Data Processing Addendum
Version 2026-10-15-draft · Last updated 2026-10-15
This Data Processing Addendum ("DPA") forms part of the Terms of Service between [COMPANY LEGAL NAME] ("Processor") and the customer organization ("Customer", acting as controller or as processor on behalf of its own customers) and applies to personal data that RouteHaven processes on the Customer's behalf when providing the Service. Terms such as "personal data", "processing", "controller" and "processor" have the meanings given in applicable data protection law (including, where relevant, the EU and UK GDPR).
1. Subject matter, nature and duration
| Subject matter | Providing the RouteHaven API gateway and dashboard under the Terms. |
| Nature and purpose | Receiving API requests, forwarding prompts and inputs to the model providers selected by the Customer, returning outputs, and recording request metadata for metering, billing, security and support. |
| Data subjects | The Customer's users and any individuals whose personal data the Customer includes in prompts or inputs. |
| Categories of data | Any personal data contained in prompts, inputs and outputs (determined by the Customer); request metadata such as IP addresses and application names. The Customer should not send special categories of data unless it has a lawful basis and appropriate safeguards. |
| Retention | Prompt and output content is processed transiently and not stored by the Processor, except fragments that may appear in error messages returned by model providers, which are stored with the request metadata. Request metadata is retained for [RETENTION PERIOD]. |
| Duration | The term of the Terms, plus any period needed to delete data as described below. |
2. Processing on documented instructions
The Processor processes Customer personal data only on the Customer's documented instructions, which consist of the Terms, this DPA and the Customer's configuration and use of the Service (including the choice of model provider and provider credentials), unless required otherwise by law, in which case the Processor will inform the Customer unless legally prohibited. The Processor will inform the Customer if it believes an instruction infringes data protection law.
3. Confidentiality
Persons authorized to process Customer personal data are bound by confidentiality obligations and access it only as needed to provide the Service and support.
4. Security measures
- Encryption in transit (TLS) for all connections to the Service and to model providers.
- Customer provider credentials encrypted at rest with AES-256-GCM bound to the Customer's organization; API keys and passwords stored only as hashes.
- No storage of prompt or output content; request logging limited to metadata (which can include provider error messages that quote parts of a request).
- Logical separation of each Customer's data; role-based access control within Customer organizations; audit logs of administrative actions.
- Rate limiting, spend controls and monitoring of errors and abuse.
- Access to production systems restricted to authorized personnel.
5. Sub-processors
The Customer authorizes the sub-processors listed below. The Processor imposes data protection obligations on its sub-processors that are no less protective than this DPA, and remains responsible for their performance. The Processor will give at least [NOTICE PERIOD] notice of new sub-processors; the Customer may object on reasonable data protection grounds, in which case the parties will discuss alternatives in good faith, and the Customer may terminate the affected service if none is found.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, edge network and request logs | United States (functions run in the US East region) |
| Neon (via Vercel Marketplace) | Managed PostgreSQL database (accounts, organizations, request metadata, ledger) | United States (AWS us-east-1) |
| Stripe, Inc. | Payment processing, tax calculation, invoices and receipts | United States and other Stripe locations |
| Google LLC (Google Workspace) | Sending transactional email (verification, password reset, invitations) | United States and other Google locations |
| Model providers selected by the Customer: OpenAI, Anthropic, Google | Generating model outputs. Prompts and completions are transmitted to the provider the Customer selects, using the Customer's own provider API key (BYOK); the provider's terms with the Customer also apply | Per the respective provider |
Model providers receive Customer content only for requests the Customer routes to them, using the Customer's own provider credentials; the Customer's agreement with each provider also governs that provider's processing.
6. Assistance and data subject requests
Taking into account the nature of the processing, the Processor will assist the Customer with responding to data subject requests, with security, breach notification, data protection impact assessments and prior consultations, to the extent the Customer cannot do so using the Service. The Processor will forward to the Customer any data subject request it receives relating to Customer personal data.
7. Personal data breaches
The Processor will notify the Customer without undue delay, and in any event within [NOTIFICATION PERIOD], after becoming aware of a personal data breach affecting Customer personal data, and will provide the information reasonably available to help the Customer meet its obligations.
8. International transfers
Customer personal data is processed in the United States and in the locations of the sub-processors listed above. Where required, transfers are made under [TRANSFER MECHANISM, e.g. EU Standard Contractual Clauses / UK Addendum], which are incorporated by reference.
9. Deletion and return
On termination, the Processor will delete Customer personal data within [RETENTION PERIOD], except where retention is required by law (for example, billing records). Because prompt and output content is not stored, deletion concerns account data, credentials and request metadata.
10. Information and audits
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits by the Customer or an independent auditor on reasonable notice, no more than once a year unless required by a supervisory authority or following a breach. The Processor does not currently hold third-party security certifications.
11. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms, except where law does not permit such limitation. In case of conflict, this DPA prevails over the Terms with respect to the processing of personal data. Contact: [PRIVACY CONTACT EMAIL].