Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service and the applicable Order Form between Kyrazo LLC (“Processor”) and the customer using Kyrazo (“Controller”). This DPA applies to the processing of Personal Data subject to Data Protection Laws (including GDPR and PDPL) in the course of providing dedicated, physically isolated webhook infrastructure. If an Order Form conflicts with this DPA, the Order Form controls for deployment location and retention.

2. Processing of Personal Data

Processor shall only process Personal Data for the following purposes:

• Provisioning and operating the Controller’s dedicated environment.
• Processing in accordance with Controller’s documented instructions, including the Order Form.
• Ensuring the performance, security, and integrity of the dedicated infrastructure.

3. Technical & Organizational Measures

Processor implements industry-standard measures to protect Personal Data, including:

• Encryption: Payload encryption using AES-256-GCM (at rest) and TLS 1.3 (in transit).
• Physical isolation (Professional): Dedicated Spaceship virtual machines, databases, and delivery workers reserved exclusively for the Controller. No shared database memory and no multi-tenant worker pools.
• BYOC / private cloud (Enterprise): Where specified in the Order Form, payload processing remains inside the Controller’s cloud boundary.
• Data residency: Region is specified in the Order Form. Managed backups for Processor-hosted deployments are encrypted snapshots stored within the EEA via Cloudflare R2 unless the Order Form states otherwise.
• Retention: Data is deleted in accordance with the Controller’s Order Form for ingest and dispatch events, and the dedicated environment is decommissioned on contract end.

4. Sub-processing

We use a limited number of third-party sub-processors to provide our services, including Spaceship for dedicated virtual machines. A current list and their processing locations can be found on our GDPR Page. For Enterprise BYOC, infrastructure inside the Controller’s cloud is not a Kyrazo sub-processor.

5. Data Subject Rights & Audits

Processor shall assist Controller in responding to Data Subject requests and provide reasonable information necessary to demonstrate compliance with these data protection obligations.

6. Jurisdiction

This DPA is governed by the laws of the United States, without prejudice to the mandatory protections afforded to Data Subjects under the GDPR or PDPL where applicable.