Data processing, written for scrutiny.

This DPA applies when Hyperoru processes Personal Data on behalf of Customer to provide the services described in an applicable order form or services agreement, together the Agreement.

If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA controls. Customer-specific signed terms control over this public standard form.

Customer is the controller or business that determines why Personal Data is processed. Hyperoru acts as Customer's processor or service provider. Each party remains responsible for obligations that apply to its own role.

Hyperoru processes Personal Data only to provide, secure, support, and improve the contracted service according to the Agreement, Customer's documented configuration, and lawful written instructions.

Customer will provide lawful instructions, maintain necessary notices and permissions, connect only repositories and sources it is authorized to review, and avoid submitting regulated data outside the agreed service scope.

Customer controls workspace membership, integration permissions, evidence retention settings, and approval of reports or remediation actions.

Hyperoru will process data only for the documented purpose, limit personnel and service access to need, maintain appropriate technical and organizational measures, and notify Customer if an instruction appears to violate applicable data protection law.

Hyperoru will not sell Customer Personal Data or use it for targeted advertising. Customer workspace evidence is not published as marketing content.

Personnel authorized to process Customer Data are bound by confidentiality obligations and receive access according to role and service purpose. Confidentiality duties continue after access ends.

Repository source, findings, architecture relationships, prompts, reports, and remediation artifacts are treated as confidential service data.

Hyperoru maintains the measures described in Annex II. They include tenant-scoped authorization, row-level database controls, encrypted transport, protected object storage, per-workspace source encryption, expiring credentials, bounded model context, audit events, and controlled workers.

Security measures evolve with risk and the service. Hyperoru will not materially reduce the overall protection of Customer Data during an active Agreement.

Models receive selected, bounded evidence needed for a task, not unrestricted access to the workspace. Model requests are routed through LLMGateway to provider-pinned models with request storage disabled and the gateway configured for metadata-only retention.

Hyperoru does not use Customer Data to train its own general-purpose models. Downstream provider handling remains subject to the contracted provider configuration and applicable provider terms. Hyperoru stores final structured artifacts and measured usage, not hidden model reasoning.

Customer authorizes the subprocessors listed in Annex III to support the service. Hyperoru remains responsible for their processing to the extent required by applicable law and will impose data protection duties appropriate to their services.

Material changes to the register will be communicated through an agreed notice channel. Customer may raise a reasonable, documented data protection objection before the change takes effect.

Taking into account the nature of processing, Hyperoru will provide reasonable assistance for access, correction, deletion, restriction, portability, or objection requests. If a request is received directly, Hyperoru will direct the requester to Customer unless law requires another response.

Hyperoru will notify Customer without undue delay after confirming a security incident affecting Customer Personal Data. Notice will include available information needed to understand the nature, likely impact, containment, and remediation, with updates as the investigation develops.

Unsuccessful attempts, routine scanning, and events that do not compromise Customer Personal Data are not security incidents under this section.

During the service term, Customer can export supported reports and artifacts. On workspace deletion or termination, Hyperoru begins an auditable lifecycle covering tenant records, objects, vectors, reports, and credentials, subject to configured retention, provider backup expiry, and legal obligations.

Data required to demonstrate security, billing, or legal compliance may be isolated and retained only for the applicable purpose and period.

Where Personal Data is transferred across a legally protected boundary, the parties will use the transfer mechanism identified in the executed Agreement or order form, including applicable standard contractual clauses where required.

Infrastructure regions and subprocessor locations are described in Annex III. Customer acknowledges that global delivery providers may process limited operational data outside the primary application region.

On reasonable written request, Hyperoru will provide information needed to demonstrate compliance with this DPA, such as control descriptions, architecture boundaries, and relevant independent reports when available.

Additional audits must be proportionate, protect other customers and security-sensitive information, avoid unreasonable service disruption, and follow confidentiality and cost arrangements agreed by the parties. This page does not claim a certification Hyperoru has not obtained.