Brainback’s institutional Data Processing Agreement is available on request. It covers our obligations as a data processor for institutional deployments, including subprocessor lists, security measures, and data-transfer mechanisms.
What’s in the DPA
- Scope of processing and role assignment (processor vs. controller).
- Full subprocessor list — see /legal/subprocessors.
- Security measures (technical + organizational).
- Data-transfer mechanisms (Standard Contractual Clauses for EU→US transfers).
- Breach notification timelines — 72 hours.
- Deletion + return obligations at contract termination.
How to request it
Email legal@brainback.app. We accept redlines from institutional counsel.
Related
See also /trust/data and /trust/security for the plain-language stance.