Data Processing Agreement

Last updated: July 28, 2026

This Data Processing Agreement (the "DPA") forms part of the agreement between the customer ("Controller") and Electryion ("Processor") under which the Controller uses the Electryion platform (the "Service"). It sets out the terms on which Electryion processes personal data on behalf of the Controller and is intended to comply with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

By using the Service, the Controller accepts this DPA. For a counter-signed version of this DPA, contact [email protected].

1. Definitions

Terms not defined in this DPA have the meaning given in the GDPR. "Personal Data", "Data Subject", "Processing", "Controller" and "Processor" have the meanings set out in Article 4 GDPR. "Sub-Processor" means any third party engaged by Electryion to process Personal Data on behalf of the Controller.

2. Subject Matter and Duration

Electryion processes Personal Data on behalf of the Controller solely to deliver the Service. Processing lasts for the term of the Controller's subscription and ends no later than 30 days after account termination, except where retention is required by law (for example tax records).

3. Nature and Purpose of Processing

• Operating AI employees: Axel (executive assistant), Sebastian (recruiter), Talon (social media), Carmen (lead generation), PRISM (requirements engineering with Jira/Linear integration), CIPHER (tender monitoring).
• Storing workspace content, preferences, and conversations.
• Sending transactional and service emails.
• Logging security-relevant events.
• Providing support when the Controller raises a ticket.

4. Categories of Personal Data

• Account data: name, email, hashed password, preferred language.
• Workspace content: emails, candidate records, leads, ticket descriptions, EARS requirements, tender data, notes, chat messages.
• Connected-service data: content the Controller authorizes through OAuth (Outlook, LinkedIn, Jira, Linear, Meta, X).
• Technical data: IP address, browser, device, timestamps, audit events.
• Billing data: handled by Stripe; Electryion stores only invoice metadata.

5. Categories of Data Subjects

• Controller's employees and users of the Service.
• Controller's customers, prospects, candidates, counterparties, and correspondents whose data is fed into the AI employees.

6. Obligations of the Controller

The Controller warrants that it has a lawful basis under the GDPR for all Personal Data it submits to the Service, has provided required notices to Data Subjects, and will instruct Electryion only to perform processing that is itself lawful.

7. Obligations of Electryion (Processor)

Electryion will:

• Process Personal Data only on documented instructions from the Controller, which include the use of the Service as configured.
• Ensure that personnel authorized to process Personal Data are bound by confidentiality.
• Implement the technical and organisational measures described in Annex A.
• Assist the Controller in responding to Data Subject rights requests (access, rectification, erasure, restriction, portability, objection).
• Assist the Controller with Data Protection Impact Assessments and consultations with supervisory authorities, to the extent reasonably required.
• Notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting the Controller.
• Not use Personal Data for training of AI models or for any purpose other than delivering the Service.

8. Sub-Processors

The Controller provides general authorisation for Electryion to engage the Sub-Processors listed at https://electryion.com/sub-processors. Electryion will:

• Impose data-protection obligations on each Sub-Processor that are no less protective than those in this DPA.
• Remain liable for any failure of a Sub-Processor to meet its obligations.
• Give the Controller at least 30 days' notice of any new Sub-Processor. The Controller may object on reasonable data-protection grounds, in which case Electryion will use commercially reasonable efforts to find an alternative. If no alternative is available, the Controller may terminate the affected part of the Service.

9. International Transfers

Where Electryion or a Sub-Processor transfers Personal Data outside the European Economic Area, the transfer is governed by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which are hereby incorporated by reference. The Controller is the data exporter and Electryion is the data importer.

10. Security Measures

Electryion implements and maintains the technical and organisational measures set out in Annex A. The Controller acknowledges that the Service evolves; Electryion may update its measures over time provided the updated measures offer an equivalent or higher level of protection.

11. Audit Rights

Electryion will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, including summaries of its technical and organisational measures, Sub-Processor list, and security incidents involving the Controller. In addition, on reasonable written request and not more than once every 12 months, Electryion will permit an audit carried out by the Controller or an independent auditor, subject to reasonable confidentiality and scheduling constraints. The Controller bears the costs of any such audit unless the audit reveals a material breach.

12. Data Subject Requests

If Electryion receives a Data Subject request relating to the Controller's data, Electryion will promptly forward the request to the Controller and will not respond substantively except on the Controller's documented instructions or as required by law.

13. Return or Deletion of Data

On termination of the Service, Electryion will delete or return all Personal Data processed on behalf of the Controller within 30 days, except where continued retention is required by law. Export tooling is available through the Controller's account settings and on request.

14. Liability

Each party's liability under this DPA is subject to the limitations of liability in the main agreement between the parties.

15. Precedence

In the event of a conflict between this DPA and the main agreement, this DPA prevails for matters concerning the processing of Personal Data.

16. Contact

All notices under this DPA, including breach notifications, should be sent to [email protected]. Security issues may also be reported to [email protected].

Annex A - Technical and Organisational Measures

A.1 Access Control

• Workspace-level data isolation: each workspace's data is scoped at the database layer and enforced in application middleware.
• Passwords are hashed with bcrypt (cost factor 12).
• Password policy: minimum 12 characters, mixed case, numbers, checked against known breach corpora in production.
• Session authentication with HTTP-only, SameSite=Lax cookies; Secure flag required in production.
• Role-based access controls on administrative endpoints.

A.2 Encryption

• All traffic to the Service is encrypted in transit with TLS 1.2 or higher.
• OAuth tokens and integration credentials are encrypted at rest using AES-256 via Laravel's encrypted cast.
• Database-level backups are encrypted at rest by the hosting provider.

A.3 Application Security

• Content Security Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers applied to every response.
• CSRF protection on all state-changing requests.
• Rate limiting on authentication, OAuth callbacks, and LLM streaming endpoints.
• Dependency scanning and timely security updates.

A.4 Monitoring and Audit

• Structured audit log for login, logout, password change, account deletion, integration connect/disconnect, and billing events.
• Error and exception monitoring via Sentry with PII redaction (passwords, tokens, API keys, Stripe secrets are stripped).
• Audit logs retained for up to 24 months.

A.5 Personnel

• Access to production systems is limited to authorized engineering personnel on a need-to-know basis.
• All personnel are bound by written confidentiality obligations.

A.6 Incident Response

• Documented breach-notification procedure; Controller is notified within 72 hours of confirming a breach affecting their data.
• Security reports can be submitted to [email protected].

A.7 Business Continuity

• Daily database backups with at least 30 days of retention.
• Recovery procedures tested periodically.

A.8 Data Minimisation

• OAuth scopes requested are the minimum required for each AI employee to function.
• Workspace content and account data are deleted within 30 days of account termination, subject to legal retention obligations.
• Optional behavioural features (such as Axel's Promise Radar that scans the user's Sent folder for unfulfilled commitments) are off by default and only run after the user explicitly enables them in agent settings.