Data Processing Agreement

This DPA applies to all personal data processed by Zod in the course of providing the Service to the customer. For the purposes of this DPA:

• Data Controller is the customer who determines the purposes and means of processing personal data
• Data Processor is Zod, which processes personal data on behalf of and under the instructions of the controller
• Personal data means any information relating to an identified or identifiable natural person as defined under applicable data protection laws
• Processing means any operation performed on personal data, including collection, storage, use, disclosure, and deletion

This DPA does not apply where Zod acts as an independent data controller of personal data, such as account information collected for Zod's own business purposes (governed by the Privacy Policy).

Zod will:

• Process personal data only on documented instructions from the controller, unless required to do otherwise by applicable law (in which case Zod will inform the controller of that legal requirement before processing, unless prohibited by law)
• Ensure that persons authorized to process the personal data are subject to obligations of confidentiality (contractual or statutory)
• Implement appropriate technical and organizational security measures as described in Section 8
• Not engage another processor (subprocessor) without prior specific or general written authorization from the controller
• Assist the controller by appropriate technical and organizational measures to respond to requests from data subjects exercising their rights under applicable data protection law
• Assist the controller in ensuring compliance with obligations regarding security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities
• At the choice of the controller, delete or return all personal data after the end of the Service term
• Make available to the controller all information necessary to demonstrate compliance with this DPA and allow for audits as described in Section 12

Zod will assist the customer in fulfilling its obligations to respond to data subject requests under applicable data protection law. If Zod receives a request from a data subject directly, Zod will:

• Promptly forward the request to the customer (the controller)
• Not respond to the request without the customer's prior instruction, except to confirm that the request has been forwarded
• Provide the customer with the ability to access, correct, delete, or export personal data through the Service's built-in functionality
• Assist with additional requests that cannot be fulfilled through the Service's self-service features

The customer is responsible for responding to data subject requests within the timeframes required by applicable law.

Zod maintains appropriate technical and organizational security measures to protect personal data, including:

• Encryption: AES-256 encryption at rest for all data stores; TLS 1.2+ encryption in transit for all network communications
• Access controls: Least-privilege access principles with multi-factor authentication enforced for all production access
• Infrastructure security: SOC 2 Type II certified; annual penetration testing by independent third parties; vulnerability scanning; intrusion detection
• Personnel security: Background checks where permitted; confidentiality agreements; security awareness training; role-based access controls
• Incident response: Documented incident response plan with defined escalation procedures; 24/7 security monitoring
• Data segregation: Customer data segregated by account with strict access controls between tenants
• Physical security: Data hosted in AWS data centers with industry-standard physical security controls (access cards, biometrics, surveillance, 24/7 guards)

Zod's SOC 2 Type II report is available under NDA upon request. See our Security page for additional details.

Zod will notify the customer without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach affecting the customer's data. The notification will include:

• A description of the nature of the breach, including the categories and approximate number of data subjects and records concerned
• The name and contact details of Zod's data protection officer or security contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach and mitigate its adverse effects

Zod will cooperate fully with the customer in investigating and remediating the breach. Zod's obligations under this section do not apply to breaches that are unlikely to result in a risk to the rights and freedoms of natural persons.

Zod will make available to the customer all information necessary to demonstrate compliance with this DPA. This includes:

• SOC 2 Type II audit reports (available under NDA)
• Penetration testing summaries
• Information security policies and procedures overview

The customer may request an audit of Zod's processing activities not more than once per 12-month period, at the customer's expense. Audits will be conducted during normal business hours with reasonable notice and will not unreasonably interfere with Zod's operations. If Zod's SOC 2 Type II report or equivalent certification demonstrates compliance, no additional audit rights are triggered.