Contents
⚠️ DRAFT TEMPLATE — pending legal review. Not legal advice. Complete all
[[PLACEHOLDERS]]and obtain counsel approval before use.
This DPA forms part of the Customer Agreement between phi-cloud ("Processor") and Customer ("Controller") and governs Processing of Personal Data under GDPR (EU 2016/679), the UK GDPR, and the Swiss Federal Act on Data Protection (nFADP). Capitalized terms not defined here have the meaning given in those laws or the Customer Agreement.
1. Roles and scope
1.1 Customer is the Controller (or processor acting for a third-party controller) and phi-cloud is the Processor of the Personal Data contained in requests submitted to the Service.
1.2 phi-cloud Processes Personal Data only on Customer's documented
instructions, which comprise the Customer Agreement, this DPA, the request
parameters Customer sets (including X-Region and X-PHI), and any subsequent
written instructions. phi-cloud will inform Customer if an instruction infringes
Data Protection Law.
2. Nature of processing (key fact)
2.1 phi-cloud is a stateless gateway. It transmits request content to the selected Provider to obtain a response and does not log, store, or otherwise retain the content of requests or responses. The only data phi-cloud stores is limited account metadata (identity, API-key metadata, billing balance) — see the Sub-processor list and Privacy Policy.
2.2 Details of Processing (Annex I): subject matter — provision of AI inference
routing; duration — the term of the account; nature/purpose — transient
transmission to Providers for inference; categories of data subjects and Personal
Data — as determined and submitted by Customer; special-category/health data —
only where Customer sets X-PHI and an eligible region (see §4).
3. Security
phi-cloud implements appropriate technical and organizational measures (Annex II), including: encryption in transit (TLS); no payload logging/persistence; authenticated, least-privilege access to account metadata; key material held in the deployment environment; and provider isolation. Customer is responsible for securing its own API keys and endpoints.
4. Region-resident routing; special-category and health data
4.1 Routing is jurisdiction-pinned by X-Region. For X-PHI-flagged or
special-category data, phi-cloud routes only to Providers contractually
cleared for that data class in that jurisdiction, and otherwise declines the
request (phi_blocked / no_route) rather than route to a non-cleared Provider.
4.2 Current PHI-cleared Providers by jurisdiction are listed in the Sub-processor list. Customer must set the controls correctly; phi-cloud is not liable for regulated data exposed to a Provider because Customer failed to flag it.
5. Sub-processors
5.1 Customer authorizes phi-cloud to engage the Providers and infrastructure sub-processors listed in the Sub-processor list, each bound by terms no less protective than this DPA.
5.2 phi-cloud will give Customer prior notice of any new or replacement sub-processor that Processes request content (via the published list and/or email) and Customer may object on reasonable data-protection grounds within [[30]] days; absent resolution, Customer may stop using the affected region/model.
6. International transfers
Where Processing involves a transfer subject to Chapter V GDPR, the UK regime, or the nFADP, the parties rely on the EU Standard Contractual Clauses (and the UK IDTA/Addendum and Swiss addendum as applicable), which are incorporated by reference and completed by Annex I/II. Region-resident routing is designed to keep data within the selected jurisdiction.
7. Data-subject requests and assistance
Given the stateless design, phi-cloud holds no request content with which to fulfil access/erasure requests for payload data; phi-cloud will assist Customer, to the extent applicable and at Customer's cost where permitted, with requests relating to the account metadata it does hold, and with DPIAs and consultations (Art. 32–36 GDPR).
8. Personal Data breach
phi-cloud will notify Customer without undue delay after becoming aware of a Personal Data breach affecting Customer's data within phi-cloud's control, with information sufficient to meet Customer's notification duties.
9. Deletion / return
On termination, because phi-cloud retains no request/response content, there is no payload to return or delete. Account metadata is deleted or anonymized per the Privacy Policy retention terms, save where law requires retention.
10. Audits
phi-cloud will make available information necessary to demonstrate compliance with Art. 28 GDPR (including third-party reports/certifications when available) and allow audits subject to reasonable confidentiality, scope, frequency, and cost terms.
11. Precedence and term
This DPA prevails over the Customer Agreement on the Processing of Personal Data, and runs for as long as phi-cloud Processes Personal Data for Customer.
Annex I — Processing details
Controller/Processor: Customer / phi-cloud. Data subjects & categories: as
submitted by Customer. Special categories: health data only via X-PHI +
eligible region. Processing operations: transient transmission for inference.
Sub-processors: see Sub-processor list.
Annex II — Technical & organizational measures
TLS in transit; no payload logging/persistence; least-privilege access to account metadata; secrets in deployment environment; provider isolation; region-resident routing; PHI gating. (Expand to your control framework before signature.)