Star on GitHub

Data Processing Addendum

Last Updated: October 14, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Intutic ("we", "us") and a customer that uses Intutic Cloud for a business ("Customer"). It applies when we process personal data on Customer's behalf in providing Intutic Cloud, under the data protection laws that apply to that processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Swiss Federal Act on Data Protection ("FADP"). It takes effect when Customer accepts the Terms.

1. Roles

"Customer Personal Data" means personal data in the workspace data that Customer's agents and members send through Intutic Cloud and that the service records about it. For Customer Personal Data, Customer is the controller (or a processor acting for its own controllers), and we are Customer's processor (or subprocessor). For account, billing and website data, we are a controller, as our Privacy Policy describes, and this DPA does not apply to it.

2. Details of the Processing

  • Subject matter and purpose: providing Intutic Cloud to Customer under the Terms, including governing and routing its agents' AI requests, recording traces and applying its policies.
  • Nature of the processing: collection, storage, analysis, transmission to the model providers and integrations Customer chooses, retrieval and deletion.
  • Duration: for as long as Customer uses Intutic Cloud, and afterwards for the periods in section 3(g).
  • Data subjects: Customer's members, and individuals whose personal data appears in the prompts, responses, tool calls, files and documents that Customer's agents and members send.
  • Types of personal data: the workspace data described in section 2 of the Privacy Policy (traces of governed requests, change records, replay samples, prompt and response text in the cases listed there, policies and documents, the AI inventory of connected machines, repository, branch and commit, and corrective-card outcomes where turned on), and any personal data in that content.
  • Special categories of data: none intended. Under section 1 of the Terms, Customer does not send protected health information, payment card data or other specially regulated data unless we have agreed to it in writing.
  • Frequency: continuous, while Customer uses the service.

3. Our Obligations

  • (a) Instructions. We process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, and Customer's configuration and use of the service, unless the law requires otherwise; in that case we tell Customer first, unless the law forbids it. We tell Customer if we believe an instruction infringes data protection law.
  • (b) Confidentiality. Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
  • (c) Security. We maintain technical and organisational measures appropriate to the risk, as GDPR Article 32 requires, including: TLS 1.2 or later for all connections to the service; encryption at rest by Google Cloud; additional AES-256-GCM encryption of integration, single sign-on and SIEM credentials; passwords and API keys stored only as Argon2id hashes and tokens only as SHA-256 hashes; secrets and personal data redacted from change records and replay samples before they are stored; and daily database backups kept for 7 days.
  • (d) Subprocessors. We use subprocessors only as section 4 describes.
  • (e) Requests from individuals. We pass to Customer any request we receive from an individual about Customer Personal Data, and help Customer answer such requests, taking into account the nature of the processing.
  • (f) Assistance. We help Customer meet its obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us.
  • (g) Deletion and return. When Customer stops using Intutic Cloud, we delete Customer Personal Data on Customer's request, or first give Customer a copy of it if it asks, unless the law requires us to keep it. Customer can export its data before then. We delete the rest of Customer Personal Data, traces and audit records included, within 90 days after the end of the service, and confirm the deletion in writing if Customer asks; data in backups expires within 7 days after that. This DPA continues to protect anything we keep.
  • (h) Audits. We make available the information needed to demonstrate compliance with GDPR Article 28, and allow and contribute to audits, including inspections, by Customer or an auditor it appoints. We first answer Customer's written questions. An audit beyond that needs at least 30 days' written notice, takes place during business hours, is at Customer's cost, is subject to confidentiality, and happens no more than once a year unless a supervisory authority requires it or after a personal data breach. Once we hold a current SOC 2 Type II or ISO 27001 report, we provide it in place of an audit for the matters it covers.

4. Subprocessors

Customer authorises us to use subprocessors. Our Subprocessors page lists the current ones. At least 30 days before a new subprocessor processes Customer Personal Data, we add it to that page and email Customer's workspace owners. If Customer objects, it may end its subscription before the change takes effect, and we refund the unused part of any prepaid fees, pro rata. We bind each subprocessor by written contract to data protection obligations that give Customer Personal Data the same protection as this DPA, and we remain responsible to Customer for its performance of them.

5. Personal Data Breaches

If we confirm a personal data breach affecting Customer Personal Data, we notify Customer without undue delay, and in any case within 72 hours of confirming it, by email to its workspace owners. We say what we know at the time (the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences and the measures taken or proposed), and send updates as we learn more.

6. International Transfers

We store and process Customer Personal Data in the United States. We do not rely on the EU–US Data Privacy Framework or its UK and Swiss counterparts.

  • EU Standard Contractual Clauses. For transfers of Customer Personal Data subject to the GDPR, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this DPA by reference, with Customer as data exporter and us as data importer: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. Where we pass Customer Personal Data on to a subprocessor, we do so under Clauses 8.8 and 9 of the EU SCCs, and under Module 3 of the EU SCCs with that subprocessor where the transfer needs a transfer mechanism of its own. In the EU SCCs: Clause 7 does not apply; under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in section 4; the optional wording in Clause 11(a) does not apply; under Clause 13, the competent supervisory authority is the one determined by Clause 13(a); under Clause 17, Option 1 applies, with the law of Ireland; under Clause 18(b), the courts of Ireland. Annex I is completed by the Terms, Customer's account details and section 2 of this DPA, Annex II by section 3(c), and Annex III by the Subprocessors page.
  • United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) is incorporated by reference. Table 1 is completed by the parties' details above, Table 2 by the EU SCCs as selected above, and Table 3 by this DPA; for Table 4, either party may end the Addendum as its Section 19 allows.
  • Switzerland. For transfers subject to the FADP, the EU SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the FADP; and "Member State" in Clause 18(c) does not prevent data subjects habitually resident in Switzerland from bringing proceedings there.

7. Liability, Precedence and Changes

Each party's liability under this DPA is subject to section 5 of the Terms, except where the EU SCCs or the law do not allow it to be limited. For the processing of Customer Personal Data, this DPA prevails over the rest of the Terms, and the EU SCCs prevail over both. Apart from the EU SCCs, which are governed as section 6 sets out, this DPA is governed by the same law as the Terms.

This DPA applies for as long as we process Customer Personal Data. When we change it, we update the date at the top and give notice of material changes as section 10 of the Privacy Policy describes.