Data processing agreement

Roles

For personal data that a business customer puts into its workspace (for example its staff's accounts, its repositories, logs and AI conversations), the customer is the Data Fiduciary and Escanor Labs processes it on the customer's behalf as its Data Processor under the Digital Personal Data Protection Act, 2023. This agreement applies automatically to every workspace; Enterprise customers can sign a copy by writing to support@escanor.in or on a call.

What we process

• Subject matter and purpose: providing Escanor (dashboards, the AI assistant, automations, machine access and the apps) as the customer configures it.
• Duration: while the workspace exists, then deletion as described below.
• Data principals: the customer's users, and people whose data appears in content the customer connects.
• Categories: account and sign-in data; content from connected services; AI prompts and replies; machine commands and output; logs.

Our commitments

• Process the data only on the customer's documented instructions (its configuration of the service and its requests), unless the law requires otherwise, in which case we tell the customer first where the law allows.
• Keep it confidential, and give access only to staff who need it and are bound to confidentiality.
• Apply the security safeguards in Rule 6 of the DPDP Rules, 2025: encryption of stored keys and tokens, access control, logging and monitoring of access, backups, logs kept for one year, and these same obligations in our contracts with sub-processors.
• Tell the customer of a personal data breach affecting its data without undue delay and within 24 hours of becoming aware of it, with what we know, so it can meet its 72-hour duty to the Data Protection Board; and report to CERT-In within 6 hours.
• Help the customer answer its data principals' requests (access, correction, erasure, nomination) and complaints.
• Use only the sub-processors listed below, and tell customers at least 30 days before adding one, so they can object.
• When the workspace is deleted, delete its personal data within 7 days, except records the law requires us to keep (listed in the Privacy policy), and certify deletion on request.
• Make available the information needed to show we meet these terms, and answer reasonable audit questionnaires once a year.

Sub-processors

• Amazon Web Services: application servers and database, Mumbai, India.
• Vercel: website hosting and delivery, global.
• Cloudflare: network and secure tunnel, global.
• Google Cloud: Escanor's own AI models (Mumbai, India), Gemini models, and Firebase Cloud Messaging for app notifications.
• Razorpay Software Private Limited: payments, India.
• Zoho: email delivery, India.

Transfers outside India

Data processed by a global sub-processor may leave India. We never transfer it to a country the Government of India has restricted under section 16 of the DPDP Act.