Data Processing Addendum
Effective date: May 25, 2026 | Last updated: May 25, 2026
1. Application and Parties
This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Vouchstone LLC ("Vouchstone" or "Processor") and the customer ("Customer"). It applies automatically when Vouchstone processes Customer Personal Data in providing the hosted Services. Customers who need a countersigned copy may request one from legal@vouchstone.ai.
This DPA does not apply to Self-Hosted Software running in Customer's infrastructure, where Vouchstone does not process Customer Personal Data, except to the extent Customer gives Vouchstone access to personal data for support or professional services, in which case this DPA applies to that access.
2. Definitions
"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended (CCPA), other U.S. state privacy laws, India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU General Data Protection Regulation (GDPR) and the UK GDPR.
"Customer Personal Data" means personal data within Customer Data that Vouchstone processes on Customer's behalf.
"Sub-processor" means any third party engaged by Vouchstone to process Customer Personal Data.
"Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
Terms such as "controller," "processor," "data subject," "business," "service provider," "data fiduciary" and "processing" have the meanings given in Data Protection Laws.
3. Roles and Instructions
Customer is the controller (or business or data fiduciary) and Vouchstone is the processor (or service provider or data processor) of Customer Personal Data. Vouchstone will process Customer Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA and Customer's use and configuration of the Services, unless the law requires otherwise, in which case Vouchstone will inform Customer unless legally prohibited. Vouchstone will notify Customer if it believes an instruction violates Data Protection Laws.
Customer is responsible for the lawfulness of its instructions and for providing notices and obtaining any consents needed for processing.
4. Details of Processing
| Subject matter | Provision of the Vouchstone hosted Services under the Agreement |
| Duration | The term of the Agreement plus the post-termination deletion periods in Section 11 |
| Nature and purpose | Hosting, storage, extraction, knowledge-graph construction, retrieval, AI-assisted analysis, agent execution, audit logging, support and other processing needed to provide the Services |
| Data subjects | Customer's Users, employees, contractors, customers, patients, students, suppliers and other individuals whose data Customer submits or connects |
| Categories of data | As determined by Customer; may include contact details, identifiers, employment, financial, transactional and communications data, and technical data |
| Special categories | Only where Customer chooses to submit them and the Agreement permits, such as health data under a Business Associate Agreement |
| Processing location | United States (AWS us-east-1) unless otherwise agreed in an Order Form |
5. Confidentiality and Personnel
Vouchstone ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive appropriate privacy and security training, and access data only as needed to provide the Services or support.
6. Security
Vouchstone implements and maintains the technical and organizational measures described in its Security Overview (Annex II), which include encryption, access controls, logging, vulnerability management, business continuity and vendor management. Vouchstone may update these measures provided that overall protection is not materially reduced.
7. Sub-processors
Customer gives general authorization for Vouchstone to engage Sub-processors. The current list is at vouchstone.ai/legal/subprocessors. Vouchstone will give at least 30 days' notice of new Sub-processors by updating that page and notifying Customers who subscribe to updates by emailing privacy@vouchstone.ai.
Customer may object on reasonable data protection grounds within 30 days of notice. The parties will discuss the objection in good faith. If no resolution is reached, Customer may terminate the affected Services and receive a refund of prepaid, unused fees. Large language model providers used by Vouchstone's model routing (currently Anthropic and OpenAI) are Sub-processors, and any new model provider will be added to the list under this notice procedure before it processes Customer Personal Data. Model providers that Customer selects under its own account or API keys are Customer's own processors and are not Vouchstone Sub-processors.
Vouchstone imposes data protection obligations on each Sub-processor that are no less protective than this DPA and remains responsible for their performance.
8. Assistance and Data Subject Requests
Taking into account the nature of processing, Vouchstone will provide reasonable assistance to Customer in responding to data subject requests, carrying out data protection impact assessments and prior consultations, and meeting security and breach-notification obligations. If Vouchstone receives a request directly from a data subject about Customer Personal Data, it will refer the request to Customer and will not respond except as Customer instructs or as the law requires.
9. Security Incidents
Vouchstone will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. Vouchstone will take reasonable steps to contain and remediate the incident and will keep Customer informed. Notification is not an acknowledgement of fault.
10. Audits
Vouchstone will make available, on written request and subject to confidentiality, the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and descriptions of its security controls. If that information is insufficient or a regulator requires it, Customer may conduct an audit no more than once every 12 months, on at least 30 days' notice, during business hours, at Customer's cost, in a manner that does not compromise other customers' data or Vouchstone's security.
11. Return and Deletion
On termination of the Agreement, Customer may export Customer Personal Data for 30 days. Vouchstone will then delete Customer Personal Data from active systems within 30 days and from backups within 90 days, unless the law requires retention, in which case Vouchstone will continue to protect it under this DPA. Vouchstone will certify deletion on request.
12. California (CCPA) Service Provider Terms
Vouchstone will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Services; (c) retain, use or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information received from other sources, except as permitted by the CCPA. Vouchstone will comply with the CCPA, provide the same level of privacy protection it requires, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized use.
13. International Transfers
Customer Personal Data is processed in the United States. Where Data Protection Laws restrict transfers of personal data to the United States, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two for controller-to-processor or Module Three for processor-to-processor) and, for UK data, the UK International Data Transfer Addendum, are incorporated by reference. For those clauses: the optional docking clause applies; general sub-processor authorization applies with the notice period in Section 7; the governing law and forum are Ireland; and the Annexes are completed by Section 4 and Annexes II and III of this DPA. For transfers under the DPDP Act, Vouchstone will not transfer Customer Personal Data to any country restricted by notification of the Government of India.
14. Liability and Precedence
Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses prohibit such limitation. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Agreement regarding the processing of Customer Personal Data.
Annex II: Technical and Organizational Measures
The measures described in the Vouchstone Security Overview, as updated from time to time, including encryption in transit and at rest, tenant isolation, least-privilege access, multi-factor authentication, logging and monitoring, vulnerability management, secure development practices, backups and disaster recovery, incident response and vendor due diligence.
Annex III: Sub-processors
As listed at vouchstone.ai/legal/subprocessors and in the Security Overview.
Contact
Vouchstone LLC, 2000 Walnut Ave, Fremont, California 94538, United States | privacy@vouchstone.ai | legal@vouchstone.ai