Data Processing Addendum

01Roles

The customer organization decides why and how personal data is used. DORET Prism processes it only to provide the service, on the customer's instructions.

02What is processed

• Account data: the names and email addresses of the organization's members, and their sign-in records.
• Usage records: for each call through the gateway the model, tokens, cost and status, and the first 200 characters of a provider's error when a call is rejected.
• Budget requests: the text an agent or a person writes, and the decisions on it.
• Prompts and model answers pass through the gateway on their way to and from the provider and are not stored.

03Subprocessors

The current list is on the Subprocessors page. Your model providers are not on it: they work under your own agreement with them.

04Security

The measures in place are described on the Security page: encryption of provider keys, separation of organizations in the database, a hash-chained audit log, and limits on sign-in.

05Deletion

An Owner can close the organization. Keys stop working at once, and its records are deleted 30 days later, apart from what the law requires us to keep.

06To be completed

The parties' details, international transfers, audit rights, breach notice periods and the governing law are being prepared with counsel.