Data Processing Addendum

1. Background

This Data Processing Addendum ("DPA") forms part of the agreement for the use of the Archon service (the "Agreement") between Regnor Systems ("Processor", "Archon") and the customer identified in the Agreement ("Controller", "Customer") and reflects the parties' commitment to abide by applicable Data Protection Laws.

2. Definitions

• Data Protection Laws — the GDPR (EU 2016/679), UK GDPR, Swiss FADP, CCPA/CPRA, and any other applicable privacy legislation.
• Personal Data — any information relating to an identified or identifiable natural person processed by Archon on behalf of the Customer.
• Processing, Controller, Processor, Data Subject, Sub-processor, and Personal Data Breach have the meanings given in the GDPR.
• Standard Contractual Clauses ("SCCs") — the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

3. Roles and Scope

• The Customer is the Controller and Archon is the Processor of Customer Personal Data.
• Archon will process Customer Personal Data only on documented instructions from the Customer, unless otherwise required by law.
• The subject matter, duration, nature, purpose, and categories of Personal Data are described in Annex A.

4. Processor Obligations

Archon shall:

• Ensure that persons authorized to process the Personal Data are bound by confidentiality obligations.
• Implement the technical and organizational measures described in Annex B.
• Assist the Customer, taking into account the nature of processing, in fulfilling data-subject requests (Articles 12–22 GDPR).
• Assist the Customer in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs).
• At the Customer's choice, delete or return all Personal Data at the end of the Agreement, unless retention is required by law.
• Make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits as set out in Section 9.

5. Sub-processors

The Customer provides general authorization for Archon to engage Sub-processors. The current list is published at /subprocessors. Archon will give at least 30 days' advance notice of any new Sub-processor. The Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected portion of the Agreement without penalty.

Archon remains fully liable to the Customer for the performance of its Sub-processors.

6. International Transfers

Where Archon transfers EU/UK/Swiss Personal Data to a country without an adequacy decision, the transfer is made under the 2021 Standard Contractual Clauses (Module 2, Controller-to-Processor), incorporated by reference into this DPA. The UK International Data Transfer Addendum applies for UK data; the Swiss supplement applies for Swiss data.

7. Security

Archon implements the technical and organizational measures described in Annex B. These are subject to improvement over time; Archon will not materially degrade the overall level of protection during the term of the Agreement.

8. Personal Data Breach

Archon will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include the information required by Article 33(3) GDPR to the extent known at the time.

9. Audits

Archon will make available, on reasonable request, documentation reasonably necessary to demonstrate compliance (including third-party audit reports once available). On-site audits are limited to once per year, require at least 30 days' notice, and must be conducted during business hours without disrupting the Service.

10. Liability and Term

Each party's liability under this DPA is subject to the limitation-of-liability provisions of the underlying Agreement. This DPA takes effect on the earlier of its execution or the Customer's first use of the Service and remains in force for as long as Archon processes Customer Personal Data.

Annex A — Details of Processing

• Subject matter: provision of the Archon SOP-generation and management Service.
• Duration: term of the Agreement plus retention periods set out in the Privacy Policy.
• Nature and purpose: hosting, generation, storage, retrieval, export, and analytics of Customer-supplied content to provide the Service.
• Categories of Personal Data: identifiers (name, email), business contact details, content voluntarily submitted by the Customer or its end-users, usage and technical metadata.
• Categories of Data Subjects: the Customer's employees, contractors, and authorized users of the Service.
• Prohibited categories: as set out in Section 5 of the Terms of Service, the Customer must not submit PHI (HIPAA), cardholder data (PCI-DSS), SOX-regulated records, minors' data, export-controlled data, or biometric identifiers.

Annex B — Technical and Organizational Measures

• Encryption — TLS 1.2+ in transit; AES-256 encryption at rest via Supabase managed encryption.
• Access control — Supabase Row Level Security (multi-tenant isolation), role-based access control (admin / member / viewer), least-privilege service roles.
• Authentication — JWT-based with configurable expiry; MFA available via Supabase Auth.
• Audit logging — write operations on SOPs, memberships, exports, and deletions are logged to an append-only audit table.
• Sub-processor isolation — document embeddings stored in Supabase pgvector with org-scoped Row Level Security; Anthropic and OpenAI are configured with zero-retention / no-training settings.
• Backup — daily automated backups with point-in-time recovery via Supabase.
• Incident response — documented 72-hour notification process; runbook maintained internally.
• Secrets management — API keys rotated quarterly; production secrets held in Railway / Vercel environment vaults.
• Personnel — all personnel with production access are bound by confidentiality agreements.

Annex C — Standard Contractual Clauses

The 2021 SCCs (Module 2, Controller-to-Processor) are incorporated into this DPA by reference, with Clause 7 (docking) and Option 2 of Clause 9 (general authorization for Sub-processors with 30-day notice). The competent supervisory authority is the authority of the Customer's place of establishment, or, if the Customer is not established in the EU, the Irish Data Protection Commission. Governing law for the SCCs is Ireland.

Contact

For DPA execution, Article 28 inquiries, or data-subject requests, contact:
romil@regnor.systems

Regnor Systems