attestation.

12. Deletion or return at the end of the service

Controller can export and erase its tenant's data from the console at any time. When the service ends, Processor deletes the remaining personal data processed on Controller's behalf within 30 days, unless Union or Member State law requires it to be kept. Copies in database backups remain encrypted where the source data was encrypted, are never restored for any other purpose, and are removed when those backups are deleted.

13. Acceptance and contact

Accepting the Terms of Service constitutes agreement to this DPA. To request a signed copy or to ask questions about this DPA, contact [email protected]. Security reports: [email protected].

Annex 1 — Technical and organisational measures

A summary of the measures in place. The Security page describes each one in more detail and lists what is not yet available.

• Location: application, engine and database on a dedicated server in an EU data centre.
• Documents: processed in memory only; web server and upload buffers on RAM (tmpfs); swapping to disk minimised; jobs deleted on delivery or after 15 minutes at most; never written to the database, to disk or to logs.
• Encryption: HTTPS only, with HSTS; pseudonymization mappings encrypted at rest with envelope encryption (per-tenant data key wrapped by an application master key); configuration secrets encrypted (sops/age).
• Minimisation and retention: mappings expire after the configured TTL and are deleted automatically; dry_run stores no mapping; usage and audit records contain no submitted text.
• Logs: redaction of emails, IP addresses, tokens, phone numbers, IBANs and payment cards on every log channel; daily logs kept for 14 days; error reports without query strings.
• Access control: requests checked against tenant, identity and permissions; API keys stored as hashes only; CSRF protection and bot protection on public forms; verified signatures on payment webhooks.
• Fail-closed clients: the browser and VS Code extensions send nothing if protection is not confirmed; the SDKs raise an explicit error when the engine does not respond.
• Resilience: a database backup before every deployment, stored on the same server. No off-site backup and no geographic redundancy at the date of this DPA.
• Development: automated tests, dependency scanning and secret detection in the project pipelines; the detection engine is open source (Apache-2.0).

Annex 2 — Sub-processors

Google and Stripe only process account and billing data, never the text or documents you protect. Where indicated, transfers outside the EU rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses provided in the provider's terms.