Data processing agreement

This data processing agreement ("DPA") is between the customer that accepts it ("you", the controller) and Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA ("we", the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing programmable.run. To accept it, email [email protected] from your account's address with your company name; we'll countersign and return a copy. It applies from that date, and to processing that has already taken place under your account.

1. What we process for you

• Subject matter and purpose: making the API calls your AI clients ask for, with the credentials you save, and returning the responses; holding the APIs you add and the calls waiting for your approval; keeping the activity log.
• Personal data: whatever the arguments and responses of your calls contain. That is decided by you, the APIs you add and your AI client, not by us. It must not include special categories of data (health, religion, politics, sexual orientation and the like) or data about children unless the law allows it and you have the safeguards it requires.
• Data subjects: your customers, users, contacts and staff, as they appear in the data your calls carry.
• Duration: the moment of each call for its arguments and response; the life of an approval for the arguments of a call waiting for you; 13 months for the activity log; the life of your account for the APIs and credentials you add, deleted within 30 days of its closure.

2. Our obligations as processor

• We process personal data only on your documented instructions, which are the Terms, this DPA, and the calls your AI clients make with your keys within the rules you set. We'll tell you if we think an instruction breaks the law.
• We keep the personal data we process for you confidential, and everyone who works on the service is bound by confidentiality.
• We keep the security measures in section 5, and won't reduce them during the term.
• We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the service allows and given what we hold (which for the content of calls is nothing).
• We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we're doing.
• On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it.
• We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.

3. Your obligations as controller

You are responsible for having a lawful basis for the personal data your calls carry, for the rules you give your access keys, for the approvals you grant, for honouring the rights of the people concerned, and for your agreements with the APIs you add. You warrant that your instructions to us are lawful.

4. Subprocessors

You authorise the subprocessors below. We'll email account owners at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can't resolve it, end the affected service.

The APIs you add and call, and the AI clients you connect, are engaged by you directly and are not our subprocessors.

5. Security measures

• The arguments and responses of calls are handled in memory to deliver them; they are not written to a database, apart from a one-way fingerprint and the outcome in the activity log.
• Encryption in transit everywhere (TLS 1.2+); saved credentials encrypted at rest in a secrets vault; access keys stored as hashes and shown once.
• Every call is checked against the key's rules before it runs; writes can be held for a person's approval; each approval runs one call, once.
• Servers reachable only through Cloudflare; firewalling on ingress and egress; SSH by key only; no shared accounts.
• Access to production is limited to the people who operate the service, with logging.
• Error reports have credentials and arguments stripped before they leave the server.

6. Where data is processed

Our servers, database and authentication are in the United States, and our subprocessors are listed in section 4. Where you are established in the EU, the EEA or the UK, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.

7. General

If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 6 says otherwise. Questions: [email protected].