Data Processing Agreement

Effective: 2026-10-12, as published at https://ergoda.com/dpa/
Version: 1
Every version: ergoda.com/legal/#versions, each at its own URL.

This DPA forms part of the Terms of Service between Maffen Oy (the "Processor", "we") and the customer named in the account (the "Controller", "you"). It applies where we process personal data on your behalf. On any conflict about personal data, this DPA prevails over the Terms.

By accepting the Terms you accept this DPA; no signature is required. If you need a countersigned copy, email legal@ergoda.com and we will sign one.

1. Roles

You are the controller, or a processor acting for your own controller. We are the processor, or your sub-processor. For personal data in what you send us (derived metrics, and any tool catalogue you submit), you determine the purposes and means of processing and we act only on your instructions.

We are an independent controller for our own account, billing and security data; that is covered by the Privacy Policy, not by this DPA.

This DPA does not apply where you run the Software without an account with us (Terms §3). In that case the Software sends us nothing and we process no personal data on your behalf.

2. Instructions

We process personal data only:

• to provide the Service as described in the Terms and configured by you;
• on your further documented instructions; or
• where EU or Member State law requires it, in which case we tell you first unless the law forbids that.

We will tell you if we think an instruction breaches data protection law, and we will not carry out an instruction we believe to be unlawful.

We do not use your data to train models or for our own purposes, except for the aggregation described in §11, which contains no personal data.

3. Confidentiality

Everyone we allow to process your data is bound by confidentiality and is granted access only to what their role requires.

4. Security

We implement the technical and organisational measures in Annex II, taking account of the state of the art, cost, and the risk to data subjects. We may change them, but not in a way that materially lowers the level of protection.

The control plane never receives payloads. It receives derived metrics (step identifiers, agreement scores, outcome signals, hashes, counts, latencies and costs), not prompt or response content, and no setting changes this. The only content it can receive is a tool catalogue (tool names, descriptions and argument schemas) that you submit for classification, recorded under the name of the person who submits it. A submitted catalogue is retained under §9, and you can withdraw it at any time, which deletes it.

5. Sub-processors

You give general authorisation for the sub-processors listed in Annex III.

We will give you 30 days' notice by email before adding or replacing one. If you reasonably object on data protection grounds within those 30 days, we will work with you to find an alternative; if we cannot, you may terminate the affected part of the Service and we refund prepaid unused fees for it.

We impose the same data protection obligations on every sub-processor and remain fully liable to you for their performance.

6. Shadow calls

• We do not make shadow calls. The Software makes them, in your infrastructure, directly to the provider, and the Service never receives their content. A model provider is therefore not our sub-processor; your own agreement with it governs what it does with the data.
• Every shadow-call target requires your opt-in. The allowlist denies by default: a request to a model, provider or region not on your list is refused, not routed, and the refusal is written to the Software's append-only audit log. No provider is enabled by default, and we do not add providers to your allowlist.
• Nothing is redacted before the call. A shadow call carries the request as your application made it. You must remove anything that must not reach the provider before the request reaches the Software.
• Shadow calls use a separate API key you provision, are limited by a hard daily token budget you set, and back off on rate limits.

7. Assistance

We will help you respond to data subject requests, taking account of the nature of the processing, by appropriate technical and organisational measures. Because the control plane never receives payloads, we usually hold no personal data about the individual concerned, and we will confirm this in writing so you can pass it on. If a data subject contacts us directly, we will forward the request to you and will not respond to its substance ourselves.

We will also assist you in meeting your obligations under Articles 32 to 36 of the GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with a supervisory authority), taking account of the nature of the processing and the information available to us.

8. Breach notification

We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time: nature of the breach, categories and approximate numbers affected, likely consequences, and the measures taken. We update you as we learn more, and we do not delay the first notification until the investigation is complete.

9. Retention, return and deletion

On termination we delete or return your personal data at your choice, within 30 days, and delete existing copies unless EU or Member State law requires us to keep them. Data in the point-in-time history and in the off-site copy is not deleted individually; it ages out on the cycles above, so a copy made before a deletion is gone no later than 35 days after it.

10. Audits

We will make available the information needed to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by you or an auditor you mandate.

We answer requests for information in writing at no charge, and answer security questionnaires within 10 working days. An on-site or on-system audit is limited to once a year, requires 30 days' notice, takes place during business hours, is subject to confidentiality and is at your cost, unless it finds a material breach by us, in which case we bear the cost. Where we hold a current third-party report or certification that answers your question, we may offer that instead.

11. Aggregated statistics

We derive cross-customer statistics ("priors") from derived metrics. They contain no prompt or response content and no per-customer identifier, they describe step archetypes rather than any customer's business, they are aggregated over a published minimum number of contributing customers with a cap on any one customer's share, and you can opt out of them at no price penalty in the dashboard or by email.

Because they contain no personal data, they are not deleted on termination.

The Service has no means of receiving traces for a shared corpus. If one is offered, it will require a separate, explicit opt-in, will never be bundled with the priors setting, and will be revocable.

12. International transfers

Where we or a sub-processor transfers personal data outside the EEA, the transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated into this DPA by reference and completed by the Annexes below. Where the UK GDPR applies, the UK International Data Transfer Addendum applies alongside them. Where a sub-processor is certified under the EU–US Data Privacy Framework, we may rely on that instead.

For the purposes of the SCCs: the Annexes below serve as Annexes I, II and III of the SCCs; the governing law is Finnish law; the forum is the courts of Finland; and the optional docking clause applies.

13. Liability

Liability under this DPA is subject to the limitations in the Terms §17, except where the GDPR or other mandatory law says otherwise.

14. Term

This DPA runs for as long as we process personal data on your behalf, and its obligations survive termination for as long as we hold any of it.

Annex I — The processing

Parties. Controller: the customer named in the account. Processor: Maffen Oy, business ID 3633966-3, Kahlojantie 18a, 21420 Lieto, Finland, contact legal@ergoda.com.

Subject matter. Verification of AI model routing: measuring agreement between models on the controller's own steps and reporting the result.

Duration. The term of the Terms of Service, plus the retention periods in §9.

Nature and purpose. Receiving derived metrics; computing agreement rates, thresholds and costs; classifying and storing tool catalogues the controller submits; storing an audit log of policy decisions; producing reports and an attestation record. Shadow calls to model providers are made by the Software in the controller's infrastructure, not by the processor (§6).

Categories of data subjects. Determined by the controller. Typically: the controller's own end users and customers, and the controller's personnel whose interactions appear in agent traces.

Categories of personal data. Determined by the controller. We receive derived metrics (identifiers, hashes, scores, counts, timestamps, costs), which we do not expect to contain personal data, and a tool catalogue only when the controller submits one; a catalogue describes the controller's tools and names the person who submitted it. We never receive the controller's prompts or responses.

Special category data. Not expected and not requested. The controller must not send it without agreeing additional measures with us in writing first.

Frequency. Continuous, for as long as the controller's agents run.

Annex II — Security measures

• Data minimisation. The control plane never receives payloads: it receives derived metrics, and a tool catalogue only when the controller submits one.
• Encryption. TLS in transit; encryption at rest for the database and its point-in-time history.
• Access control. Access limited to personnel who need it. API keys are the credential for the controller's software; they are hashed at rest and revocable and rotatable from the dashboard or on request. People sign in to the dashboard through WorkOS with a verified email address, reach a site only as its owner or someone the owner invited, and act with the role they were given; we do not store passwords.
• Default-deny allowlist of (model, provider, region), enforced on every shadow call.
• Immutable, append-only audit log of routing and policy decisions, exportable by the controller.
• Append-only metering and billing records, so charges can be reconstructed independently.
• Segregation. Each site's data is keyed and queried by site identifier; aggregation across sites happens only under §11.
• Point-in-time restore of the control-plane database, provided by Neon, to any moment within the restore window configured on the Neon plan in use.
• Encrypted off-site copy. Each night a dump of the control-plane database is encrypted, on the machine that runs the job, with a public key whose private half only we hold, offline. The ciphertext is stored at Cloudflare for 35 days. Cloudflare does not have the key. A retention lock stops it being deleted or overwritten before the 35 days are up, and it is deleted automatically after.
• Availability monitoring, including a dead-man's check on scheduled jobs.
• Deletion on termination under §9.
• Sub-processor controls: written terms imposing equivalent obligations.

Annex III — Sub-processors

Infrastructure

Model providers are not sub-processors

We send nothing to model providers. Every call to one, a shadow call included, is made by the Software in your infrastructure, with your key, to a model on your allowlist, under your own agreement with that provider (§6). The allowlist is part of the routing policy you publish.

The current list is maintained at https://ergoda.com/legal/subprocessors. We give 30 days' notice by email before any change.