Data Processing Agreement

AM8’s Data Processing Agreement (DPA) forms part of our customer terms and sets out how we process personal data on your behalf as a processor, including security measures, sub-processor management, international transfer safeguards and assistance with data-subject requests.

Our DPA incorporates the EU Standard Contractual Clauses where relevant and references the current sub-processor list.

Where AI inference runs. AI inference for document generation, compliance screening, the ARIA advisor, intake assistance, and reports and digests is carried out by Anthropic, our sub-processor, a US provider, under the Standard Contractual Clauses referenced above, through its global service, in which inference may run in any geography Anthropic makes available. Anthropic does not currently offer an EU-region option for the model tier we use. Every Anthropic inference call we make logs its endpoint. Independent verification of generated documents is carried out separately by Mistral AI, in the EU. This is the same posture published on our Trust Center.

End of processing (Article 28(3)(g)). On deletion of your account we destroy the personal data we process on your behalf: your workspace record and the operational data under it, every member’s sign-in identity, every credential you stored with us, and the files we generated for you. A defined class of records is retained rather than deleted, because retaining it is a legal obligation under GDPR Article 17(3)(b) and the EU AI Act’s documentation duties: the audit trail, control test results, collected evidence, sign-offs, overrides, incident reports and the record of how each AI-generated verdict was reached. Control test results are kept 7 years; collected evidence 10. Those records are kept; the people named in them are not. Erasure removes the acting person’s identifier from every retained record that carried it, and destroys the key behind the pseudonym used in AI-decision records, which makes that pseudonym permanently unresolvable, by us included. The record survives intact: it still shows what happened and when, and no longer shows by whom.

Return or delete, at your choice (Article 28(3)(g)). When you close your account you may choose to have all personal data returned to you before any of it is destroyed. The complete export is delivered as part of the same closure request, so there is no separate step to remember and no window in which your account is gone and your data has not arrived. The export carries its own completeness statement, naming anything it could not include, so you can verify what you received rather than take our word for it. If we cannot return all of it, the deletion does not proceed and your account is left exactly as it was. The retained compliance evidence described above is unaffected by this choice: it is returned to you in the export, and it is also kept by us, because keeping it is a legal obligation rather than a preference.

If you stop paying rather than closing your account. Closing your account destroys your data straight away, and you may take the export first as described above. A lapsed subscription is different: we keep your workspace readable for 12 months from the end of your subscription, so that a billing failure or a lapsed renewal never costs you your compliance history. Before anything is deleted we email your workspace owners and administrators, and deletion happens only once that warning has been on the record for a further 30 days. You can export at any point in that window, and you can ask us to delete sooner.

Sub-processor changes (Article 28(2)). We give you at least 30 days’ notice by email, to your workspace owners and administrators, before we add a sub-processor or change what an existing one does. You may object during that period, and we will discuss it with you before the change takes effect. Removing a sub-processor happens as soon as we can do it and carries no notice period, because it narrows rather than widens who processes your data. Notices are also published on our sub-processor page, which is a second channel rather than the primary one: the email is the notice.

Your AI assistant instructions (ARIA). ARIA accepts free text. Whatever your users type into it, you instruct us to process on your behalf, for the purpose of answering them. Before a message reaches the model, ARIA checks its wording against fixed keyword patterns to route it: a message that tries to change ARIA’s rules or extract its instructions or credentials, asks for help with unlawful activity, asks for legal advice, or falls outside AI governance gets a fixed reply and no model call. A message that contains a credential in a format AM8 recognises (API keys issued by Anthropic, OpenAI, Stripe, Resend, Supabase, GitHub, Google or AWS, bearer tokens, JSON web tokens and private-key blocks) is refused the same way, before it reaches the model, and its text is not stored: your conversation history records only that a message was withheld. A credential in any other format is not detected, and is processed and stored like any other text. Neither check screens the message for special categories of personal data under Article 9 or criminal-offence data under Article 10: those categories are not detected, and a message that clears both checks still reaches the model unscreened for them. Every other message, and which check refused it if any, is stored in your conversation history. You should therefore treat ARIA as a general-purpose free-text field and instruct your users accordingly: it is not an appropriate place for health data, biometric data, data revealing racial or ethnic origin, political opinions, religious beliefs or trade union membership, or details of criminal offences, and it is not an appropriate place for personal data about people outside your organisation. Conversations are processed by Anthropic as our sub-processor under Standard Contractual Clauses, are retained under the periods set out in our privacy notice, and are included in your export.

To request a countersigned copy of the DPA, contact privacy@am8-ai-governance.tech.