Data Processing Addendum

1. What it covers

Personal data in your Customer Data: app-user accounts, rows, documents, files and logs your projects store. The kinds of people involved and the data are whatever you choose to store; the processing is hosting, storing, backing up, querying, transmitting and deleting it to run your projects.

2. Your instructions

We process the data only to provide the service and as you instruct through the console, API, SDKs, CLI and your settings, and not for our own purposes. If we think an instruction breaks the law, we tell you. If the law requires us to process it otherwise, we tell you first unless the law forbids it.

3. Our people

Only staff who need access to run the service get it, under written confidentiality duties, with multi-factor authentication, and every staff action is logged. Support sessions that view your console are time-limited, approved in advance, audited and shown in your Access Transparency log.

4. Security measures

We maintain at least these measures, and improve them over time:

• every request authenticated and checked against your access rules before it reaches data; tenant databases isolated per project;
• encryption in transit (TLS 1.2+); backups encrypted before they leave the server; secrets encrypted with AES-256-GCM under separate keys; bring-your-own-key for AI providers;
• least-privilege access, MFA for staff, hash-chained admin audit log, security logs archived 400 days;
• encrypted backups kept off-site with object lock, restore-tested monthly;
• dependency scanning, signed database-worker releases, hardened hosts and sandboxed (gVisor) function runtimes;
• an incident response process with automatic alerting.

5. Subprocessors

You authorise the subprocessors listed at sovaria.in/subprocessors. We bind each to data protection terms at least as protective as these. We give 30 days’ notice of a new subprocessor by email; if you object on reasonable data protection grounds and we can’t address it, you may end the affected service and get a refund of prepaid fees for it. We are responsible for our subprocessors’ work.

6. Helping you with your users’ rights

The console and API let you find, correct, export and delete your users’ data yourself (including deleting an app user, which also removes them from your project database). If a request reaches us directly, we pass it to you without answering it ourselves, unless you ask us to. We also help with impact assessments and consultations with authorities where you need information only we have.

7. Personal data breaches

We tell you without undue delay, and aim to within 24 hours, after we become aware of a breach affecting your personal data, with what we know (what happened, the data and people involved, likely effects and what we are doing), and keep you updated. That lets you meet your own duties, such as informing the Data Protection Board of India within 72 hours (DPDP Rules, Rule 7) and the people affected. We report to CERT-In where its Directions require.

8. International transfers

Your projects’ data is stored in India (AWS Mumbai). Where a subprocessor processes it elsewhere, we do so only to countries not restricted under section 16 of the DPDP Act and, for data subject to the GDPR or UK GDPR, under the Standard Contractual Clauses (module 2 or 3) or the UK addendum, which are incorporated by reference.

9. When the service ends

You can export your data at any time. When your project or account ends, we delete the data from live systems after a 30-day export window, and it leaves backups within 35 days, unless the law requires us to keep it.

10. Audits

We answer reasonable security questionnaires and share summaries of our controls and test results. Where the law requires, or after a breach, you (or an independent auditor bound by confidentiality) may audit our compliance once a year with 30 days’ notice, at your cost, in a way that doesn’t expose other customers’ data. Our readiness work for SOC 2 and ISO 27001 is described at sovaria.in/docs/trust.

11. Health data (HIPAA)

Don’t store protected health information subject to the US HIPAA rules unless your organization is on Enterprise with the HIPAA add-on and we have signed a Business Associate Agreement with you. HIPAA mode then requires MFA for every member, ends idle sessions, keeps audit logs for at least 6 years and refuses features outside our cloud provider’s BAA; projects marked as holding PHI also log every data request, block public files and take only encrypted backups.

12. Liability and order of precedence

The liability limits in the Terms apply to this addendum. If this addendum and the Terms conflict on personal data, this addendum wins; the Standard Contractual Clauses win over both where they apply.

13. Contact

Our Grievance Officer, Sovaria Technologies Private Limited, Nadi Ki Dhani, Akeda Choud, Via Jahota, Bhato Ki Gali, Jaipur, Rajasthan 303701, India. Email outreach@sovaria.in with the subject “Privacy” or “Grievance”.