Data Processing Agreement (DPA) — Template

Status: Approved for use (counsel sign-off 2026-05-09). Per-customer instances live with counsel, not in this repo — this template is the authoritative starting point.
Last updated: 2026-05-09
Applies to: All Puccha tenants (free, team, business, growth, enterprise). Enterprise tier may negotiate per-clause amendments.
Next review: on any sub-processor change (per §6 30-day pre-notice rule), any regulatory change in TH/EU jurisdictions, or annually (next: 2027-05-09).

This is the engineering-supplied factual baseline. Counsel adapts wording for execution.

1. Parties

Processing activities: knowledge-base RAG, conversation logging, AI-generated answer drafting, chat attachments (ADR-0043), ticket management, billing.
Duration: while the tenant has an active subscription + retention period thereafter.

Per service module:

Module	Purpose
RAG	Index tenant-uploaded documents and answer visitor questions
Conversations	Persist visitor ↔ assistant ↔ agent threads for support context
Attachments (ADR-0043)	Accept, store, optionally AI-process, and return to tenant agents the images visitors upload during chat
Tickets / SLA	Track open issues to compliance SLA
Billing	Generate invoices, report usage

Standard: name, email, phone (where provided)
Pseudonymous: visitor cookie ID, conversation ID, message ID, audit IDs
Sensitive (Art 9 / PDPA §26): present when visitors voluntarily upload images containing biometric, health, racial, religious, or other special-category data — see DPIA docs/compliance/dpia-attachments.md

Tenants MUST be notified 30 days before a new sub-processor is engaged. This list is the authoritative current state.

Sub-processor	Service	Data	Region	Transfer mechanism
Cloudflare, Inc.	Workers, D1, R2, KV, Vectorize, AI Gateway, Email Sending, Workers AI	All categories above	Singapore (APAC primary) + global edge	CF DPA + Standard Contractual Clauses (signed)
Anthropic, PBC	Claude Haiku 4.5 (text + vision) inference	Text content of conversations + (with phase-1 attachments) image bytes for vision turns	US-WEST-2 primary; EU available on Enterprise plan	Anthropic Enterprise + Zero Data Retention addendum (signed 2026-05-09 — input bytes are not retained beyond inference; no 30-day abuse-monitoring window applies) + SCCs
Cohere, Inc.	Rerank v3.5	Text query + retrieved chunk text	US	Standard Contractual Clauses (signed)
Sentry GmbH	Application error monitoring	Stack traces, redacted request metadata. No attachment URLs or bytes (scrubbed in `beforeSend`).	EU + US per project config	EU SCCs + UK addendum
Stripe, Inc.	Payment processing	Tenant billing details only — no visitor data	US + EU	Stripe DPA + SCCs

Resend is NOT in this list — see ADR-0042.

The controller (tenant) warrants:

Lawful basis for the data they instruct Puccha to process
That visitors are informed and have consented as appropriate to the controller’s jurisdiction
That tenant agents accessing visitor data are bound by appropriate confidentiality
For ADR-0043 attachments specifically: that the controller’s privacy notice covers visitor-uploaded files, AI processing where enabled, and sub-processor disclosure

Puccha:

The controller is the primary contact for data subjects. Puccha provides:

Right	API surface	SLA
Access	`GET /api/visitors/{id}/export` (signed-URL ZIP including attachments)	30 days; target same-session
Rectification	per-attachment delete in widget; per-message edit (admin)	Same-session
Erasure	`DELETE /api/visitors/{id}/data` (cascading R2 + D1 + Anthropic Files API + audit-log tombstones)	30 days
Restriction	tenant flag `processingPaused` on visitor row	Immediate
Portability	same export endpoint, JSON manifest + binaries	30 days
Withdraw consent	revoke flag; forward-only (past uploads survive until erasure)	Immediate

Domain	Measure
Encryption in transit	TLS 1.3 enforced (HSTS, no fallback)
Encryption at rest	AES-256 default on all sub-processors
Access control	RBAC (owner / admin / editor / viewer per tenant); MFA for agent accounts (MFA ADR pending)
Network	CF WAF rules; Worker-level rate limits; KV-backed session limits
Application	Strict CSP, HSTS, X-Content-Type-Options, prompt-injection wrapping in `<context>` blocks
Logging	Immutable audit log (ADR-0023); per-event read logs for attachments (ADR-0043 §“Access controls”)
Backup / availability	CF R2 11-9s durability; D1 daily backup (`d1-backup.yml`)
Incident response	72-hour breach notification; runbook at `docs/security/runbooks/attachment-breach.md`
Sub-processor management	§6 list; 30-day pre-notice on changes
Data minimisation	Filename hashing, no PII in audit log payloads, scrubbing in Sentry beforeSend
Personnel	Confidentiality agreements; background checks for staff with prod access

On contract termination:

Live tenant data retained for 30 days post-termination (allows reactivation without data loss)
After 30 days: hard-delete from D1, R2, AI Gateway logs
Audit-log tombstones survive per §“Tombstone retention” — they record that data existed and was deleted, not what the data was

PDPA §28 — controller acknowledges transfers to Singapore (R2 APAC), US (Anthropic, Cohere, Sentry-US), and EU (Sentry-EU) under the safeguards listed in §6.
GDPR Chapter V — SCCs in place for all extra-EU transfers.

Puccha notifies the controller within 24 hours of becoming aware of a breach affecting controller data.
Controller is responsible for onward notification to data subjects (where required) and supervisory authority (PDPC / EU DPA) within 72 hours per their jurisdiction.
Joint runbook: docs/security/runbooks/attachment-breach.md.

SOC 2 Type II audit is on our roadmap (not yet certified); controls/readiness documentation and our security posture summary available to enterprise tenants on request. This DPA will be updated when the report is available.
Customer-led audit on 30-day notice, scoped to controls relevant to the controller’s data; cost recoverable from controller.

— counsel boilerplate; not in scope for this template scaffold —

— counsel boilerplate; default Thailand, with arbitration option for international tenants —