Data Processing Agreement

Draft — pending review by counsel. Last updated: [DATE]. Bracketed items are placeholders awaiting confirmation.

A Data Processing Agreement (DPA) is the contract that governs how RedactBot processes personal data contained in your documents on your behalf — required under the GDPR and similar laws when a processor handles personal data for a controller.

A signed DPA is available to Premier and Enterprise customers. To execute one, contact sales@redactbot.app.

What the DPA covers

  • Parties: you (the customer, as controller or as a processor acting for your own clients) and Kobargo Technology Partners [legal entity — PLACEHOLDER] (as processor).
  • Subject matter: the processing of personal data contained in documents uploaded to RedactBot and in associated account and usage records.
  • Duration: the term of your subscription, plus the deletion windows described in the agreement.
  • Nature and purpose: storage, rasterization, OCR, detection, review, permanent redaction, verification, and generation of privilege logs, certificates, and audit records — solely to provide the service.
  • Categories of data and data subjects: determined by the documents you upload; typically identifiers of parties, witnesses, employees, patients, or customers appearing in legal and business records. [PLACEHOLDER — annex to enumerate.]
  • Subprocessors: Supabase (database, storage, authentication — AWS us-west-1), Cloudflare (hosting, compute, analytics), [AI model provider — to be named] (AI detection on the Pro and Premier plans), Stripe (payments), and Resend (transactional account email — United States), mirroring the list in our Privacy Policy. AI detection on Pro and Premier runs through one managed AI gateway operated for RedactBot; your document text is sent only to return detections and is never used to train models. An AI endpoint you connect yourself (Enterprise) is engaged by you, not by us, and is not our subprocessor.
  • Security measures annex: the technical and organizational measures described on our Security page — permanent burn-in with verification, hash-chained audit trail, encryption in transit and at rest, and account isolation. [PLACEHOLDER — formal TOMs annex.]
  • International transfers: [PLACEHOLDER — Standard Contractual Clauses (SCCs) module selection and transfer impact assessment, pending counsel review.]

This page describes the DPA; it is not itself the agreement. The executed document controls.