Data Processing Addendum

1. Roles

For personal data contained in Customer Data, Customer is the controller and Cirvix is the processor. Where Customer is itself a processor acting for a third-party controller, Cirvix acts as a sub-processor and Customer confirms it has the authority to instruct Cirvix on that controller's behalf.

For account data — the names and email addresses of Customer's own administrators, billing contacts, and support correspondence — Cirvix is an independent controller and processes that data to operate and secure the service.

2. Scope and instructions

Cirvix processes personal data only on Customer's documented instructions, which are the Agreement, this Addendum, and Customer's configuration of the service. Cirvix will notify Customer if it believes an instruction infringes applicable data protection law, unless legally prohibited from doing so.

Cirvix does not sell personal data, does not share it for cross-context behavioural advertising, and does not use Customer Data to train models.

3. What Cirvix actually processes

The nature of the service determines the data. Cirvix records authorization decisions: the agent identity, the accountable owner, the action, the resource identifier, the policy that matched, the verdict, any approver, and timing. Where an agent's tool call carries arguments, those arguments are recorded as part of the decision record.

Cirvix does not receive or store secret values. Agents hold opaque handles; the underlying credential is resolved from Customer's own vault at the network boundary and is never written to a trace or an audit record. This is a property of the architecture rather than a policy commitment — see the Secrets module.

Categories of data subject are determined by Customer's use, and typically comprise Customer's personnel and any individuals referenced in the systems an agent is authorized to reach.

4. Sub-processors

Customer authorises Cirvix to engage sub-processors for infrastructure, communications, and support. Cirvix maintains a current list and will give at least thirty days' notice before adding or replacing one, during which Customer may object on reasonable data-protection grounds.

Cirvix imposes data protection obligations on each sub-processor no less protective than those in this Addendum and remains liable for their performance.

5. Security

Cirvix implements technical and organisational measures appropriate to the risk, including encryption in transit and at rest, least-privilege access controls, tenant isolation, and an append-only audit record for administrative actions.

Cirvix has not completed a SOC 2 Type II audit or an ISO 27001 certification. Where a security-questionnaire response or an independent report is required for procurement, that position is stated plainly rather than implied to be otherwise.

6. Personal data breach

Cirvix will notify Customer without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably required for Customer to meet its own notification obligations.

7. International transfers

Where personal data is transferred out of the EEA, the UK, or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, which are incorporated into this Addendum by reference.

Customers on a single-tenant deployment may specify a processing region; in that configuration Customer Data remains in the region selected.

8. Data subject requests

Taking into account the nature of the processing, Cirvix will assist Customer by appropriate technical and organisational measures in fulfilling requests to exercise data subject rights. Where Cirvix receives such a request directly, it will refer the individual to Customer rather than respond on Customer's behalf.

9. Deletion and return

On termination, Cirvix will delete Customer Data within thirty days, except where retention is required by law. Audit records are retained for the life of the deployment, because deleting them on request would defeat the tamper-evidence property they exist to provide. There is no automatic pruning and no configurable retention window today; where a shorter period is required, it is agreed in writing and performed manually.

10. Audits

Cirvix will make available the information reasonably necessary to demonstrate compliance with this Addendum and will contribute to audits conducted by Customer or an auditor it mandates, on reasonable notice, no more than once in any twelve-month period except where required by a supervisory authority.