Data processing agreement

01Roles

For personal data your organization submits to AgentPlane, your organization is the controller and AgentPlane is the processor. This agreement supplements the Terms of Service and applies whenever we process personal data on your behalf.

02Scope of processing

• Subject matter: evaluating, recording and auditing actions proposed by your AI agents.
• Categories of data subjects: your console users, and people referenced in agent action payloads, such as customers named in an email an agent wants to send.
• Categories of data: names, work emails, identifiers, and payload contents you choose to send. Secrets and card-like fields are removed before anything is logged.
• Duration: the term of your agreement plus the retention period configured for your workspace.

03Instructions

We process personal data only on your documented instructions, which are these terms and your configuration of the Service. We will tell you if we believe an instruction breaks the law.

04Confidentiality

Everyone authorized to process personal data is bound by confidentiality obligations.

05Security measures

We apply the technical and organizational measures listed on our Trust center, including tenant isolation, hashed credentials, redaction at write time and a tamper-evident audit trail. Controls marked planned there are not yet in place and are not promised by this agreement.

06Subprocessors

You authorize the subprocessors on our subprocessor list. We will give at least 30 days' notice of any new subprocessor, during which you may object on reasonable grounds.

07International transfers

Where personal data leaves the EEA, UK or Switzerland, we rely on the applicable standard contractual clauses.

08Assistance and rights requests

We will help you respond to data subject requests and with data protection impact assessments, taking into account the nature of the processing and the information available to us.

09Breach notification

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.

10Return and deletion

At the end of the Service you may export your audit records for 30 days. We then delete your personal data unless the law requires us to keep it.

11Audits

We will make available the information needed to demonstrate compliance with this agreement, and allow reasonable audits with advance notice, no more than once a year unless required by a regulator or after a breach.

12Signing

To receive a countersigned copy, contact us with your company's legal name.