Data Processing Agreement

Summary version — full DPA available on request.

Subject matter

Operayde acts as a data processor on behalf of the customer (data controller) for any personal data processed through the appliance and the central plane. The appliance processes prompts, documents, and retrieval content locally. The central plane processes fleet/billing metadata plus, for every gateway request, a metering row (tokens, model, latency, virtual-key id, outcome, guardrail flags) and SHA-256 hashes of the prompt, response and message array — never the prompt or response content itself. Hashes and metering are retained per the retention policy in Annex II and are physically unreadable content, including to Operayde staff. See our privacy policy for the full technical description and the customer-side verify flow.

Sub-processors

We maintain a current list of sub-processors at /legal/sub-processors. Changes require 30 days' notice and give the customer a right to object.

Security measures

Summarised on our security page. The DPA references ISO 27001 Annex A controls and our implementation statements.

Request the full DPA

Email legal@operayde.com and we’ll send the countersigned PDF within one business day.