Data Processing Agreement

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person that you submit to the service, including any personal data contained in prompts, inputs, files and outputs ("Customer Data"). "Data Protection Laws" means all laws that apply to that processing, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws such as the CCPA. "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. "Subprocessor" means a third party we engage to process Customer Data.

2. Roles and scope

You are the Controller, or a Processor acting for your own customers. We are your Processor, or your Subprocessor. We process Customer Data only to provide the service: running inference requests, returning outputs, routing, authentication, billing, abuse prevention, security and support. Schedule 1 below describes the processing. Account, billing and contact data we hold to run our own business is covered by our Privacy Policy, not this DPA.

3. Your instructions

We process Customer Data only on your documented instructions. The Agreement, this DPA and your use and configuration of the service are those instructions. We will tell you if we believe an instruction breaks Data Protection Laws. We do not sell or share Customer Data, and we do not combine it with data from other sources except as the Agreement allows.

4. Zero data retention and no training

Production Wally runs with zero data retention for prompt and completion bodies by default: we do not log or store the text you send to a model or the text it returns. The prompt cache lives only in GPU memory, is kept separate per customer, and is not written to disk. The console playground is the one exception: its recent conversations stay in your own browser's storage, not on our servers. We keep usage records (token counts, timestamps, model, request ID and spend) for billing, abuse prevention and support. We never use Customer Data to train, fine-tune or evaluate any model. Every Subprocessor that handles Customer Data is bound to the same zero data retention rule.

5. Confidentiality and personnel

Only personnel who need access to provide the service can reach Customer Data. They are bound by written confidentiality obligations and complete security training.

6. Security

We maintain the technical and organizational measures in Schedule 2, appropriate to the risk of the processing. We may update them as long as the overall level of protection does not go down.

7. Subprocessors

You authorize the Subprocessors listed on our Subprocessors page. Each one is bound by a written agreement with data protection obligations no less protective than this DPA, and we remain responsible for their work. We will update that page at least 30 days before a new Subprocessor starts processing Customer Data. To get notified, email security@runanywhere.ai. You may object on reasonable data protection grounds within those 30 days. We will then try to offer an alternative, and if we cannot, you may terminate the affected part of the service.

8. Personal Data Breaches

We will notify you without undue delay, and within 48 hours of becoming aware of a Personal Data Breach affecting your Customer Data. The notice will include what we know about the nature of the breach, the data and people affected, the likely consequences and the steps we are taking. Send security reports to security@runanywhere.ai.

9. Helping you meet your obligations

We will forward you any request we receive from a Data Subject about your Customer Data rather than answer it ourselves, and help you respond where you cannot do so through the service. We will also give reasonable help with data protection impact assessments and with consultations with supervisory authorities.

10. Audits

We will make available the information you reasonably need to show compliance with this DPA. Our SOC 2 Type II audit is in progress, and once the report is issued we will share it under NDA on request. If that does not answer your question, you may audit us once a year, with 30 days' notice, during business hours, through an independent auditor under confidentiality obligations, at your own cost.

11. International transfers

We may process Customer Data in the countries listed on the Subprocessors page. Where Customer Data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 where you are a Controller, Module 3 where you are a Processor) are incorporated into this DPA, with the UK Addendum and Swiss amendments where they apply. For those clauses: you are the data exporter and we are the data importer; Clause 7 applies; Clause 9 option 2 applies with 30 days' notice; the optional part of Clause 11 does not apply; Clauses 17 and 18 use the law and courts of Ireland; and Schedules 1 and 2 of this DPA serve as Annexes I and II.

12. US state privacy laws

Where the CCPA or a similar law applies, we act as your service provider. We will not sell or share Customer Data, keep or use it outside our direct business relationship with you, or combine it with other personal data except as the law allows.

13. Deletion and return

Prompt and completion bodies are not retained in the first place. When the Agreement ends, or when you ask, we will delete the remaining Customer Data within 30 days, except where the law requires us to keep it, such as billing and tax records. On request, we will confirm the deletion in writing.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Agreement. If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses win.

Schedule 1: Details of processing

• Data Subjects: your users and end users, and any person whose Personal Data is included in what you send to the service.
• Personal Data: any Personal Data in prompts, inputs, files and outputs; account and request metadata such as user and key identifiers (never key material), IP address, timestamps, model, token counts and request size.
• Sensitive data: none intended. If you include it, the measures in Schedule 2 apply.
• Frequency: continuous, for as long as you use the service.
• Nature and purpose: inference, routing, authentication, billing, abuse prevention, security and support.
• Duration: the term of the Agreement plus the deletion period in section 13.
• Retention: prompt and completion bodies are not retained. Usage records are kept for as long as billing, tax and legal obligations require.

Schedule 2: Security measures

• Encryption: TLS 1.2 or higher in transit; AES-256 at rest, with keys in a managed key service.
• Access: single sign-on with multi-factor authentication, least privilege, and prompt revocation when someone changes role or leaves.
• Change control: every production change goes through code review and CI.
• Isolation: each customer's requests and prompt cache are kept apart. Production is separated from development.
• Logging and monitoring: centralized audit logs of authentication and admin actions, with alerting. Logs never contain prompt or completion bodies.
• Vulnerability management: dependency and secret scanning, and regular third-party penetration testing.
• Backups and recovery: encrypted backups of account and billing data, with tested restores.
• Incident response: a written plan, and notification as set out in section 8.
• Compliance program: SOC 2 Type II audit in progress, with a public Trust Center.