Legal · DPA
Data Processing Addendum
Data processing terms, sub-processor details and international-transfer safeguards are handled through signed customer agreements. A current DPA package is available on request from legal@aiwarden.com.
Scope
AI Warden provides a DPA for enterprise customers where AI Warden processes personal data on their behalf. The signed agreement defines the applicable parties, roles, jurisdictions, processing instructions and transfer safeguards.
Parties and roles
- Controller — the customer, deciding purposes and means of processing.
- Processor — AI Warden AG, processing personal data only on documented instructions.
- Sub-processor — approved third parties engaged to provide defined service components.
Subject-matter, duration, nature, purpose
- Subject-matter: Personal data routed through AI Warden by the Controller.
- Duration: For the term of the agreement plus retention periods set in the Order Form.
- Nature: Storage, routing, policy evaluation, redaction, logging, and access control for LLM and MCP traffic.
- Purpose: Delivery, security, governance, and compliance features of the AI Warden service.
Data subjects and data categories
Determined by the Controller. Typical data subjects include customer employees, contractors, and end users represented in prompts or tool-call payloads. Typical data categories include identifiers, business contact data, operational metadata, and any content the Controller submits.
Deployment and data residency
Hosted deployments can be configured in customer-selected regions according to contract terms and data-residency requirements. Self-hosted deployments are governed by the customer’s own environment and configuration.
Security measures
Security controls are described in our Security Practices summary and, where applicable, in Annex II or equivalent schedules to the signed DPA.
Sub-processors
Current sub-processor details are provided to customers and evaluators under the applicable DPA or confidentiality terms. The list can vary by deployment model, region, support scope and contracted services.
For self-hosted deployments, customer production traffic can remain in the customer environment according to the customer’s architecture and configuration.
International transfers
International transfer mechanisms, including any Standard Contractual Clauses or equivalent safeguards, are addressed in the signed DPA and applicable transfer schedules.
Data subject requests
AI Warden assists customers with data-subject requests according to the signed DPA, deployment model, processor role and applicable law.
Audit rights
Audit rights and evidence access are governed by the signed DPA and customer agreement. Assurance materials may include security summaries, architecture materials and other documentation appropriate to the deployment.
Personal data breach
Personal-data breach notification obligations are governed by applicable law and the signed customer agreement.
Return and deletion
Return, deletion and retention are handled according to customer instructions, contractual retention settings and mandatory legal retention requirements.
Contact
For current DPA copies, transfer annexes, or sub-processor information, contact legal@aiwarden.com.