Data Processing Agreement
When Soriku processes personal data on your behalf, a DPA defines the rights and obligations of both parties.
When you need one
Local mode: you're the controller and the processor, no DPA needed. Soriku Cloud or Simezu-mode where Atypisch hosts on your behalf: a DPA is needed to satisfy GDPR Article 28.
What's in the template
- Subject-matter and duration of processing
- Nature and purpose: AI orchestration and storage of agent state
- Type of personal data processed: prompts, completions, agent memory, user identifiers (via Simezu SSO)
- Categories of data subjects: end users of your Soriku workspace
- Sub-processors: limited to EU-region infrastructure providers, named in the addendum
- Security measures: encryption at rest, encryption in transit, tenant isolation, regular backups
- Audit rights and breach notification
How to get one
Email compliance@atypisch.nl with your legal entity name and your intended use case. The template is signed digitally; turnaround is typically 1-3 business days.