# Data Processing Addendum Last updated: 2 November 2026 This Data Processing Addendum ("DPA") forms part of the [Terms of Service](/terms) or other agreement (the "Agreement") between Ablit ("Ablit", "we") and the customer that accepts it ("Customer", "you"). It applies whenever Ablit processes personal data on your behalf in providing ablit.app, the Ablit API, ABLIT CODE and related services (the "Services"). It takes effect when you accept it in the product, sign a copy, or when your Agreement refers to it, whichever is first. A countersigned copy is available on request from [help@ablit.app](mailto:help@ablit.app). ## 1. Definitions - **Data Protection Law** means every law that applies to the processing of personal data under this DPA, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws. - **Customer Personal Data** means personal data contained in content you or your users submit to the Services (prompts, files, conversation context, tool inputs and outputs) and that Ablit processes on your behalf. - **Account Data** means data about you and your users as customers of Ablit (account, billing, usage records, support), which Ablit processes as an independent controller under its [Privacy Policy](/privacy). - **Sub-processor** means a third party engaged by Ablit to process Customer Personal Data. - "Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings in the GDPR. ## 2. Roles, scope and instructions 2.1 **Roles.** For Customer Personal Data you are the controller (or a processor acting for another controller) and Ablit is your processor (or sub-processor). For Account Data, Ablit is an independent controller. 2.2 **Instructions.** Ablit processes Customer Personal Data only on your documented instructions, which are: the Agreement, this DPA, your use of the Services and their settings, and any further written instructions you give that are compatible with the Agreement. Ablit may process Customer Personal Data otherwise only where required by law, in which case it tells you first unless the law prohibits it. 2.3 **Details of processing** are in Annex 1. 2.4 **Unlawful instructions.** Ablit will tell you if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is changed. 2.5 **Security and aggregated data.** Ablit may process Customer Personal Data to the extent needed to detect and prevent abuse, fraud and security incidents, and may create anonymised, aggregated statistics that cannot identify any person, for its own lawful purposes. ## 3. Ablit's obligations 3.1 **Confidentiality.** Persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate instruction. 3.2 **Data subject requests.** Ablit provides the tools and assistance you reasonably need to respond to data subject requests. If a data subject contacts Ablit directly about your data, Ablit refers them to you where it can identify you and does not respond on its own behalf except as required by law. 3.3 **Assistance.** Taking into account the nature of the processing and the information available, Ablit assists you with your obligations on security, breach notification, data protection impact assessments and prior consultation. Ablit may charge reasonable costs for assistance that goes beyond what the Services already provide. 3.4 **Government requests.** If a public authority demands Customer Personal Data, Ablit challenges requests it considers unlawful, discloses only what is required, and notifies you unless the law prohibits it. ## 4. Security 4.1 Ablit implements and maintains the technical and organisational measures in Annex 2 and may update them, provided the overall level of protection is not materially reduced during the term. 4.2 **Shared responsibility.** You are responsible for configuring the Services securely, for the credentials, API keys and permissions you and your users hold, for what your users submit, and for the lawfulness of the instructions you give the agent, including the targets you point the security tools at. ## 5. Sub-processors 5.1 **Authorisation.** You give general written authorisation for the Sub-processors listed on the [Trust page](/trust#subprocessors) at the time you accept this DPA, and for the ones Ablit adds in accordance with this section. 5.2 **Changes.** Ablit publishes additions and replacements on the Trust page at least 14 days before the new Sub-processor processes Customer Personal Data and, if you have asked for notice at help@ablit.app, emails you. Model providers you select yourself in the product act on your instruction from the moment you select them. 5.3 **Objection.** You may object to a new Sub-processor on reasonable data protection grounds within the notice period. If Ablit cannot offer a reasonable alternative, you may terminate the affected Services with a refund of prepaid, unused fees for them. 5.4 **Flow-down.** Ablit imposes data protection obligations on each Sub-processor that are no less protective than this DPA and remains liable for their performance. ## 6. Personal data breaches 6.1 Ablit notifies you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, at the email address of your account administrator. 6.2 The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in phases. A notification is not an admission of fault. ## 7. Return and deletion 7.1 During the term you can delete Customer Personal Data in the Services at any time. On termination, Ablit deletes Customer Personal Data within 30 days, unless you have exported it first or ask for its return in a commonly used format before that. 7.2 Ablit may retain Customer Personal Data where required by law, for billing, security, tax, audit or dispute purposes, protected as under this DPA, and only for as long as that purpose lasts. 7.3 Backups are isolated from active use and overwritten under Ablit's backup rotation (currently 7 days). ## 8. International transfers 8.1 Ablit's own systems are in the European Union. Customer Personal Data is transferred outside the EEA, the UK or Switzerland only to Sub-processors listed on the Trust page, under an adequacy decision or an appropriate safeguard. 8.2 **EEA.** Where a transfer is not covered by an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA: Module Two where you are a controller and Module Three where you are a processor, with the options in Annex 3. 8.3 **United Kingdom.** The UK International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated for transfers subject to the UK GDPR, with the details in Annex 3. 8.4 **Switzerland.** For transfers subject to the Swiss FADP, the EU SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner. 8.5 In case of conflict between this DPA and the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail for the transfer concerned. ## 9. United States privacy laws Where a US state privacy law applies, Ablit acts as your "service provider" or "processor". Ablit does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship with you or for any purpose other than performing the Services, does not combine it with data from other sources except as permitted, and will notify you if it can no longer meet these obligations. You may take reasonable steps to stop and remediate unauthorised use. ## 10. Information and audits 10.1 On written request, no more than once in 12 months, Ablit provides the information reasonably necessary to demonstrate compliance with this DPA: its current security documentation, the Trust page, summaries of any third-party assessments it has, and answers to a reasonable security questionnaire. 10.2 Where that information is not sufficient to meet your legal obligations, you may audit Ablit's compliance once in 12 months, or additionally after a personal data breach or at the request of a supervisory authority, through an independent auditor bound by confidentiality, on 30 days' notice, during business hours, at your cost, without disrupting the Services or exposing other customers' data. ## 11. Your obligations and regulated data 11.1 You warrant that you have a lawful basis, and have given the notices and obtained the consents required, for the processing you instruct, and that your instructions comply with Data Protection Law. 11.2 The Services are not designed for special categories of personal data (Article 9 GDPR), criminal data or data of children. If you submit such data anyway, this DPA still applies, but you bear the responsibility for its lawfulness. 11.3 Protected health information under HIPAA may not be submitted unless a separate business associate agreement is in place. ## 12. General 12.1 This DPA prevails over the Agreement for the processing of Customer Personal Data. The limitations and exclusions of liability in the Agreement apply to this DPA, including to the SCCs to the extent the law permits, and any liability under this DPA counts toward the cap in the Agreement. 12.2 You enter into this DPA for yourself and for your affiliates that use the Services under your account, and act as their single point of contact. 12.3 Ablit may update this DPA to reflect changes in Data Protection Law or the Services, without materially reducing the protection for Customer Personal Data during the term. 12.4 This DPA ends with the Agreement, or when Ablit no longer processes Customer Personal Data, whichever is later. ## Annex 1: Details of processing - **Subject matter:** providing the Services described in the Agreement. - **Nature and purpose:** storing and processing content submitted by you and your users; sending prompts and context to AI model and media providers to generate outputs; running tools (web browsing, code execution, security tools, cloud runs, scheduled tasks) on your instruction; storing conversations, files, traces and results for you; providing the API and CLI; securing and supporting the Services. - **Duration:** the term of the Agreement plus the deletion period in section 7. - **Categories of data subjects:** your users and administrators; persons whose data appears in the content you submit (employees, customers, end users, third parties). - **Categories of personal data:** identifiers and contact data of users; any personal data contained in prompts, files, conversation context, tool inputs and outputs; technical data about runs. - **Special categories:** not intended; see section 11.2. - **Frequency:** continuous, as the Services are used. ## Annex 2: Technical and organisational measures - **Encryption in transit.** TLS for every connection between users, the Services and Sub-processors; HTTP Strict Transport Security on the public domains; TLS between the application and the database. - **Access control.** Production access is limited to named administrators; servers accept SSH only with keys and only from allow-listed addresses; administrative panels are reachable only over HTTPS. Customer-facing access is governed by per-user accounts, roles and scoped API keys. - **Credentials and secrets.** Passwords are stored as salted scrypt hashes; API keys are stored only as hashes and shown once; provider credentials live in environment configuration, not in code; secrets are redacted from stored execution traces. - **Isolation.** Agent tools, browsers and security tools run in per-conversation containers with network rules that block private networks, Ablit's internal services and cloud metadata addresses. - **Logging and monitoring.** Centralised metrics, logs and error reporting on Ablit-hosted systems; health checks every five minutes with alerting to administrators; abuse and child-safety incidents alert a person. - **Backups and resilience.** Nightly database dumps and daily provider-level server backups, both rotated on a 7-day schedule; managed, redundant hosting for the application tier. - **Secure development.** Code review through pull requests, automated build checks on every change, dependency vulnerability audits, and a published security contact (`/.well-known/security.txt`). - **Data minimisation and retention.** Card data never touches Ablit's systems; deletion in the product takes effect immediately in the live database; retention periods are published in the Privacy Policy. - **Personnel.** Access to production is limited to people who need it to operate the Services, under confidentiality obligations. - **Sub-processor management.** Written agreements, published list with locations, advance notice of changes. - **Incident response.** A defined process for triage, containment, notification (section 6) and post-incident review. - **Physical security.** Provided by the hosting providers' certified data centres (Hetzner, Vercel's cloud providers). ## Annex 3: Transfer details - **Data exporter:** the Customer. - **Data importer:** Ablit, for Customer Personal Data it transfers to Sub-processors outside the EEA on the Customer's behalf; and each such Sub-processor as further importer under its own SCCs with Ablit. - **Clause 7 (docking):** applies. - **Clause 9 (sub-processors):** Option 2, general written authorisation, 14 days' notice. - **Clause 11 (redress):** the optional language does not apply. - **Clause 13 (supervision):** the supervisory authority of the EU member state where the Customer is established, or otherwise the Irish Data Protection Commission. - **Clause 17 (governing law):** the law of Ireland (the SCCs require the law of an EU member state; the Agreement itself is governed by Wyoming law). - **Clause 18 (forum):** the courts of Ireland for disputes under the SCCs. - **Annex I of the SCCs:** Annex 1 of this DPA. **Annex II of the SCCs:** Annex 2 of this DPA. - **UK Addendum:** Table 1 parties as above; Table 2 the EU SCCs as incorporated here; Table 3 the Annexes above; Table 4 either party may end the Addendum as set out in section 19 of the Addendum.