Our standard DPA, the sub-processors we use, and how to execute the agreement.
Our standard DPA is incorporated by reference into your Aigenta subscription. For a signed copy with your company name on it, email [email protected] with your legal entity name and signing contact. We use HelloSign and turn around requests within two business days.
The DPA includes Standard Contractual Clauses (Commission Decision 2021/914/EU) for transfers to processors outside the EEA.
You are the controller of personal data processed through your assistant. Aigenta is the processor. For the website analytics on aigenta.app itself, Aigenta is the controller.
We engage the following sub-processors to deliver the service. We notify customers 30 days before adding a new one — subscribe at [email protected].
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, KMS | EU (Frankfurt), US (Virginia) |
| Anthropic, PBC | LLM inference (zero retention) | US |
| Stripe, Inc. | Payment processing | US, EU (Ireland) |
| Resend | Transactional email | US |
| Cloudflare | CDN, DDoS protection, DNS | Global edge |
| Twilio | SMS notifications (opt-in) | US, EU (Ireland) |
| Linear | Internal task tracking (no customer data) | US |
| Notion | Internal docs (no customer data) | US |
Detailed in Annex II of the DPA: encryption (in transit and at rest), access controls (RBAC + JIT), backups, business continuity, incident response, and personnel training. Full text on request.
EU customer data is hosted in eu-central-1 (Frankfurt). Where transfers to third countries occur (e.g., LLM inference, payments), they're governed by SCCs and transfer impact assessments are available.
Once per twelve-month period, customers may audit Aigenta's compliance with the DPA. In practice, we satisfy audit obligations with our SOC 2 Type II report (available under NDA).
The DPA applies for the duration of your subscription. On termination, we delete customer personal data within 90 days unless retention is required by law (e.g., billing records under tax law).