Data processing addendum.
Draft data-processing terms for diligence. Final obligations and roles require signed customer terms before production processing.
Veridra is pre-launch. Our Data Processing Addendum is in finalization with external counsel and will be published in full before v1.0 GA.
For procurement or privacy-office review of the current draft, email legal@veridra.io directly.
What the DPA covers
- Roles: customer is the controller; Veridra is the processor
- Scope and purpose of processing (attestation, evidence generation, verification)
- Subprocessor list and notification-of-change commitments
- Cross-border transfer mechanisms (SCCs, UK IDTA, adequacy)
- Data subject rights handling and response timelines
- Breach notification within 72 hours
- Audit rights and security certifications
- Data return and deletion on termination
Key technical guarantees
Minimization by design. Veridra processes hashes of AI decision inputs and outputs, not the underlying content. The DPA reflects this architectural choice.
Residency target. The production design uses region-bound tenant data with cross-region replication disabled by default. Only the first US reference deployment is currently planned for implementation.
Encryption and key custody target. The production architecture requires encrypted storage and transport plus tenant-scoped KMS signing. The current alpha uses development-only signing and is not a customer deployment.
Request the draft
Email legal@veridra.io for the current draft DPA under MNDA. Include your organization name and intended use case.
April 2026 · revisions pending v1.0 launch