Data Processing Agreement (DPA) — GuardrailX

Pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR"), between:

• the Customer that has accepted the GuardrailX Terms of Service, controller ("Controller");
• WebbergatePlus+ s.r.l., Strada Farnesiana 45, 29122 Piacenza (PC), Italy, VAT no. IT03871830166, share capital € 10,000, processor ("Processor").

This agreement is part of the Terms of Service and applies for the whole duration of the contract.

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller only to provide the Service described in the Terms, for the duration of the contract and for the time needed for the deletion described in point 9.

2. Nature and purpose of the processing

Delivery of notifications via Webhook depends on the correct configuration and availability of the Customer's systems. WebbergatePlus+ s.r.l. is not liable for alerts not received or received late because of malfunctions, blocks or unavailability of the endpoints provided by the Customer.

3. Types of data and categories of data subjects

They depend on what the Controller has its agents send: potentially any data contained in the questions and documents sent to the models (for example data of the Controller's customers, employees, suppliers). The Controller assesses whether to send special categories of data (Article 9 GDPR) or criminal-conviction data (Article 10) and, if it does, ensures their legal basis; in that case it is advisable not to turn on Comparisons for the calls concerned and to exclude from Autopilot the agents that send them. Privacy Guard reduces the personal data that reaches the provider but does not exclude it: it recognises data with automatic rules, does not process images and attached files and leaves the rest of the text to the provider. For data that must not reach the provider, the Controller uses the mode that blocks calls, or does not send it.

The Controller formally undertakes not to enter personal data belonging to the special categories under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR in the header fields (X-GuardrailX-*) or in the configuration settings. Should the Controller decide to forward such categories of data in the payload of the calls or in Model comparisons, it guarantees under its own exclusive responsibility that it has a suitable legal basis and has fulfilled all the obligations provided by law (including any DPIA), fully indemnifying the Processor.

4. Artificial intelligence providers

The Controller can configure in the Service artificial intelligence providers of its choice (for example OpenAI, Anthropic, Google, Mistral AI, DeepSeek and OpenRouter), using credentials or API keys associated with its own relationship with those providers. The Processor transmits data to the selected provider exclusively on the basis of the Controller's instructions and configurations and to the extent necessary to carry out the request. The use of a provider configured by the Controller constitutes a documented instruction to the Processor to transmit to that provider the data necessary to carry out the request. The Controller is responsible for the choice of the provider, of the models used and for checking the related contractual terms, the conditions applicable to the processing of personal data and any safeguards required for transfers to third countries. The routing, Model comparison and Autopilot features transmit data exclusively to the providers configured by the Controller. The activation of Autopilot constitutes a documented instruction to send a sample of the calls, with the Controller's key, to other models of the same provider chosen by Autopilot and to the model in use as judge, within the goals and spend set by the Controller.

5. Obligations of the Processor

The Processor:

1. processes the data only on the Controller's documented instructions, that is the Terms, this agreement and the configurations made by the Controller in the Service; informs the Controller without undue delay if it believes an instruction infringes the GDPR or other applicable data protection law and may suspend the execution of the instruction concerned until it is changed, withdrawn or its lawfulness confirmed;
2. ensures that the persons authorised to process the data are bound by confidentiality;
3. adopts the security measures of Annex A (Article 32 GDPR) and updates them over time;
4. engages sub-processors according to point 6;
5. assists the Controller, as far as possible, in responding to data subjects' requests (Articles 15-22) and in the obligations of Articles 32-36;
6. notifies the Controller of personal data breaches without undue delay and in any case within 48 hours of becoming aware of them, with the information available;
7. makes available the information necessary to demonstrate compliance with this agreement and allows audits (point 8).

The Processor's assistance with data protection impact assessments (DPIA) and with data subjects' requests is provided within the limits of the nature of the Service. Should the assistance requested by the Controller involve an extraordinary operational or technical effort, the Processor reserves the right to charge the Controller the related costs based on its current hourly rates.

6. Sub-processors

The Controller gives general authorisation to engage the sub-processors in Annex B. The Processor gives at least 30 days' notice of the addition or replacement of a sub-processor; within that period the Controller can object on reasonable grounds related to data protection and, failing a solution, withdraw from the contract without penalties. The Processor imposes on the sub-processors obligations equivalent to those of this agreement and is liable for them.

7. Transfers outside the EEA

The Processor stores the data in Italy. Any transfers outside the European Economic Area by sub-processors take place only on the basis of an adequacy decision or of the European Commission's standard contractual clauses, with the necessary supplementary measures.

The integration of the Telegram bot for receiving alerts is an entirely optional choice of the Controller alone. By enabling that channel, the Controller gives the Processor a direct instruction to transmit the alerts' metadata to Telegram Messenger Inc. / Telegram FZ-LLC, declaring that it has assessed and accepted the related risks of the transfer to non-EU countries.

8. Audits

The Controller can request written information on compliance with this agreement; the Processor replies within 30 days. On-site audits, also through an auditor bound by confidentiality, are agreed with at least 30 days' notice, at most once a year except in case of breaches, and are at the Controller's expense.

The costs and expenses arising from the exercise of the audit right by the Controller or its auditor are borne entirely by the Controller. Such audits shall take place during normal business hours, with at least 30 days' notice, without interfering with the operation of the Service and in a way that does not compromise the security of the systems or the confidentiality of other customers' data.

9. End of processing

When the account is closed or the contract terminated, the Processor deletes the personal data processed on behalf of the Controller from the production systems within 30 days. As for backup copies, the Controller's data remains in restricted-access environments (the off-site copy is encrypted) and is deleted or overwritten at the end of the natural backup rotation cycle (14 days on the server, 60 days for the off-site copy). Before closing the account, the Controller can export the call log and its data in CSV format from the dashboard. Only the data the Processor is required to keep under a legal obligation is excluded from immediate deletion.

10. Liability

Without prejudice to Article 82 GDPR on liability towards data subjects, the total liability of the Processor towards the Controller for any breach of this DPA is subject to the limitations and the cap provided in Article 11 of the Terms of Service (equal to the total amount paid in the preceding twelve months).

Annex A — Technical and organisational measures

• Encryption in transit: HTTPS (TLS) between agents, Service and providers; dashboard on HTTPS only with security headers (HSTS, restrictive Content Security Policy).
• Encryption at rest: providers' API keys and the texts of Comparisons and Autopilot encrypted with AES-256-GCM and a master key kept outside the database.
• Minimisation: the content of the calls is not stored (except Comparisons and Autopilot turned on by the Controller); with Privacy Guard, which is optional, recognised personal data becomes placeholders before being forwarded to the provider, and the entries of the project dictionary are stored encrypted; the log contains only metadata; retention limited by plan (90 or 365 days), then only monthly totals; Comparison texts deleted 30 days after the end of the comparison, Autopilot texts 30 days after collection.
• Access: passwords stored as a bcrypt hash; email confirmed before the first login; login with Google or Microsoft optional; limits on login and sign-up attempts; gr_… keys stored only as a SHA-256 hash; each user sees only their own projects; server access via SSH with a key, restricted to authorised staff.
• Network: database not exposed to the internet; application reachable only through the HTTPS reverse proxy; webhook addresses to private networks rejected.
• Continuity: daily database backup, verified and kept for 14 days on the server and 60 days in an encrypted off-site copy (content and file names) with another provider; documented restore procedure; monitoring of the Service status.
• Updates: dependencies and system kept up to date; versioned and verified database migrations.
• Breaches: handling and notification procedure within 48 hours (point 5.6).

Annex B — Authorised sub-processors

Stripe (payments), Google and Microsoft (login with Google or Microsoft) process only the Customer's account data, as controllers or as processors on our behalf: they are listed in the Privacy Policy and do not receive the data of the calls. The AI providers configured directly by the Controller and used through credentials/API keys attributable to the contractual relationship between the Controller and the provider are not selected by the Processor as its own sub-processors. The Processor acts exclusively as a technical intermediary, transmitting the data to the provider indicated by the Controller on the basis of the latter's documented instructions. The qualification of the provider under applicable law remains determined by the relationship and the conditions between the Controller and the provider. The integration of the Telegram bot for receiving alerts is an entirely optional choice of the Controller alone. By enabling that channel, the Controller gives the Processor a direct instruction to transmit the alerts' metadata to Telegram Messenger Inc. / Telegram FZ-LLC, declaring that it has assessed and accepted the related risks of the transfer to non-EU countries.

Last updated: 27 October 2026