Data Processing Agreement

Last updated: October 21, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer ("Controller") and WardenAuth, operating WardenAuth ("Processor"). It applies whenever the Processor processes personal data on the Customer's behalf through the Service, and meets the requirements of Article 28 GDPR. It is accepted together with the Terms when the Customer creates an organization. Customers who need a countersigned copy can request one at legal@wardenauthz.com.

1. Subject Matter and Duration

The Processor processes personal data only to provide the Service described in the Terms, for as long as the Customer uses the Service and until the data is deleted under section 9.

2. Nature of the Processing, Data, and Data Subjects

  • Operations: storage, retrieval, evaluation of access policies, audit logging, and deletion.
  • Data subjects: the Customer's users, employees, and end users, and the AI agents acting for them.
  • Personal data: identifiers and email addresses, attributes the Customer chooses to send for policy evaluation, IP addresses and user agents in audit logs, and access decisions.
  • Special categories: none. The Customer will not submit data under Article 9 GDPR unless agreed in writing.

3. Instructions

The Processor processes personal data only on the Customer's documented instructions, which are these Terms, this DPA, and the Customer's configuration of the Service, unless EU or Member State law requires otherwise, in which case the Processor will inform the Customer first unless that law forbids it. The Processor will tell the Customer if it believes an instruction infringes data protection law.

4. Confidentiality and Security

Everyone authorized to process the data is bound by confidentiality. The Processor maintains appropriate technical and organizational measures under Article 32 GDPR, including encryption in transit (TLS 1.2+) and at rest, tenant isolation, least-privilege access with MFA, tamper-evident audit logging, backups, and documented incident response.

5. Sub-processors

The Customer authorizes the following sub-processors, each bound by data protection obligations equivalent to this DPA:

  • Amazon Web Services, Inc. — hosting, databases, authentication, email (us-east-1, United States)
  • Stripe, Inc. — billing (receives only billing contact data, never data stored in the Service)

The Processor will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if no solution is found, the Customer may terminate the affected Service without penalty. The Processor remains liable for its sub-processors.

6. International Transfers

Personal data is stored in the United States. Transfers rely on the EU–US Data Privacy Framework certification of the sub-processors and, as a fallback, on the European Commission's Standard Contractual Clauses.

7. Assistance

Taking into account the nature of the processing, the Processor assists the Customer with data subject requests (the Service lets the Customer view, export, and delete its data through the dashboard and API), with security, breach notification, data protection impact assessments, and prior consultations.

8. Personal Data Breaches

The Processor will notify the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Customer's data, with the information available to help the Customer meet its own obligations under Articles 33 and 34 GDPR.

9. Deletion and Return

The Customer can export its data at any time. When the Customer deletes its organization, its data is deleted from live systems immediately; audit archives are purged unless the Customer enabled compliance-mode retention, in which case they are deleted when that period ends; backups are overwritten within 12 months.

10. Audits

The Processor makes available the information necessary to demonstrate compliance with this DPA, including its security documentation, and allows audits by the Customer or an auditor it mandates, with 30 days' notice, at most once every 12 months unless a breach or a supervisory authority requires otherwise.

11. Liability and Precedence

The liability provisions of the Terms apply to this DPA. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.