This Data Processing Addendum (“DPA”) supplements the Terms of Service. It applies when Verdeshell Technologies Pvt Ltd(the “Processor”) processes personal data on behalf of the Customer (the “Controller”). Where the Customer is a data fiduciary under the Indian DPDP Act, the term “Controller” should be read accordingly.
1. Subject matter and duration
The Processor processes personal data solely for the purpose of providing the Service for as long as the Customer’s subscription remains active, plus the retention windows in clause 9.
2. Nature of processing
Multi-tenant SaaS hosting of conversations, memos, and synthesis sessions; LLM inference via Anthropic with no model training; transactional email via Microsoft Graph; payment processing via Razorpay (INR) or Stripe (USD); object storage via AWS S3; error monitoring via Sentry; secrets management via Infisical; VPS hosting and primary database via Hostinger (Mumbai, India).
3. Categories of data subjects
Customer’s personnel who use the Service; counterparties or third parties mentioned in Customer-uploaded content.
4. Categories of personal data
Identifiers (email, display name), authentication factors (hashed password, and a two-factor secret plus hashed recovery codes where two-factor is enabled), billing data (legal name, GSTIN, billing address), tenant content (conversations, memos, prompts), and telemetry (IP, User-Agent, request IDs).
5. Processor obligations
- Process personal data only on documented instructions from the Controller.
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures (see /security).
- Engage sub-processors only with prior general written authorisation and 30 days’ notice (see /legal/sub-processors).
- Assist the Controller with data-subject requests, DPIAs, and breach notifications — email legal@cortex.pleisys.com for our DPIA assistance template (a working scaffold; your own DPO/counsel signs off, we don’t certify your processing).
- Notify the Controller of personal-data breaches without undue delay (target: 72 hours for GDPR-scoped tenants). As an India-incorporated, India-hosted Processor, we are separately bound by India CERT-In’s stricter 6-hour incident-reporting requirement for in-scope cyber incidents — that clock governs first when it applies, regardless of a Customer’s own regulatory scope.
- Return or delete personal data on termination, subject to legal retention obligations.
6. International transfers
Where transfers leave the EEA, UK, or India, they rely on Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module Two) or equivalent transfer mechanisms. The executed clauses and supplementary measures (Schrems II) are documented at /legal/scc.
6a. EU addendum — for EEA, UK, and Swiss customers
Where the Customer is established in the EEA, UK, or Switzerland, the following terms apply in addition to the rest of this DPA and prevail in case of conflict.
- Article 28 GDPR.Clauses 2–9 of this DPA, taken together, satisfy the controller-to-processor requirements of Article 28(3) GDPR.
- Lead supervisory authority. For Customers with no establishment in the EU, the Irish Data Protection Commission acts as the relevant authority for the SCCs at /legal/scc.
- Storage location. All Customer content (conversations, memos, prompts, uploads) and all operational metadata (billing identifiers, account state, audit logs) is stored in India. There is no EU storage region and no in-product setting to elect one: EU data residency is not currently offered.Any EU-resident storage arrangement would have to be agreed with us in writing in advance and is not available self-service. Automated encrypted off-site backups are not yet running — see /security.
- LLM processing. Anthropic does notoffer an EU-region routing option in our integration — every tenant’s prompts and completions are processed by Anthropic in the United States, under SCCs. This is unaffected by storage location, and would remain true of any future EU storage arrangement. The full sub-processor mapping is published at /legal/sub-processors.
- Schrems II supplementary measures. See clause 6 of the SCCs.
- UK addendum.Where required, the Information Commissioner’s UK International Data Transfer Addendum (IDTA) applies in addition to the SCCs.
- Swiss addendum. For Swiss data subjects, references to GDPR are read as references to the Swiss FADP, and the relevant supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).
7. Sub-processors
The current list is published at /legal/sub-processors. Each sub-processor is bound by data-protection obligations no less protective than this DPA. Where a sub-processor (e.g. Anthropic, for LLM inference) receives Tenant content, it does so as a sub-processor of the Processor acting on the Controller’s instructions — the Processor remains responsible for that sub-processor’s performance under Article 28(4) GDPR / DPDP § 8(2). Sub-processors engaged only for the Processor’s own account-level data (e.g. billing gateways, error monitoring) act on the Processor’s instructions as an independent controller and are outside the scope of this clause.
8. Audits
Once per calendar year, the Controller may audit the Processor’s compliance, on 30 days’ written notice, during business hours, and subject to confidentiality obligations. The Processor will provide SOC 2 / ISO 27001 reports once those certifications are obtained (see the Security roadmap at /security).
9. Retention and deletion
On termination, primary tenant data is deleted within 30 days through the erasure cascade. Invoices and audit logs are retained for a minimum of 7 years for Indian regulatory compliance. Audit logs are append-only at the database level (no deletion path exists yet, including past the 7-year mark) — automated post-retention deletion is on our roadmap, not yet implemented.
10. Signing
A signed copy of this DPA is available to Business + Enterprise Customers on request. Contact legal@cortex.pleisys.com with the legal name and registered address of the contracting entity, and we will return a counter-signed PDF within 5 business days.