1. How this addendum applies
This Data Processing Addendum (“DPA”) is part of the agreement between you, the customer, and Frazer AI LLC (“Frazer”) for the Frazer services: the Terms of Service and any order form (the “Agreement”). It applies whenever Frazer processes Customer Personal Data, and it needs no signature. If you want a signed copy for your records, an owner of your organization can sign one in the console; the text is the same.
Where this DPA and the Agreement differ about personal data, this DPA applies. Where the Standard Contractual Clauses apply and differ from this DPA, the Clauses apply.
2. Definitions
- Data Protection Law means every law on the processing of personal data that applies to a party’s processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it applies in the United Kingdom (“UK GDPR”) with the Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and US state laws such as the California Consumer Privacy Act as amended (“CCPA”).
- Customer Personal Data means personal data in Your Content, as the Terms define it, that Frazer processes for you when it provides the services.
- Controller, processor, data subject, personal data, processing and supervisory authority have the meanings Data Protection Law gives them. Under the CCPA, “processor” includes “service provider”.
- Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Sub-processor means a company other than Frazer that Frazer engages to process Customer Personal Data.
- SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
3. Roles
You are the controller of Customer Personal Data, or a processor acting for your own customers. Frazer is your processor, or your sub-processor. You are responsible for having a lawful basis for the processing, for the instructions you give, and for the notices and consents your data subjects need.
Frazer is a separate controller only of the data it collects to run its relationship with you: account, billing, security and support data, as the Privacy Policy describes. This DPA does not cover that data.
4. Instructions
Frazer processes Customer Personal Data only on your documented instructions. Your instructions are the Agreement, this DPA, the settings and actions you and your agents take in the services, and any other instructions you give us in writing that we agree to. Frazer does not process Customer Personal Data for any other purpose, unless a law requires it, in which case we tell you first unless that law forbids it.
Frazer never uses Customer Personal Data to train or improve AI models, to advertise, or to build profiles for anyone, and never sells or shares it as the CCPA defines those words.
If we believe an instruction breaks Data Protection Law, we tell you, and we may suspend that processing until you confirm or change it.
5. People who process it
Frazer staff and contractors who may process Customer Personal Data are bound by confidentiality, trained in data protection and security, and get access only as their role needs it. Staff reach Customer Personal Data only with your consent on a support case, or with a recorded emergency reason approved as section 7 of Annex 2 describes. Every such action appears in your organization’s audit log within one minute.
6. Security
Frazer implements and maintains the technical and organizational measures in Annex 2. We may change them as technology and threats change, but never in a way that lowers the overall protection of Customer Personal Data. You are responsible for the security settings you control, such as who has access, whether two-factor sign-in is required, and how agents are allowed to act.
7. Sub-processors
- General authorization. You authorize Frazer to engage the sub-processors on the sub-processors list, and new ones as this section describes.
- Same protection. Frazer engages a sub-processor only under a written contract that gives Customer Personal Data at least the protection this DPA gives, and remains responsible to you for its performance.
- 30 days’ notice. Before a new sub-processor processes Customer Personal Data, Frazer updates the list and emails the owners and billing contacts of your organization at least 30 days ahead. If we must replace a sub-processor sooner to keep the services secure or running, we tell you as soon as we can, with the reason.
- Objection. You may object to a new sub-processor on reasonable data protection grounds by writing to privacy@frazer.ai during the notice period. We will work with you in good faith on a solution, such as a change in configuration or an alternative. If we cannot find one within 30 days of your objection, you may end the services that depend on that sub-processor by written notice, and we refund what you prepaid for them for the period after the end.
Model providers you reach with your own keys, the providers where servers you bring run, and tools you connect are your own choices, work under your agreements with them, and are not Frazer’s sub-processors.
8. Requests from data subjects
The services let you find, export, correct and delete personal data in Your Content, through the console, the API and the CLI. If a data subject’s request reaches Frazer about Customer Personal Data, we pass it to you without undue delay and do not answer it ourselves, other than to tell the person we have passed it on, unless you ask us to or the law requires it. Where you cannot answer a request with the services’ own tools, we help you, taking into account the nature of the processing.
9. Other help
Frazer gives you the information and help you reasonably need, taking into account the nature of the processing and the information we have, to meet your obligations on security, on data protection impact assessments and on consulting supervisory authorities. Where that help goes beyond what the services and our documentation provide, we may charge our reasonable costs, and we tell you before.
10. Personal Data Breaches
- Frazer notifies you of a Personal Data Breach without undue delay, and at the latest 48 hours after confirming it, by email to your organization’s owners and security contacts.
- The notice describes, as far as we know at the time, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Where we cannot give everything at once, we give it in stages, without further undue delay.
- We take reasonable steps to contain the breach and limit its effects, and we keep you informed.
- Notifying you is not an admission of fault. You decide whether to notify supervisory authorities and data subjects; we help you do it.
11. Return and deletion
You can export Your Content, including Customer Personal Data, at any time while the services run. When you delete data, or close a project or your organization, Frazer deletes the Customer Personal Data concerned from the live systems, with a grace period of 30 days for closures so that a mistake can be undone, after which the data is purged. Copies in encrypted backups are not restored from, and are deleted as the backups expire on their schedule. Where data is encrypted with a key held only for that data, Frazer destroys the key, which makes every copy unreadable. Frazer may keep Customer Personal Data longer only where a law requires it, and then only protects and processes it for that purpose.
12. Information and audits
- Frazer makes available the information needed to show it meets this DPA: this document, the security page, our answers to a reasonable security questionnaire once a year, and audit reports by independent auditors once we have them.
- If that is not enough to meet a requirement of Data Protection Law, or a supervisory authority requires it, or after a Personal Data Breach, you may audit Frazer’s processing of Customer Personal Data, by yourself or through an independent auditor bound by confidentiality, on 30 days’ written notice, during business hours, at most once a year unless a breach or an authority justifies more, and without access to other customers’ data. You bear the costs of the audit; we bear ours.
- Audits under the SCCs follow this section, as far as the SCCs allow.
13. International transfers
Frazer is in the United States and processes Customer Personal Data there, as the data locations page describes.
EU. Where you transfer Customer Personal Data to Frazer from the European Economic Area, or where the GDPR otherwise requires a transfer mechanism, the SCCs are incorporated into this DPA by reference. Module 2 applies where you are a controller and Module 3 where you are a processor. For them:
- Clause 7, the docking clause, applies;
- in Clause 9, option 2 applies, with the notice period in section 7 of this DPA;
- the optional wording in Clause 11 does not apply;
- in Clause 13, the competent supervisory authority is the one of the member state where you are established or, if you are not established in the EU, where your representative is established, or else where the data subjects concerned are;
- in Clauses 17 and 18, the law and courts of Ireland apply;
- Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and the list of sub-processors is the one in section 7.
United Kingdom. For transfers under the UK GDPR, the UK Addendum is incorporated by reference. Its tables are completed with the information in this section and in Annexes 1 and 2, and either party may end it as its section 19 allows.
Switzerland. For transfers under the FADP, the SCCs apply as set out for the EU, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers under the FADP; references to the GDPR include the FADP; and “member state” does not prevent data subjects in Switzerland from bringing claims where they habitually reside.
If a transfer mechanism is replaced or found invalid, we will work with you to put a valid one in place.
14. Requests from authorities
If an authority asks Frazer for Customer Personal Data, Frazer:
- tries to send the authority to you instead;
- tells you promptly, with a copy of the request, unless the law forbids it, and in that case asks for the prohibition to be lifted where that is reasonable;
- challenges a request it considers unlawful, and discloses only the minimum the request lawfully requires.
Our law-enforcement guidelines describe how we handle these requests, and we publish how many we receive each year.
15. US state privacy laws
Where the CCPA or a similar US state law applies, Frazer, as your service provider or processor:
- does not sell or share Customer Personal Data;
- does not retain, use or disclose it for any purpose other than the business purposes in the Agreement, which are providing, securing and supporting the Services you use, including outside the direct business relationship with you;
- does not combine it with personal data it receives from others, or collects itself, except as those laws allow;
- complies with those laws and gives Customer Personal Data the same level of protection they require;
- tells you if it can no longer meet its obligations under them;
- lets you verify its compliance, as section 12 describes, at least once every 12 months;
- helps you answer consumers’ requests, as section 8 describes;
- lets you take reasonable steps to stop and remedy any use of Customer Personal Data that is not authorized;
- requires the same of its own sub-processors.
Frazer certifies that it understands and will comply with these restrictions.
16. Liability
Each party’s liability under this DPA, and under the SCCs between the parties, is subject to the limits and exclusions of the Agreement, except where Data Protection Law does not allow them to apply. Nothing in this DPA limits a data subject’s rights under the SCCs.
17. Changes
We may update this DPA to reflect changes in Data Protection Law, in the services or in our sub-processors. We announce changes 30 days ahead, as the Terms describe. A change never lowers the protection this DPA gives Customer Personal Data during the term of an order form you signed.
Annex 1. Description of the processing
| Item | Description |
|---|---|
| Data exporter | The customer, as identified in its account or order form. Contact: its organization’s owners |
| Data importer | Frazer AI LLC, a Florida limited liability company, 1221 Brickell Ave, Ste 900, Miami, FL 33131, provider of the Frazer services. Contact: privacy@frazer.ai. Role: processor or sub-processor |
| Data subjects | Whoever the customer’s personal data is about: for example its staff, contractors, users of its applications, its customers, people in its code and documents, and recipients of mail it sends through Frazer |
| Categories of personal data | Whatever the customer puts into the services: for example names, contact details, identifiers, account data of its own users, communications, and data in code, files, databases, logs, prompts and outputs |
| Special categories | Only if the customer chooses to process them. Safeguards: encryption, access limited by role, audit of every staff access, and the measures in Annex 2 |
| Frequency | Continuous, for as long as the customer uses the services |
| Nature of the processing | Hosting, storage, computing, networking, transmission and delivery, model inference through the gateway, backup, support and the other operations of the services as the Agreement describes them |
| Purpose | To provide, secure and support the services under the Agreement, on the customer’s instructions |
| Duration and retention | For the term of the Agreement, then until deletion as section 11 describes |
| Transfers to sub-processors | As listed on the sub-processors list, for the services each one supports, for the duration above |
Annex 2. Technical and organizational measures
- Encryption. Data is encrypted in transit with TLS, and between Frazer’s components with mutual TLS. Data at rest is encrypted on disk. Repository content is encrypted with a key per domain, so destroying the key makes every copy unreadable.
- Isolation. Customers and projects are kept apart: separate tenants for metrics and logs, separate virtual machines for workloads that need them, per-organization GPU machines, and network policies between projects.
- Identity and access. Single sign-on and two-factor sign-in for customers; hardware keys for staff; short-lived credentials of at most 8 hours; no standing administrator access to production; least-privilege roles; and a review of staff access every quarter.
- Secrets. Secret values are write-only for people by default; reading one needs an explicit grant and a second factor, and is audited.
- Servers you bring. Servers connect out to Frazer; they need no inbound ports, and Frazer staff have no shell on them.
- Audit. Every change, by a person, an agent or Frazer, is recorded. Administrative audit logs are kept for 400 days. Every staff access to customer data is recorded and shown in the customer’s audit log within one minute.
- Emergency access. Emergency credentials are sealed and split between two people; every use alerts, is recorded, and is reviewed within 24 hours.
- Changes. Infrastructure is defined as code. Changes are reviewed plans, need two approvals, and are applied only from the main line; a nightly check reports drift.
- Software supply chain. Releases are built in isolated CI, signed, and verified before they are deployed.
- Vulnerability management. Images and dependencies are scanned continuously, and fixes are prioritized by exploitability and exposure. External researchers can report issues under our Vulnerability Disclosure Policy.
- Monitoring and incident response. Frazer monitors its own systems with the same Security Center customers use, runs incidents with defined severities and on-call staff, and writes blameless reviews with dated actions.
- Backups and recovery. Backups are encrypted and copied off the primary site; restore tests run every night; a standby site in the United States can take over if the primary site is lost.
- Data minimization. The LLM gateway keeps metadata, not bodies, by default; mail bodies are kept only until delivered; known secret formats are dropped from logs before they are stored.
- Physical security. Frazer’s servers are in data centers with controlled access, surveillance and environmental protection, run by providers bound by contract.
- People. Staff and contractors sign confidentiality obligations and are trained in security and data protection.
Annex 3. Sub-processors
The sub-processors list, as updated under section 7.