Data Processing Agreement
Last updated: October 22, 2026
This Data Processing Agreement ("DPA") is part of the Terms of Service between you ("Controller") and Vaulken ("Processor"). It governs the processing of personal data through the Vaulken cloud platform ("Service"), under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
- "Processing" means any operation performed on Personal Data (Article 4(2) GDPR).
- "Data Subject" means the individual to whom Personal Data relates.
- "Subprocessor" means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
- "Customer Data" means the files and content the Controller makes available to the Service through a Vault, held in storage the Controller owns.
2. Scope and Purpose of Processing
| Subject matter | Operation of the Vaulken platform: access to Controller-owned S3-compatible storage, search indexing, AI text extraction, MCP access |
| Duration | The term of the Terms of Service, plus the time needed to delete data |
| Nature and purpose | Indexing, text extraction, retrieval and modification of Customer Data held in Controller-owned storage, through MCP tools and the dashboard |
| Types of Personal Data | Any Personal Data contained in Customer Data, as determined by the Controller |
| Categories of Data Subjects | Determined by the Controller: employees, customers, contacts, or anyone whose data appears in the files |
3. Obligations of the Processor
The Processor shall:
- Process Personal Data only on documented instructions from the Controller, including for transfers outside the EEA (Article 28(3)(a)).
- Ensure that people authorized to process Personal Data are bound by confidentiality (Article 28(3)(b)).
- Implement appropriate technical and organizational measures (Article 28(3)(c)), described in section 6.
- Engage no Subprocessor without the Controller's authorization (Article 28(3)(d)), as set out in section 5.
- Assist the Controller with Data Subject rights requests (Article 28(3)(e)), as set out in section 7.
- Assist the Controller with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments).
- At the Controller's choice, delete or return Personal Data at the end of the Service and delete existing copies (Article 28(3)(g)).
- Make available the information needed to demonstrate compliance with Article 28 and allow audits (Article 28(3)(h)), as set out in section 8.
4. Instructions
The Controller's instructions are the Terms of Service and the configuration of the Service: Vault settings, bucket connection, MCP URLs issued, and the requests made by AI clients the Controller has authorized. The Processor processes Personal Data for no other purpose.
If the Processor believes an instruction infringes GDPR or other data protection law, it informs the Controller promptly.
5. Subprocessors
The Controller gives general authorization for the Subprocessors below, under the conditions in 5.2 and 5.3.
5.1 Current Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Infrastructure: compute, database, key management, backups | Paris, France (EU) |
| Scaleway TEM | Transactional email delivery | Paris, France (EU) |
| Mistral AI | Embeddings for semantic search; OCR of PDF pages; image description. Content is processed and not retained. | Paris, France (EU) |
| Google LLC | Sign in with Google only: the account holder's email and display name. No Customer Data. | United States |
The storage provider that holds the Controller's bucket is contracted by the Controller and is not a Subprocessor of Vaulken.
5.2 Subprocessor Changes
The Processor notifies the Controller at least 30 days before adding or replacing a Subprocessor, with its name, purpose and location. The Controller may object within 15 days. If the objection cannot be resolved, the Controller may terminate the affected Service.
5.3 Subprocessor Obligations
The Processor imposes on each Subprocessor data protection obligations at least as protective as this DPA, and remains liable for their performance.
6. Technical and Organizational Measures
Encryption
- In transit: TLS 1.2 or higher on every connection.
- At rest: bucket credentials and tokens are encrypted through a key management service. Passwords are hashed with an industry-standard algorithm and never stored in plaintext.
Access Control
- Every Vault connects only to the bucket the Controller configured; every database query is scoped to the Controller's Workspace.
- OAuth 2.0 authorization for MCP clients, with read-write or read-only scope per MCP URL and optional path restriction.
- Rate limiting on authentication endpoints.
Data Minimization
- File contents are read in memory for indexing and extraction and are not persisted by the Processor.
- Search indexes (trigrams and vectors) cannot be used to reconstruct the original text.
- Text extracted from PDFs and images is written to the Controller's own bucket, not to the Processor's systems.
Infrastructure
- All Processor infrastructure is hosted in the EU (Paris, France).
- Container-based deployment with automated updates.
- Regular database backups stored in the EU.
7. Data Subject Rights
The Processor assists the Controller with Data Subject requests (access, rectification, erasure, portability, restriction, objection) by:
- Letting the Controller read, modify and delete Customer Data through the Service, and deleting the related indexes when a Vault is deleted
- Notifying the Controller promptly if a Data Subject contacts the Processor directly
- Not answering Data Subject requests directly unless the Controller authorizes it
8. Audits
On reasonable request and notice, the Processor provides the information needed to demonstrate compliance with this DPA. The Controller may audit, directly or through a third-party auditor bound by confidentiality, at most once a year. The Processor may answer an audit request with certifications, audit reports or compliance documentation.
9. Data Breach Notification
The Processor notifies the Controller without undue delay, and within 48 hours at most, after becoming aware of a Personal Data breach. The notification covers:
- The nature of the breach, including the categories and approximate number of Data Subjects affected
- The likely consequences
- The measures taken or proposed
- A contact for further information
10. International Transfers
Customer Data, indexes and account data are processed and stored within the European Economic Area. The one exception is the account holder's email and display name sent to Google in the United States when they choose "Sign in with Google", under Google's Data Processing Terms and Standard Contractual Clauses. No Customer Data leaves the EEA through the Processor.
Should another transfer outside the EEA become necessary, the Processor puts appropriate safeguards in place (Standard Contractual Clauses or an adequacy decision) and obtains the Controller's prior authorization.
11. Data Deletion and Return
On termination of the Terms of Service, the Processor:
- Deletes all search indexes, file metadata, usage counters and stored bucket credentials within 30 days
- Provides, on request made before termination, an export of the Controller's account data in a machine-readable format
- Confirms deletion in writing on request
Customer Data files are never held by the Processor. They stay in the Controller's bucket, which the Controller can export at any time with any S3-compatible tool.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service.
13. Term
This DPA applies for the duration of the Terms of Service. Deletion and confidentiality obligations survive termination.
14. Contact
- Privacy questions and rights under this DPA: privacy@vaulken.dev
- Anything else: contact@vaulken.dev