Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service and governs the processing of personal data by APIR on behalf of the Customer. It applies to all personal data APIR processes for the Customer through the Service.

For the purposes of the GDPR, the Australian Privacy Act 1988 and equivalent laws: the Customer is the controller and APIR is the processor. APIR processes personal data only on the Customer's documented instructions, which include the Customer's use of the Service.

Categories of data subjects: the Customer's staff and end users; people who operate or oversee the Customer's AI agents; and people named in documents or declarations the Customer submits.

Types of personal data: names, email addresses, job titles, IP addresses and usage logs; the records the Customer's agents write to their log books; and any personal data inside documents the Customer submits. For a seal or a file check, APIR receives the declaration and a fingerprint of each file, never the file itself.

Purpose: providing the Service the Customer uses: agent credentials and their records, the seal and the file check, business profiles, the Numbers Check and the Triage Verdict, and the reporting that goes with them.

Duration: for as long as the Customer uses the Service, plus the retention period in the Privacy Policy. Entries written to an append-only ledger (an agent's log book, or the seal chain) are kept for the life of that ledger by design. The Customer decides what is written to them.

APIR applies the measures listed at apir.ai/trust, which is kept current, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256, applied by APIR's database provider); row-level security on every database table; signing keys generated and held in a vault and never exported; administrative access limited to one named person and checked on the server; and a log of administrative actions.

APIR holds no third-party security certification and has not had a third-party penetration test. The trust page says so, and this DPA does not imply otherwise.

APIR's sub-processors are listed below, and the list on apir.ai/trust is kept identical. APIR will notify the Customer at least 30 days before engaging a new sub-processor, and the Customer may object by notifying APIR within 14 days.

Personal data is stored primarily in Singapore and processed by the sub-processors above in the regions shown. Where the law that applies to the Customer requires a transfer mechanism, APIR relies on the transfer terms each sub-processor offers, including the European Commission's Standard Contractual Clauses where they apply, and will sign further transfer terms the Customer reasonably needs.

APIR will help the Customer respond to requests for access, rectification, erasure, portability, restriction and objection within the time the applicable law allows. An entry on an append-only ledger cannot be changed or removed without breaking the record; where a request reaches one, APIR will say what the entry holds and help the Customer respond, and will write nothing further about that person.

APIR will notify the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken.

The Customer may audit APIR's compliance with this DPA on reasonable notice, no more than once a year. APIR will provide the information reasonably needed to show compliance and will answer written security questionnaires. APIR has no third-party audit report to offer in place of this.

Data protection contact: Slav Ripa, Founder and CEO, at dpo@apir.ai.

28 September 2026: the sub-processor list was corrected to the services APIR uses (OpenRouter, Google, PostHog and freeTSA added; Upstash, never used, removed); the security measures now match the trust page; and the purposes now describe the Service as it is.