Data Processing Agreement

This Data Processing Agreement forms part of the Terms of Service between Neural Arc, Inc., a Delaware corporation trading as ModelBeat, and the customer agreeing to those terms. It applies where you route personal data through the ModelBeat gateway.

Capitalised terms not defined here take their meaning from the General Data Protection Regulation.

You are the controller of the personal data contained in the requests you send and the responses returned to you. We are your processor of it. This document calls that data Customer Personal Data.

This agreement covers only that relationship. Personal data about you, meaning your account, your users and your billing, is data for which we are the controller, and it is governed by the Privacy Policy rather than by this agreement. The distinction matters: the policy is a notice, this is a contract.

Where you are yourself a processor acting for a third party, you warrant that you have that party's authority to appoint us as a sub-processor.

We process Customer Personal Data only on your documented instructions, which for these purposes are this agreement, the terms, and the configuration you set in the console or through the API, including your routing policy, your model allow list, and any residency restriction you apply.

We will tell you if, in our opinion, an instruction infringes data protection law. We may decline to act on an instruction that would require us to break the law.

Where a law we are subject to requires us to process beyond your instructions, we will tell you before doing so, unless that law prohibits us from telling you.

Processing lasts for as long as your account is open, and ends as set out in the deletion section below. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex A.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidence, by contract of employment or by a written undertaking, that survives the end of their engagement. Access is limited to those who need it in order to provide the service, and is reviewed.

We implement the technical and organisational measures set out in Annex B, having regard to the state of the art, the cost of implementation, and the risk to data subjects.

We may change a measure, but not in a way that materially reduces the overall level of protection.

You give general authorisation for us to appoint sub-processors. The current list is at Annex C.

Before adding or replacing a sub-processor that will process Customer Personal Data, we will give you at least 30 days' notice by email or in the console. If you object on reasonable data protection grounds within that period, we will work with you in good faith to find an alternative, for example a routing restriction that excludes the provider in question. If we cannot, you may terminate the affected service and receive a refund of unused credit up to the amount you paid us, and that is your sole remedy.

Every sub-processor is bound by written terms imposing obligations equivalent to those in this agreement. We remain liable to you for their performance.

Because routing is a per request judgement, the provider that serves any given request may vary within the authorised list. Where you need certainty about which providers may serve you, the routing policy and residency restriction on your account are the mechanism for it.

If a data subject contacts us directly about Customer Personal Data, we will not respond substantively. We will direct them to you and tell you promptly.

We will assist you in responding to data subject requests by appropriate technical and organisational measures, taking into account the nature of the processing.

We will assist you, taking into account the nature of the processing and the information available to us, with your obligations relating to security, breach notification, and data protection impact assessments.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed to address it. Where we cannot provide all of that at once, we will provide it in phases without undue further delay.

Notifying you is not an admission of fault by either of us.

On termination, and at your choice, we will delete or return Customer Personal Data and delete existing copies, within 30 days.

Two exceptions apply, both required by law rather than chosen by us:

• The credit ledger and the audit log are append only and are retained for seven years as financial and security records. Neither contains prompt or response content. Where a ledger or audit entry identifies a person, we pseudonymise that identifier where lawful rather than delete the entry.
• Where a law we are subject to requires retention, we retain only what that law requires, for only as long as it requires, and we continue to protect it under this agreement.

Because prompt and completion content is not retained in the ordinary course, there is usually nothing to delete or return beyond account level records.

We will make available the information reasonably necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections, conducted by you or by an auditor you mandate.

So that this is workable for both of us:

• We will first offer our then current third party audit report or certification where one exists. We do not hold SOC 2 Type 2 or ISO/IEC 42001 today, and we will not represent otherwise. Where no report exists, we will answer a reasonable security questionnaire instead.
• On site inspection is available on 30 days' notice, no more than once in any twelve months unless a breach or a supervisory authority requires otherwise, during business hours, subject to confidentiality, and in a manner that does not give access to any other customer's data.
• Each party bears its own costs, except where an audit reveals material non compliance by us, in which case we bear both.

We operate from the United States and India, and our sub-processors operate in several countries.

Where Customer Personal Data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer is made under the Standard Contractual Clauses set out in Annex D, or another valid transfer mechanism, together with the measures in Annex B.

Where you have set a residency restriction on your account, we enforce it in routing before a request is dispatched. A request that cannot be served within the restriction is refused rather than routed outside it.

Each party's liability under this agreement is subject to the exclusions and the cap in the Terms of Service, and that cap is aggregate across the terms and this agreement rather than separate for each.

Nothing in this section limits either party's liability to a data subject under the Standard Contractual Clauses, or any liability that cannot lawfully be limited.

This agreement takes effect when you accept the Terms of Service and continues for as long as we process Customer Personal Data. If any provision is held unenforceable, the remainder stays in force. This agreement is governed by the law stated in the terms, except that the Standard Contractual Clauses are governed as they themselves provide.

Subject matter

Provision of the ModelBeat routing and orchestration gateway.

Duration

The term of your account, plus the deletion period set out above.

Nature and purpose

Receiving a request, selecting a model capable of serving it, transmitting the request to that model's provider, returning the response, and recording metadata about the call for billing, quality measurement and audit.

Categories of data subject

Whoever your end users choose to include in a request. ModelBeat does not determine this and does not inspect it. Typically your own users, employees or customers.

Types of personal data

Whatever you include in request content. ModelBeat does not select, inspect or categorise it. You are responsible for what you send, and the Acceptable Use Policy restricts certain categories.

Special categories

Not expected. Permitted only where you have a lawful basis for the processing and have told us, so that residency and routing can account for it.

Frequency

Continuous, per request.

Retention

Request content is not retained. Metadata about each call, meaning token counts, cost, the model served, latency, timestamps and the routing decision, is retained in line with our retention schedule. Ledger and audit records are retained for seven years.

Three points that are not obvious from the table, stated explicitly:

• Where content aware routing is enabled on your account, the router reads request text transiently and in memory in order to derive closed vocabulary routing labels. No request text is stored or logged, and only the labels persist. This is disabled by default.
• We do not train models on Customer Personal Data. There is no setting that enables it.
• Request content is transmitted to the model provider that serves the request. That provider processes it under the terms described in Annex C.

Data minimisation is the primary control. It is the most effective measure in this annex, because most confidentiality risks do not arise when the data is not there.

• Prompt and completion content is not retained. It is processed in order to serve the request and is not written to any store.
• Logging records metadata only. No code path writes request content to a log or to a table.
• Support staff cannot retrieve the text of a request, because it does not exist to retrieve.

Encryption.

In transit, client to edge

TLS 1.2 or above, with HSTS.

In transit, between internal services

Mutual TLS over gRPC.

In transit, to providers and to the database

TLS with verified certificates.

At rest, database

Storage encryption under a dedicated, customer managed KMS key with rotation enabled. TLS is enforced server side and automated backups are encrypted.

At rest, object storage and snapshots

Server side encryption with KMS managed keys.

API keys issued by ModelBeat

Stored as a one way SHA-256 hash, never as recoverable ciphertext. The secret is displayed once at creation and is never persisted or logged.

Card data

None is held anywhere. Payments run through hosted checkout at Stripe and no card number reaches our systems.

Secrets

Held in a managed secrets store, fetched at process start, never written into a build artifact or a source file.

Access control and tenant isolation.

• Every tenant scoped table enforces database row level security in FORCE mode, derived from the authenticated credential. The browser never supplies a tenant identifier.
• Cross tenant reads are possible only through narrowly scoped definer functions, each of which returns a single value and cannot mutate data. No role in the system holds a bypass privilege.
• Internal staff access to the operator console requires a separate identity pool with multi-factor and step up authentication.
• Balance adjustments require separation of duties: one operator proposes, a different operator decides.
• Production access is limited to those who need it and is reviewed.

Accountability and resilience.

• Every privileged mutation writes an immutable audit entry in the same database transaction as the action itself. A failed audit write fails the action.
• The credit ledger is append only, enforced by database triggers and by revoked privileges rather than by application convention.
• Operator actions are recorded in a separate, hash chained operator audit log.
• Automated encrypted backups with point in time recovery on the production database, and deletion protection enabled on the production cluster.

Stated rather than implied, so that the annex above can be checked against the system rather than taken on trust.

SOC 2 Type 2

Not held. In progress.

ISO/IEC 42001

Not held. Alignment in progress.

Customer managed encryption keys

Not offered.

Automated retention purge

Not implemented. Retention periods are policy, not yet enforced by a scheduled job.

Mechanised data subject export and erasure

Not implemented. Requests are handled manually within the period set out above.

Multi-factor authentication for customer console users

Deferred and formally risk accepted. Operator accounts do have it.

Authorised as at the version date of this agreement. The current list is also available on request.

Amazon Web Services, Inc.

Compute, database, storage, key management, secrets management, console sign in, transactional email, and Amazon Bedrock, the model serving platform for most of the catalogue. Processes all categories, including request content transiting Bedrock. United States, us-west-2, inside ModelBeat's own AWS account.

Stripe, Inc.

Payments and prepaid credit. Billing identifiers only, no request content, and no card data on our side. United States, with the European Union as failover.

Fireworks AI, Inc.

Model serving for part of the catalogue. Processes request content for requests routed to it. United States.

Sendinblue SAS, trading as Brevo

Transactional authentication email: verification, password reset and account notice messages. Processes the recipient's email address and the code contained in the message. European Union, France.

Self hosted software is not a sub-processor. Open source components that we run ourselves on our own cloud account do not introduce a third party. The cloud provider is the sub-processor for that infrastructure and is listed above.

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the following apply.

European Economic Area

The Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two, controller to processor, incorporated by reference, with ModelBeat as data importer and you as data exporter.

United Kingdom

The UK International Data Transfer Addendum to those Clauses.

Switzerland

Those Clauses as amended by the Swiss Federal Data Protection and Information Commissioner.

Where you are yourself a processor, Module Three applies instead.

For the purposes of the Clauses: Annex I is Annex A and Annex C of this agreement, Annex II is Annex B, the competent supervisory authority is that of your place of establishment, the optional docking clause applies, and the governing law and choice of forum are as the Clauses provide.