DAVAI LLC · Last updated: 1 September 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between DAVAI LLC ("Processor") and the customer organization ("Controller") and applies where the Processor processes personal data on the Controller's behalf in providing DAVAI Trace.
The Controller determines the purposes and means of processing. The Processor processes personal data only on the Controller's documented instructions, which the Terms, this DPA, and the Controller's use of the Service's features constitute. The Processor will inform the Controller if an instruction appears to infringe applicable data-protection law.
Subject matter — provision of the Service. Duration — the term of the subscription, plus the retention periods in the Privacy Policy. Nature and purpose — hosting, retrieval, model-assisted analysis, generation of reports, collaboration, metering, and support.
Categories of data subjects — the Controller's personnel who hold accounts, and any individuals referenced within content the Controller submits. Types of personal data — account identifiers and contact details, authentication data, usage and audit records, and whatever personal data the Controller chooses to include in content it uploads.
The Service is not designed for and must not be used to process special-category health data about identifiable individuals, or data subject to HIPAA as protected health information, unless separately agreed in writing.
The Processor ensures that personnel authorized to process personal data are bound by confidentiality obligations and receive appropriate training, and limits access to those who need it to provide or support the Service.
The Processor implements appropriate technical and organizational measures, including: tenant isolation enforced at the database through row-level security; encryption of data in transit using TLS; encryption of off-site backups at rest using AES-256; hashed credentials; optional multi-factor authentication; role-based access control within an organization; audit logging of sign-ins, sharing, exports, and administrative actions; and rate limiting and spend controls.
Measures may be updated over time provided the level of protection is not reduced.
The Controller gives general authorization for the Processor to engage the sub-processors listed on this page. The Processor imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains liable for their performance.
The Processor will give notice before a new sub-processor begins processing customer content. The Controller may object on reasonable data-protection grounds within 30 days, and if the parties cannot resolve the objection the Controller may terminate the affected part of the Service without penalty for the unused remainder of the term.
| Provider | Purpose | Region |
|---|---|---|
| phoenixNAP | Application, database and knowledge-graph hosting | United States |
| Anthropic (Claude) | Language-model inference for report generation and chat | United States |
| OpenAI | Language-model inference for evidence classification and enrichment steps within the pipeline | United States |
| Moonshot AI (Kimi) | Language-model inference for polarity grading of PUBLIC literature (published abstracts) and relationship extraction. Under an enterprise provider policy it never receives customer documents, chat prompts or report drafts — those are routed to the US providers above. | Singapore / China |
| WorkOS | Authentication, single sign-on and directory sync | United States |
| Optional Google sign-in, and outbound transactional email | United States | |
| Stripe | Subscription billing and payment processing | United States |
| Cloudflare | Encrypted off-site backup storage and DNS | United States |
| Sentry | Application error monitoring and diagnostics | United States |
Providing the Service requires sending content to language-model providers, which are listed as sub-processors. Those providers act on the Processor's instructions, are contractually prohibited from using Controller content to train models, and retain content only as needed to return a result or to meet their own legal obligations.
The Controller can limit what reaches a model provider by choosing, per run, to exclude its own uploaded documents and rely on public sources only.
Taking into account the nature of processing, the Processor assists the Controller by appropriate technical and organizational measures with: responding to data-subject requests; the security of processing; breach notification; data-protection impact assessments; and prior consultation with a supervisory authority.
The Service provides export and deletion capabilities the Controller can operate itself for most such requests.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, and will provide the information reasonably available to it to enable the Controller to meet its own notification obligations.
Where the Processor or a sub-processor transfers personal data out of the EEA, the UK, or Switzerland, the transfer is made under an appropriate safeguard, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference where they apply.
The sub-processor list on this page identifies the processing region for each provider.
On reasonable written request, and no more than once per year unless required by a supervisory authority or following a breach, the Processor will make available the information necessary to demonstrate compliance with this DPA, and will contribute to an audit conducted by the Controller or an independent auditor bound by confidentiality, at reasonable times and without unreasonable disruption to the Service.
On termination, and at the Controller's choice, the Processor will return or delete Controller personal data within the periods set out in the Privacy Policy, except where retention is required by law. Backup copies are deleted on their ordinary rotation, described in the Privacy Policy.
In the event of a conflict between this DPA and the Terms of Service on the processing of personal data, this DPA prevails.
To request a countersigned copy of this DPA, contact privacy@davai.ai.