01 Definitions & Regulatory Frameworks

This DPA applies to the processing of Personal Data by Terrion AI Solutions LLC ("Processor") on behalf of the Customer ("Controller") in connection with the Services. It aligns with the following frameworks:

• GDPR & UK GDPR: Regulation (EU) 2016/679 and its UK counterpart.
• CCPA/CPRA & VCDPA: California Consumer Privacy Act and Virginia Consumer Data Protection Act.
• HIPAA: For healthcare workloads, this DPA incorporates Business Associate alignment.
• SCCs: The European Commission's Standard Contractual Clauses (Modules Two and Three).

02 Roles of the Parties: Controller vs. Processor

Customer (Data Controller): Determines the purposes and means of processing Personal Data ingested into the SaaS engines (Knowledge AI, Terrion Flow, etc.) or AWS VPC pipelines.

Terrion AI (Data Processor): Processes Personal Data strictly on documented instructions from the Customer via API calls, RAG indexing, or workflow triggers. Terrion AI shall not process data for its own purposes.

03 AI Vector Embeddings, Ephemeral Processing & Zero-Training Covenant

Terrion AI provides the following binding legal obligations regarding AI data processing:

• Isolated Processing: Customer Personal Data is processed strictly within isolated single-tenant namespaces or Customer VPCs.
• Terrion Guard Masking: PII/PHI is automatically masked via Terrion Guard before inference.
• Ephemeral Memory: LLM context windows are processed in-memory and not permanently stored.
• Zero-Training Covenant: Customer Personal Data is NEVER used to train, retrain, or fine-tune external foundational models.

04 Personnel Confidentiality & Background Screening

All US-led solutions architects, SREs, and engineers with access to production environments are bound by strict Non-Disclosure Agreements (NDAs) and least-privilege IAM policies. Personnel undergo annual security and privacy awareness training.

05 Technical & Organizational Security Measures (TOMs)

Terrion AI implements defense-in-depth security controls:

• Encryption: TLS 1.3 in transit and AES-256 at rest (Customer-Managed AWS KMS keys available).
• Network: Private VPC peering, zero public internet exposure, AWS Shield DDoS mitigation.
• Access: RBAC, mandatory MFA for internal staff, and SAML 2.0 / OIDC SSO for customers.

06 Authorized Sub-Processors & Notification

The Customer authorizes the engagement of the following Sub-Processors. Terrion AI will provide 30-day advance notice before engaging new Sub-Processors.

07 Data Subject Rights Assistance (DSAR)

Terrion AI provides automated tools and API endpoints to assist the Controller in fulfilling Data Subject Access Requests (DSAR), including access, rectification, erasure, and data portability. If a request is sent directly to us, we will forward it to the Controller without undue delay.

08 Personal Data Breach Notification Protocol

In the event of a confirmed Personal Data Breach, Terrion AI will notify the Customer without undue delay and within 48 hours of discovery. The notification will include the nature of the breach, affected data categories, root-cause telemetry, and immediate remediation steps taken.

09 Return & Cryptographic Deletion of Data

Upon subscription termination, the Customer is granted a 30-day data export window. Following this period, Terrion AI will execute NIST 800-88 compliant cryptographic erasure of all vector indexes, logs, and database backups. Certificates of destruction are available upon request.

10 Cross-Border Data Transfers & Regional Pinning

Data residency is pinned to the AWS region selected by the Customer during deployment (e.g., US-East, US-West, EU-Central). For transfers from the EU/EEA to the US, the parties rely on the EU Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.

11 Annexes & DPO Contact

Annex I: Details of Processing

• Categories of Data Subjects: Customer's employees, contractors, and end-users.
• Categories of Personal Data: Name, work email, IP addresses, ingested documents (PDF, DOCX), prompts, and metadata.
• Nature & Purpose: Provisioning of AI SaaS engines, RAG vector indexing, FinOps telemetry, and security monitoring.

Annex II: Summary of Technical Security Controls

• Network Security: VPC isolation, WAF, AWS Shield.
• Data Security: TLS 1.3, AES-256 KMS encryption.
• Access Control: IAM least privilege, MFA, SAML 2.0 SSO.