Data Processing Agreement

"Content" means the prompts, uploaded documents, conversations, project contents and AI responses submitted to or generated by the Services for Customer, as defined in the Agreement.

"Data Protection Law" means the GDPR and applicable Luxembourg data protection legislation, in each case as amended.

"Zero-Access Architecture" means the technical design of the Services under which Content is encrypted client-side and/or processed only inside attested confidential computing environments (secure enclaves) operated by Tresor and, for routed inference, approved attested inference providers, such that Tresor personnel and infrastructure operators have no technical means to access Content in plaintext outside those environments, as described in the Agreement and Annex 2.

Terms such as "controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR. Capitalised terms not defined here have the meaning given in the Agreement.

3.1 Customer is the controller of personal data contained in Content (or, where Customer acts on behalf of a third-party controller, a processor duly authorised to engage Tresor as a sub-processor; in that case references to "controller" obligations apply to Customer accordingly). Tresor is Customer's processor for such data.

3.2 Tresor processes personal data in Content only on Customer's documented instructions, unless required to do so by Union or Member State law, in which case Tresor will inform Customer of that legal requirement before processing unless the law prohibits this. Customer's complete and final instructions are: (a) processing necessary to provide the Services in accordance with the Agreement; and (b) processing initiated by Customer and its users through their use of the Services. Additional instructions require the Parties' written agreement, including on any costs.

3.3 Tresor will inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. The Parties acknowledge that, given the Zero-Access Architecture, Tresor is generally unable to review or evaluate Content and therefore cannot assess instructions embedded in Content.

3.4 Customer is responsible for the lawfulness of the personal data it submits to the Services, including having a legal basis and providing any required notices to data subjects.

4.1 The Parties acknowledge that the Services are designed so that Content is processed only inside attested confidential computing environments operated by Tresor and, where Customer uses routed third-party inference, by the approved attested inference provider selected for the request. Neither Tresor personnel nor infrastructure operators have technical means to access Content in plaintext outside those environments. For the Confidential Inference API, prompts and responses are not retained after the response is returned, except that cryptographic digests and verification metadata may be recorded in receipts without storing prompt or response plaintext. For the Tresor Workspace, Content is stored only in encrypted form under keys controlled by Customer.

4.2 Accordingly, where this DPA requires Tresor to assist Customer or to act with respect to personal data in Content, Tresor's obligations apply taking into account the nature of the processing (Articles 28(3)(e) and (f) GDPR): assistance is provided primarily through the functionality of the Services (e.g., Customer-side access, export, correction and deletion of Content) and through architectural, audit, and attestation information, rather than through direct handling of Content in plaintext, to which Tresor does not have routine operational access.

6.1 Tresor implements and maintains the technical and organisational measures described in Annex 2, in accordance with Article 32 GDPR. Tresor may update these measures from time to time, provided the updates do not materially reduce the overall level of protection during a subscription period.

6.2 Customer is responsible for the security measures within its control, including the management of its credentials, encryption keys and recovery material, API keys, user access, and the configuration of region restrictions where required.

7.1 Customer grants Tresor general written authorisation to engage sub-processors for the processing of personal data under this DPA. The current list of sub-processors, including attested inference providers, is set out in Annex 3. Tresor will make updated Annex 3 information available to Customer through the Services, by email to Customer's administrative contact, or by another written notice channel designated in the Agreement.

7.2 Tresor will notify Customer of intended additions or replacements to Annex 3 at least thirty (30) days before the new sub-processor processes personal data, by email to Customer's administrative contact, through the Services, or through another written notice channel designated in the Agreement. Customer may object on reasonable data-protection grounds within that period; if the Parties cannot resolve the objection, Customer may terminate the affected Service or Order Form without penalty as its sole remedy.

7.3 Tresor imposes on each sub-processor data-protection obligations materially equivalent to those in this DPA and remains liable to Customer for its sub-processors' performance.

7.4 Attested inference providers. Inference requests may be routed to approved third-party inference providers that operate attested confidential computing environments. Tresor verifies each provider's hardware attestation before any Content is forwarded. For routed inference, Content is processed in plaintext only inside Tresor's enclave path and inside the verified TEE of the selected provider, and approved providers must not retain prompts or responses after the response is returned other than transient in-memory processing required to serve the request. This contractual non-retention obligation backstops, and does not replace, the technical controls described in Sections 4.1 and 6.1. The provider serving each request is identified in the corresponding receipt. Where Customer enables a region restriction (EU or Luxembourg), it is enforced as a hard routing constraint: if no eligible route matches, the request fails rather than widening geography.

8.1 Taking into account the nature of the processing, Tresor assists Customer by appropriate technical and organisational measures in fulfilling Customer's obligation to respond to data subject requests under Chapter III GDPR. For personal data in Content, access, rectification, erasure and portability are exercised by Customer directly through the Services, since Tresor cannot read or extract Content on Customer's behalf.

8.2 If a data subject contacts Tresor directly regarding personal data in Content, Tresor will, to the extent it can attribute the request to Customer, forward the request to Customer without undue delay and will not respond on the merits except as instructed by Customer or required by law.

9.1 Tresor will notify Customer without undue delay, and where feasible within forty-eight (48) hours, after becoming aware of a personal data breach affecting personal data processed under this DPA, and will provide the information reasonably required for Customer's obligations under Articles 33 and 34 GDPR, supplementing it as information becomes available. Tresor will take reasonable measures to contain and remediate the breach.

9.2 The Parties acknowledge that, under the Zero-Access Architecture, a compromise of Tresor's infrastructure outside the enclaves exposes only ciphertext and operational metadata; Tresor's notification will state, where determinable, whether the breach could have affected Content in plaintext.

11.1 Tresor makes available the information necessary to demonstrate compliance with this DPA, including: (a) this DPA and the Annexes; (b) technical documentation of the Zero-Access Architecture, including published enclave measurements and the attestation verification procedure; (c) signed receipts evidencing processing inside attested environments; and (d) summaries of third-party audits or certifications, as they become available.

11.2 Where the material in Section 11.1 is insufficient to demonstrate compliance, Customer (or an independent auditor mandated by it and bound to confidentiality, not being a competitor of Tresor) may audit Tresor's compliance with this DPA no more than once per twelve (12) months, upon at least thirty (30) days' written notice, during business hours, without disruption to operations, and subject to Tresor's security policies. Audits do not include access to data of other customers, to enclave-internal key material, or to systems whose disclosure would compromise the security of the Services. Each Party bears its own costs; audits exceeding one day or requested more frequently are at Customer's expense at Tresor's then-current rates, unless the audit reveals material non-compliance.

11.3 Audits required by a supervisory authority remain unaffected.

12.1 Tresor-controlled infrastructure for the production Services is hosted in the European Union. Where Customer selects, or permits automatic routing to, a sub-processor location outside the EU/EEA, Tresor ensures a valid transfer mechanism under Chapter V GDPR (for example, an adequacy decision or the Standard Contractual Clauses supplemented by the measures in Annex 2).

12.2 The Parties consider the Zero-Access Architecture a technical supplementary measure for routed inference because Content is encrypted in transit and processed in plaintext only inside attested TEEs, with no routine administrative plaintext access outside those TEEs. Customers requiring EEA-only processing can enable the region restriction described in Section 7.4; if no eligible route matches, the request fails.

13.1 Upon termination or expiry of the Agreement, or earlier upon Customer's instruction through the Services, Tresor deletes personal data processed under this DPA, unless Union or Member State law requires storage. For the Confidential Inference API, prompts and responses are not retained after the response is returned, so no end-of-term deletion of Content is required. For the Tresor Workspace, deletion is effected by deletion of the encrypted Content and/or destruction of the associated key material (crypto-erasure); Content encrypted under keys held only by Customer becomes permanently irrecoverable upon deletion.

13.2 Return of Content is effected by Customer's own export through the Services prior to termination; Tresor cannot extract or hand over Content in plaintext. Where the applicable Service or request stores verification receipts, receipt bodies are stored as opaque signed JWS records rather than plaintext Content.

14.1 The liability provisions of the Agreement apply to this DPA. Nothing in this Section limits a data subject's rights or either Party's liability towards data subjects under Article 82 GDPR.

14.2 This DPA takes effect upon acceptance of the Agreement and remains in force for as long as Tresor processes personal data on behalf of Customer.

14.3 This DPA is governed by the law specified in the Agreement. Annexes 1-3 form an integral part of this DPA.