Scope and roles
This Data Processing Agreement (DPA) forms part of the agreement between YTT SECUNET PRIVATE LIMITED and the customer and applies whenever YTT Secunet processes personal data on the customer's behalf. The customer is the controller, or a processor acting for its own client, and YTT Secunet is the processor or subprocessor. The DPA is written to meet Article 28(3) of the GDPR and the UK GDPR and the equivalent requirements of the Swiss revFADP. For processing subject to India's Digital Personal Data Protection Act, 2023, the customer is the Data Fiduciary and this DPA is the contract under which it engages YTT Secunet as a Data Processor.
On data protection matters this DPA prevails over the rest of the agreement, and the standard contractual clauses, where they apply, prevail over both. The DPA applies by reference; customers who want a countersigned copy can request one from legal@yttsecunet.com.
Processing details
These details form Annex I.B of the standard contractual clauses where those apply.
- Subject matter: routing the customer's AI inference requests to endpoints admitted by its policy, with policy evaluation, detection and masking of personal data, and generation of residency receipts.
- Duration: the term of the agreement, plus the export and deletion periods below.
- Nature: in-memory inspection, masking, pseudonymization and transmission of requests and responses; storage of configuration, pseudonymization vault entries and receipts.
- Purpose: providing the service the customer subscribed to, and no other purpose.
- Categories of personal data: whatever the customer or its users put into prompts or receive in completions, which can include names, contact details, national identification numbers, financial data and, where the customer's policy permits, special categories such as health data; vault mappings between identifiers and tokens; request metadata such as tenant identifiers, timestamps and source IP addresses; and console user account data.
- Data subjects: the customer's end users, employees and clients, anyone named in a prompt, and the customer's console users.
- Retention: prompts and completions are not stored. Receipts are kept for 90 days on Growth, 7 years on Enterprise Sovereign, and as the customer configures on Sovereign Dedicated.
Processor obligations under Article 28(3)
YTT Secunet commits to each element of Article 28(3) as follows.
- Instructions, point (a): we process customer personal data only on documented instructions, which are the agreement, this DPA and the policies the customer deploys, including with regard to international transfers. If we consider an instruction to infringe data protection law, we tell the customer.
- Confidentiality, point (b): everyone we authorise to process the data is bound by confidentiality.
- Security, point (c): we take the measures Article 32 requires, summarised below and forming Annex II of the SCCs.
- Subprocessors, point (d), read with Article 28(2) and (4): we engage them only as the next section allows.
- Data subject rights, point (e): we assist with appropriate technical and organisational measures.
- Articles 32 to 36, point (f): we assist with security, breach notification, DPIAs and prior consultation, taking into account the information available to us.
- Deletion or return, point (g): at the end of the service, as described below.
- Information and audits, point (h): we make available the information needed to demonstrate compliance and allow audits as set out below.
Subprocessors
The customer gives general written authorisation for the subprocessors on our Subprocessors page, which forms Annex III of the SCCs. Before adding or replacing one, we notify the customer at least 30 days in advance through the subprocessor update email list. The customer may object on reasonable data protection grounds within those 30 days. We will then work to resolve the objection, for example by keeping the customer's traffic away from the new subprocessor. If we cannot, the customer may terminate the affected service and receive a refund of prepaid fees for the remaining term.
Each subprocessor is bound by data protection obligations equivalent to this DPA, and we remain liable to the customer for its performance. Model providers the customer connects with its own credentials are engaged by the customer under its own contracts, not by YTT Secunet.
Security measures
The full technical and organisational measures are available in the Trust Center. In summary:
- Zero data retention: prompts and completions stream in memory, are never written to disk and are never used to train models.
- Encryption: AES-256 at rest for receipts, configuration and vault entries; TLS 1.3 in transit.
- Residency: the data plane is selected per tenant by policy, and failover stays inside the same jurisdiction.
- Access control: role-based least privilege, multi-factor authentication, SAML SSO and SCIM on Enterprise, and logging of every administrative access.
- Evidence: every response carries an Ed25519-signed receipt naming the resolved endpoint and provider region, committed to an hourly Merkle tree whose root is published.
- Assurance: SOC 2 Type II, ISO 27001 and ISO 27701, with regular independent penetration testing.
Assistance with DPIAs and data subject requests
For a DPIA or a transfer impact assessment, we provide architecture and data flow descriptions, the list of endpoints and subprocessors by region, our own transfer impact assessment, and compliance report exports covering records of processing and EU AI Act Annex IV evidence. The assessment and its conclusions remain the customer's.
Because prompts are not stored, requests about prompt content are answered by the customer from its own systems. For data we hold, such as vault mappings and console accounts, we locate, export or delete records on the customer's written instruction within 10 business days. Any request we receive directly from a data subject is forwarded to the customer without our answering it.
Personal data breaches
As Article 33(2) requires, YTT Secunet notifies the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, and in any case within 48 hours. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not yet available follows in phases. Notification is not an admission of fault.
Audits
Audits start with evidence. On request, under confidentiality, we provide our current SOC 2 Type II report, ISO 27001 and ISO 27701 certificates, a penetration test summary and answers to a reasonable security questionnaire. Receipts and the published Merkle roots let the customer verify where each request was processed without relying on us.
If that evidence does not answer a specific concern, or a supervisory authority requires it, the customer may run a remote audit once a year on 30 days' notice. On Sovereign Dedicated, on-site audits of the facilities and processes that serve the customer are available on the same notice. Each party bears its own costs, and auditors sign a confidentiality agreement.
International transfers
Data planes keep inference in the region the customer's policy selects, and the control plane runs in Frankfurt am Main with a Paris standby on EU-headquartered infrastructure. A restricted transfer can still occur in three cases: when YTT Secunet staff in India access personal data, when data is held by YTT SECUNET PRIVATE LIMITED as an Indian company, and when the customer's policy routes traffic to a zone outside the EEA.
For those transfers the parties incorporate the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914: Module 2 where the customer is a controller and Module 3 where it is a processor. Clause 7 applies. Under Clause 9 option 2, general authorisation applies with the 30-day notice above. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the clauses are governed by German law and disputes go to the courts of Germany.
- United Kingdom: the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner applies, with its tables completed by reference to this DPA. A customer that prefers the International Data Transfer Agreement (IDTA) may sign it instead.
- Switzerland: for transfers subject to the revFADP, the SCCs apply with these adaptations: the FDPIC is the competent supervisory authority; references to the GDPR include the revFADP; and references to Member States do not prevent data subjects in Switzerland from bringing claims where they habitually reside.
- Government access: we review every legally binding request for customer personal data, challenge it where there are reasonable grounds, disclose the minimum required and notify the customer unless prohibited, as Clause 15 requires. Prompts and completions are never stored, so a later request cannot reach them, and on Sovereign Dedicated the customer holds the signing keys. We do not claim that YTT SECUNET PRIVATE LIMITED is outside the reach of US law.
Deletion and return
When the agreement ends, the customer has 30 days to export configuration and receipts. YTT Secunet then deletes all customer personal data, including vault entries and receipts, within a further 30 days, and backup copies expire within 35 days after that, unless Union or Member State law requires us to keep it. We confirm deletion in writing on request. Questions about this DPA go to dpo@yttsecunet.com.