Data Processing Agreement (DPA)

1.1 The Parties

Controller (hereinafter, the "Customer"):

The natural or legal person contracting the Alethexis Service, whose full identification details are recorded in the sign-up form and reflected in the Service account. For the purposes of this Agreement, the Customer acts as controller within the meaning of Art. 4(7) GDPR.

Processor (hereinafter, "Alethexis" or the "Processor"):

ALETHEXIS, S.L. (Tax ID (NIF) B88758057 · registered office at C/ Tirso de Molina 36, 08940 Cornellà de Llobregat, Barcelona · CNAE 6201), represented by its sole director Rafael Luque, operator of the Service marketed under the brand Alethexis — AI Governance & Compliance Framework for SMEs™. Privacy contact point: [email protected]. For the purposes of this Agreement, Alethexis acts as processor within the meaning of Art. 4(8) GDPR.

1.2 Recitals

I. The Customer has contracted the Alethexis Service, a SaaS application for artificial intelligence governance and GDPR compliance aimed at European SMEs (hereinafter, the "Service"), in accordance with the published terms of service and the subscribed plan.

II. The operation of the Service entails Alethexis processing personal data on behalf of the Customer, which constitutes a processing-on-behalf relationship subject to Art. 28 GDPR.

III. The Parties wish to document that engagement by means of this Data Processing Agreement (hereinafter, "DPA" or "Agreement"), which is incorporated into and forms an indivisible part of the terms of service.

IV. In the event of any conflict between this DPA and the terms of service in matters of personal data protection, the provisions of this DPA shall prevail.

For the purposes of this DPA, capitalised terms shall have the meaning set out below. Terms not defined here shall be interpreted in accordance with the GDPR.

3.1 Material scope

This DPA governs the processing of the Substantive Data carried out by Alethexis, on behalf and in the interest of the Customer, exclusively in the context of the provision of the Alethexis Service.

3.2 Exclusions

The following fall outside the scope of this DPA:

• The Account Data of the Customer itself and of its Users, in respect of which Alethexis acts as an independent controller as documented in its public privacy policy.
• Personal data processed by the Customer outside the Service.
• Personal data that the Customer decides not to enter into the Service.

3.3 Subordination

The processing carried out by Alethexis under this DPA is subordinate to the documented instructions of the Customer, as set out in this Agreement, in the terms of service and in the functional configuration of the Service.

4.1 Nature and purpose

The purpose of the processing is to enable the Customer to operate the Alethexis Service in order to exercise its AI governance and GDPR diligence: registration of AI systems, P0–P6 classification, FRIA and DPIA assessments, policy publication, generation of evidence and the other contracted functionalities. The operational details of the processing are set out in Annex I.

4.2 Duration

This DPA shall remain in force for as long as the subscription agreement for the Service between the Parties remains in force and, in any event, until the return or deletion procedure provided for in clause 10 has been completed.

4.3 Unauthorised purposes

Alethexis undertakes not to process the Substantive Data for any purpose other than the provision of the Service. In particular, Alethexis expressly declares that it does not sell the Substantive Data, does not disclose them to third parties for their own purposes, does not use them to train its own or third-party artificial intelligence models and does not carry out profiling on them.

The details of the types of Personal Data processed and the categories of Data Subjects concerned are set out in Annex I.

By way of guidance and without being exhaustive, Data Subjects may include employees, candidates, patients, end customers and other natural persons whose data the Customer decides to incorporate into the Service in its inventories, FRIAs or DPIAs. The Personal Data may include, if the Customer so decides, special categories under Art. 9 GDPR (for example, health data in sectors such as dentistry). The Customer is solely responsible for the lawfulness, legal basis and proportionality of the data it enters into the Service.

Alethexis, in its capacity as Processor, assumes the obligations provided for in Art. 28(3) GDPR, as developed below.

6.1 Processing only on documented instructions (Art. 28(3)(a))

Alethexis shall process the Personal Data only on documented instructions from the Customer, including with regard to international transfers, unless required to do so by Union or Member State law, in which case it shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on grounds of public interest.

The following constitute documented instructions:

• This DPA and its Annexes.
• The terms of service accepted by the Customer.
• The configurations applied by the Customer or its authorised Users within the Service.
• Any additional written instructions that the Customer may send to [email protected].

The following are also documented instructions of the Controller, in addition to those set out in this Agreement: activation of the read API and issuance of the corresponding keys; configuration of one or more recipients of outbound notifications, including the destination address; designation of an identity provider for federated authentication; and the granting of temporary external auditor access. Alethexis carries out those instructions and does not itself determine the recipients, purposes or means of those communications.

If Alethexis considers that an instruction infringes the GDPR or other applicable data protection legislation, it shall inform the Customer without delay.

Use of activity records by the Customer. The records of use of AI systems, responsibility matrices, AI literacy measures and other records generated in the platform are processed for the purpose of documenting the governance of the use of artificial intelligence in the Customer's organisation. Any use of those records by the Customer for the evaluation of performance, the monitoring of conduct or the disciplinary management of workers constitutes a different purpose, under the exclusive responsibility of the Customer in its capacity as controller, which must determine and document in advance its legal basis, necessity, proportionality, transparency and other applicable safeguards. The platform is not designed for that purpose and does not incorporate functionalities for scoring, classifying or ranking individual workers.

6.2 Confidentiality of personnel (Art. 28(3)(b))

Alethexis shall ensure that persons authorised to process Personal Data:

• Have committed themselves to confidentiality or are under an equivalent statutory obligation of confidentiality.
• Receive appropriate training in data protection and information security.
• Access the Personal Data only where necessary for the provision of the Service (principle of least privilege).

This obligation extends to the operator of the Service itself and to any future team member, and is formalised by means of an NDA and a documented undertaking.

6.3 Security measures (Art. 28(3)(c) and Art. 32)

Alethexis shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR. The details of these measures are set out in Annex III, which forms an integral part of this DPA and may be updated to reflect technical improvements, provided that such updates do not reduce the level of protection.

6.4 Sub-processors (Art. 28(3)(d), Art. 28(2) and Art. 28(4))

The Customer grants Alethexis a prior general authorisation to engage Sub-processors, in accordance with Art. 28(2) GDPR. The up-to-date list of authorised Sub-processors is set out in Annex II.

Alethexis undertakes to:

• Impose on each Sub-processor, by way of a contract or other binding legal act, the same data protection obligations as those set out in this DPA, in particular those relating to security measures and purpose limitation.
• Keep the list of Sub-processors up to date and publicly accessible at alethexis.com/en/subprocessors.
• Notify the Customer at least 30 days in advance of any addition, removal or replacement of a Sub-processor, by email to the Customer's contact address and by a visible notice in the Service.
• Recognise the Customer's right to object on reasoned grounds to the addition of a new Sub-processor within 30 days following the notification. In the event of a reasonable objection, the Parties shall negotiate in good faith an alternative solution. If this is not possible, the Customer may terminate the subscription agreement for the Service without penalty in respect of the unused portion.
• Remain liable to the Customer for the performance of the data protection obligations by its Sub-processors.

6.5 Assistance in the exercise of Data Subjects' rights (Art. 28(3)(e))

Alethexis shall assist the Customer, by appropriate technical and organisational measures and insofar as this is possible, in responding to requests for exercising the Data Subjects' rights (access, rectification, erasure, restriction, portability, objection and automated individual decision-making — Arts. 15 to 22 GDPR).

To that end, the Service incorporates self-service functionalities that allow the Customer to:

• Access and edit the Substantive Data directly.
• Export the data in structured formats (JSON, CSV) and, where applicable, the PDFs generated by the Service.
• Delete data by itself through the interface, without the need for Alethexis to intervene.

Where assistance requires direct technical intervention by Alethexis (for example, complex exports or bulk deletions exceeding the self-service functionality), the Customer may request it at [email protected]. The obligation to handle Data Subjects' requests in the first instance lies with the Customer as controller; Alethexis does not reply directly to the Data Subject except on documented instructions from the Customer.

6.6 Assistance with security, breaches, DPIA and prior consultation (Art. 28(3)(f), Arts. 32-36)

Alethexis shall assist the Customer in ensuring compliance with the obligations incumbent on the controller pursuant to Arts. 32 to 36 GDPR, taking into account the nature of the processing and the information available to it. In particular, it shall:

• Make available to the Customer the information in Annex III (security measures) and, through the public Trust Center (alethexis.com/trust), up-to-date information on its security posture.
• Notify the Customer of Personal Data Breaches in accordance with clause 8.
• Where the Customer carries out a DPIA (Art. 35 GDPR) or a prior consultation (Art. 36 GDPR) relating to processing that includes the use of the Service, reasonably provide the technical and organisational information necessary on the processing that Alethexis carries out in its capacity as Processor.

This assistance is proportionate to the role of Processor and does not replace the Customer's own obligations as controller, in particular those relating to the determination of the legal basis, the information to Data Subjects and the substantive response to their rights.

6.7 Return or deletion at the end of the provision of services (Art. 28(3)(g))

At the end of the provision of the Service, Alethexis shall return the Personal Data to the Customer or delete them, as detailed in clause 10 and in accordance with the five-level staged deletion policy described there.

The blocked retention provided for in clause 10.5 is excepted; Alethexis carries it out in its capacity as processor and under Article 33(4) of Spanish Organic Law 3/2018, for as long as liabilities may arise from its relationship with the Customer. That retention does not turn Alethexis into a controller.

6.8 Information to demonstrate compliance and audits (Art. 28(3)(h))

Alethexis shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and shall allow for and contribute to audits, including inspections, in accordance with clause 9. If Alethexis considers that an instruction from the Customer in this area infringes the GDPR or other legislation, it shall immediately inform the Customer.

The full list of authorised Sub-processors, their functions, locations and safeguard mechanisms is set out in Annex II.

7.1 Procedure for notifying changes

• Any addition, removal or replacement of a Sub-processor shall be notified to the Customer at least 30 calendar days in advance, by email to the contact address registered in the Customer's account and by a visible notice in the Service.
• The public list of Sub-processors shall be updated simultaneously at alethexis.com/en/subprocessors.

7.2 Controller's right to object

• The Customer may object on reasoned grounds to the addition of a new Sub-processor within 30 days following the notification, by written communication to [email protected].
• In the event of a reasonable objection, the Parties shall negotiate in good faith, for a period of up to 30 days, an alternative solution (for example, a configuration of the Service that avoids the objected Sub-processor, or replacement by another provider).
• If no agreement is reached, the Customer may terminate the subscription agreement for the Service early by written notice, with the right to a pro-rata refund of the unused portion of the subscribed plan.

7.3 Sub-processors not applicable to Substantive Data

Certain third parties used by Alethexis (GitHub for the code repository and Anthropic as a development assistant) do not access the Customer's Substantive Data. This separation is structural and is supported by an internal operating rule that prevents personal data of customer production accounts from being extracted through development or verification tools. They are therefore not included as Sub-processors.

7.4 Recipients authorised by the Controller

On the Customer's instruction, the Service allows certain information to be made available to third parties designated by the Customer itself: recipients of outbound notifications (webhooks), holders of read API keys and external auditors to whom the Customer grants temporary read-only access.

Those third parties are not Sub-processors of Alethexis, because Alethexis does not engage them, does not pay them and does not give them instructions. They are recipients within the meaning of Article 4(9) GDPR. Their own role — processor of the Customer, independent controller or otherwise — depends on the legal relationship they have with the Customer, and it is not for Alethexis to characterise it.

It is for the Customer to authorise each recipient, to determine what they may consult and to ensure that an adequate legal and confidentiality relationship exists with them.

External auditor access is served over minimised views of evidence, without direct user identifiers, always expires — 7, 30 or 90 days, with no option of indefinite access —, the Customer may revoke it at any time and it may be granted with or without download. Every access and every download is recorded in the Customer's audit log.

8.1 Detection and containment

Alethexis has internal procedures for the detection, containment of and response to Personal Data Breaches, documented in its internal SECURITY_RUNBOOK.md and applied on an ongoing basis.

8.2 Notification to the Customer

Alethexis shall notify the Customer without undue delay and, in any event, within 24 hours of becoming actually aware of a Personal Data Breach affecting the Customer's Substantive Data. The notification shall be sent by email to the contact address registered in the Customer's account and, where appropriate, by a notice in the Service.

8.3 Content of the notification

The notification shall include, to the extent available at the time of the notice, the elements provided for in Art. 33(3) GDPR:

• The nature of the Breach and, where possible, the categories and approximate number of Data Subjects and records concerned.
• Details of the contact point at Alethexis where more information can be obtained.
• The likely consequences of the Breach.
• The measures taken or proposed to address the Breach and, where appropriate, to mitigate its possible adverse effects.

If not all the information is available at the time of the initial notification, Alethexis shall provide successive updates as the investigation progresses.

8.4 Notification to authorities and Data Subjects

Notification to the competent supervisory authority (in Spain, the AEPD, the Spanish Data Protection Authority, or the supervisory authority competent for the Customer) in accordance with Art. 33 GDPR and, where applicable, communication to the Data Subjects in accordance with Art. 34 GDPR, are the responsibility of the Customer as controller. Alethexis shall assist the Customer by providing the available information and by responding reasonably to additional requests from the Customer and, where applicable, from the authority.

8.5 Retention of evidence

Alethexis shall retain, for a minimum of 5 years, the evidence relating to Breaches detected and notified, as well as the post-mortem analyses and the corrective measures applied, for defensive and continuous-improvement purposes.

9.1 Customer's right of audit

The Customer, as controller, has the right to verify Alethexis's compliance with the obligations of Art. 28 GDPR and of this DPA, by means of:

• Requests for information addressed to [email protected], which Alethexis shall answer within a reasonable period.
• Consultation of the public Trust Center (alethexis.com/trust), which includes up-to-date information on sub-processors, security measures and applicable certifications or adherences, where relevant.
• Where appropriate, an on-site or remote audit on the terms of clauses 9.2 to 9.5.

9.2 Frequency and notice

Unless there is a reasonable cause justifying otherwise (for example, a significant Personal Data Breach or a request from an authority), the right of audit shall be exercised:

• With a maximum of one audit per calendar year.
• With at least 30 calendar days' prior written notice.
• During normal business hours and in a manner that does not unreasonably interfere with the operation of the Service.

9.3 Auditor

The Customer may carry out the audit itself or through a qualified independent auditor, who may in no case be a direct competitor of Alethexis. The auditor shall first sign a confidentiality agreement (NDA) with Alethexis.

9.4 Scope

The audit shall be limited to verifying compliance with the obligations arising from this DPA and from Art. 28 GDPR. The following are excluded: proprietary source code, the data of other customers, trade secrets unrelated to the processing and any information whose disclosure could compromise the security of the Service.

9.5 Cost

The costs of the audit shall be borne by the Customer, unless the audit reveals material breaches attributable to Alethexis, in which case Alethexis shall bear the reasonable costs directly related to the audit.

9.6 Audits by authorities

The foregoing is without prejudice to the powers of inspection and audit vested in the AEPD, the AESIA (Spanish Agency for the Supervision of Artificial Intelligence) or other competent authorities. Alethexis shall cooperate in good faith with such authorities and shall keep the Customer informed, insofar as legally possible.

10.1 Five-level staged deletion policy

At the end of the provision of the Service, whether by termination of the agreement, deletion requested by the Customer or any other cause, Alethexis shall apply the following staged deletion policy, aligned with Art. 17 GDPR and with the applicable commercial and documentary-defence obligations:

10.2 Closure communication

At the close of the process, the Customer's Owner shall receive a confirmation email including:

• Hash of the export delivered (proof of delivery).
• A summary of which data are retained, on which medium and on what legal basis.
• An approximate schedule for the purge of the backup.

10.3 Grace period

After cancellation of the agreement and before starting the deletion procedure, Alethexis shall apply a 30-day grace period during which the Customer may:

• Carry out the final export of its data itself from the Service.
• Reactivate the subscription without loss of data.

Once that period has elapsed without reactivation, the deletion cascade described in 10.1 shall begin.

10.4 Legal exceptions

Where Union or Member State law requires the retention of Personal Data beyond the above periods (for example, court orders, tax obligations), Alethexis shall inform the Customer and shall retain the strictly necessary data for the legally required period.

10.5 Blocked retention (Articles 32 and 33(4) LOPDGDD)

Once the engagement has ended, Alethexis may retain a copy of the data that is necessary to address any liabilities arising from its relationship with the Controller, duly blocked under Articles 32 and 33(4) of the LOPDGDD. As a general rule, that retention shall have a maximum duration of five years from the end of the engagement, without prejudice to a different limitation period being applicable or to a legal cause interrupting or extending that period. Once the applicable limitation period has elapsed, the data shall be destroyed.

Blocked means, under Article 32 of Spanish Organic Law 3/2018, that the data are identified and set aside and that their processing, including their display, is prevented, except in order to make them available to judges and courts, the Public Prosecutor's Office or the competent public administrations.

In Service terms: no read function and no API return those entries, to any user or any role. The only way out is an internal disclosure procedure for authorities that requires a reason and is itself recorded.

What does continue to operate on blocked data, because Article 32 itself requires it — «identify and set aside»: verification of the integrity of the chain, the daily export of its head, suspension of destruction where a legal cause interrupts or extends the period, and destruction on expiry of the applicable period. None of the four returns content.

11.1 General regime

In the current version of the Service (Wave 1), Alethexis has configured its infrastructure so that the Substantive Data are stored within the European Economic Area (Supabase, eu-central-1 · Frankfurt). However, the provision of the Service entails the Substantive Data transiting through the delivery and edge network of infrastructure providers with a presence outside the EEA (United States), in particular Cloudflare (proxy/CDN/WAF) and Vercel (hosting and edge network). Such transfers are covered by safeguards in accordance with Chapter V of the GDPR: the Standard Contractual Clauses under Article 46(2)(c), with the assessment and such supplementary measures as may be necessary. The location and safeguard mechanism of each Sub-processor are set out in Annex II and in the up-to-date public list at alethexis.com/subprocessors.

• Storage of Substantive Data: Supabase eu-central-1 (Frankfurt) — EEA.
• Transit / edge: Cloudflare (USA) and Vercel (USA primary + global edge) — under Chapter V safeguards.
• Payments, email to users and customer correspondence: they process Account Data (Alethexis as controller) — see the privacy policy, not this DPA.

11.2 Additional future transfers

If in the future an additional Sub-processor or a processing operation entailing a new transfer of Substantive Data outside the EEA other than those declared in 11.1 were to be incorporated, Alethexis shall:

• Apply one of the safeguard mechanisms provided for in Chapter V of the GDPR (Arts. 44 to 49), preferably the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR) accompanied by such supplementary measures as may be necessary in accordance with the applicable case law (Schrems II, among others).
• Notify the Customer in accordance with the procedure for changes of Sub-processors (clause 7.1).
• Make available to the Customer the documentation evidencing the safeguard mechanism applied.

12.1 Allocation of liability

Each Party shall be liable for the damage caused as a result of a breach of the obligations that the GDPR and this DPA assign to it in its respective capacity as controller or processor, on the terms of Art. 82 GDPR.

12.2 Limitation proportionate to the role of Processor

Alethexis's liability towards the Customer arising from this DPA is limited to damage directly attributable to its breach of the obligations incumbent on it as Processor. In particular, Alethexis shall not be liable for:

• The Customer's decisions as controller (legal basis of the processing, information to Data Subjects, substantive handling of their rights, compliance with Art. 5 GDPR).
• The suitability or lawfulness of the data that the Customer decides to enter into the Service.
• The consequences arising from instructions of the Customer with which Alethexis has complied in accordance with this DPA, unless such instructions were manifestly unlawful and Alethexis had not reported them in accordance with clause 6.1.

12.3 Amount

Except in cases of wilful misconduct or gross negligence, or where the applicable law does not permit it, the aggregate liability of each Party towards the other under this DPA shall be limited as provided in the terms of service. This limitation does not apply to fines imposed by a supervisory authority directly on one of the Parties, nor to compensation to Data Subjects resulting from such fines, which shall be governed by Art. 82 GDPR.

12.4 Cooperation in defence

If a Data Subject, authority or third party brings a claim in relation to the processing covered by this DPA, both Parties shall cooperate in good faith to coordinate the defence and the response, sharing the information reasonably necessary.

13.1 Term

This DPA shall enter into force on the date of its acceptance by the Customer (click-through during onboarding to the Service or electronic signature) and shall remain in force for as long as the subscription agreement for the Service between the Parties remains in force, unless the return and deletion clauses (clause 10) or the audit clauses (clause 9) require their subsequent application.

13.2 Amendment

Alethexis may amend this DPA in the following cases:

• Legislative or regulatory changes affecting the GDPR or related legislation.
• Decisions of supervisory authorities requiring adjustments.
• Improvements to the technical and organisational measures that increase the level of protection.
• Changes to the list of Sub-processors, in accordance with the procedure in clause 7.

Amendments shall be notified to the Customer with reasonable notice, a minimum of 30 calendar days where materially possible, by email and by a notice in the Service. If the amendment substantially reduces the level of protection or introduces changes that the Customer cannot reasonably accept, the Customer shall be entitled to terminate the subscription agreement without penalty.

13.3 Severability

If any provision of this DPA is declared null and void or unenforceable, the remainder of the Agreement shall remain valid. The Parties shall negotiate in good faith a replacement clause that reflects, insofar as possible, the original intention.

13.4 Governing law

This DPA is governed by Spanish law and by the applicable law of the European Union, in particular Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

13.5 Jurisdiction

The Parties submit, expressly waiving any other forum to which they may be entitled, to the Courts and Tribunals of the city of Barcelona (Spain) for the resolution of any dispute arising from this DPA, without prejudice to the powers conferred by law on the AEPD or on other supervisory authorities.

13.6 Languages and prevalence

This Agreement is available in Spanish and English. Both versions state the same obligations. In the event of a discrepancy of interpretation, the Spanish version prevails, without prejudice to mandatory rules.

Read the Spanish version

A.I.1 Subject matter of the processing

Processing of Personal Data by Alethexis, on behalf of the Customer, in the context of the provision of the Alethexis Service (modules M1 Visibility, M2 Governance, M3 High-Risk Ready and, where applicable, Agentic Add-on).

A.I.2 Duration of the processing

For as long as the subscription agreement for the Service remains in force, plus the return and retention periods provided for in clause 10 of the DPA.

A.I.3 Nature and purpose

A.I.4 Types of Personal Data

The following types are included by way of guidance. The actual determination lies with the Customer.

The Customer undertakes not to enter into the Service Personal Data that are unnecessary for the declared purpose, in accordance with the data minimisation principle of Art. 5(1)(c) GDPR.

A.I.5 Categories of Data Subjects

A.I.6 Processing operations

Collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, internal disclosure between Sub-processors in accordance with Annex II, alignment, restriction, erasure, destruction and export.

Technical channels. In addition to the web interface, the Service makes available to the Customer an authenticated read API, outbound notifications (webhooks) and federated authentication (SSO/SAML). These are technical interfaces or channels through which Alethexis processes or transmits information on the Controller's instructions; their activation and configuration are the Customer's responsibility.

A.I.7 Location of the processing

Storage in the European Economic Area (Frankfurt). Transit through edge infrastructure with a presence outside the EEA under Chapter V GDPR safeguards. Details per Sub-processor in Annex II.

Version: 1.4 · Review date: 9 October 2026 · The live source of this list is the public page alethexis.com/subprocessors, which prevails in the event of a temporary divergence between updates.

Notes:

• The current version of this list is published at alethexis.com/en/subprocessors.
• The providers of payments, invoicing and transactional email — Stripe, Holded and Resend — process Account Data of which Alethexis is the controller, not the Customer's Substantive Data. For that reason they do not appear in this Annex: they are listed in Block 2 of the public Register, together with Google Workspace.
• GitHub (code repository) and Anthropic (development assistant) do not access the Customer's Substantive Data and are therefore not included as Sub-processors in this Annex. The separation is structural and is supported by an internal operating rule that prevents personal data of customer production accounts from being extracted through development or verification tools (clause 7.3).
• Any addition, removal or replacement shall be notified to the Customer in accordance with clause 7 of the DPA, with at least 30 calendar days' notice.

The following measures are those applied at the time of signing the DPA. They may be updated to reflect improvements, provided that such updates do not reduce the level of protection.

A.III.1 Encryption

• In transit: all connections with the Service are encrypted using TLS. With current browsers, TLS 1.3 is established.
• At rest: the database and file storage are encrypted by the infrastructure provider (Supabase) with AES-256.

A.III.2 Access control

• Authentication: Supabase Auth. The active methods are password, one-time code sent by email and sign-in with Google. Single sign-on (SAML) is available to organisations with M2 or M3 and is configured by each Client. Magic-link sign-in is not offered.
• Two-step verification: available to all Users. It is required of the Owner and DPO roles to access the M3 module (High-Risk Ready): without a session verified in two steps, access is denied.
• Multi-tenant isolation: Row Level Security enabled on every table with account_id, each with at least one isolation policy. RLS tests run in continuous integration and no change is deployed if they fail.
• Least privilege: canonical Customer roles (Owner, AI Officer, DPO, Contributor, Auditor) with differentiated permissions; sensitive sections are restricted by role through additional policies.
• Supabase service role keys: used exclusively in the server's route handlers and Server Actions, never exposed to the client.

A.III.3 Auditability and integrity

• Application-level append-only audit log, with cryptographic integrity controls, periodic verification and daily external anchoring. In the audit.access_log table the application roles are granted INSERT and, where applicable, SELECT, and no UPDATE or DELETE permission at database level. Each entry chains its SHA-256 fingerprint to that of the previous one; the chain is verified daily and its head is exported every day to a store held by a different provider, under independent access control and without overwriting, so that the system is designed so that a full reconstruction of the log would be detected when compared against that copy. Retention in accordance with clause 10.1, level 4.
• The system is designed to evidence unauthorised alterations (tamper-evident). Alethexis does not claim that any alteration is detectable: that depends on the threat model and on the anchoring and comparison mechanism remaining intact.
• FRIA and DPIA PDFs protected with a SHA-256 integrity fingerprint embedded in the metadata and shown on the last page, allowing verification that the document has not been altered. It does not constitute an electronic signature within the meaning of Regulation (EU) 910/2014. Database triggers prevent the document from being modified after approval: an approved FRIA or DPIA may only move to archived when superseded by a new version, and any other modification is rejected.
• Snapshots of published policies are versioned: changes create a new version without overwriting earlier ones.

A.III.4 Secrets management

• Environment variables stored on the deployment platform and, where applicable, in Supabase Vault. Never in the code repository.
• Secret detection in continuous integration by means of gitleaks, as a required check for merging changes into the main branch. It sweeps the whole reachable history, not just the working tree.
• Documented emergency rotation procedure in the event of suspected exposure.

A.III.5 Dependencies and change control

• Dependency updates managed automatically (Renovate).
• No change reaches production without passing through a reviewed branch, type checking, a test suite and a preview deployment. The checks are required: if one fails, the change is not merged.

A.III.6 Backups

• Daily backups managed by the database infrastructure, in the eu-central-1 (Frankfurt) region, with a 7-day retention.

A.III.7 HTTP headers and web hardening

• HTTP Strict Transport Security enabled, with a two-year max-age.
• Self-hosted fonts (Montserrat, Open Sans); the Google Fonts CDN is not loaded, which reduces third-party dependencies in rendering.

A.III.8 Environment segregation

• Separate development, staging and production environments.
• Preview deployments with Vercel authentication (Standard Protection); never publicly accessible with real data.
• Customer data only in production; staging uses synthetic data.

A.III.9 Sub-processors and providers

• DPA signed with each Sub-processor in Annex II.
• Up-to-date public list at alethexis.com/en/subprocessors.
• Procedure for notifying the Customer, with 30 days' prior notice, of the addition or replacement of any Sub-processor in this Annex.

A.III.10 Organisational measures

• Restricted internal access: principle of least privilege; only the operator of the Service and, where applicable, future team members with an NDA and a documented confidentiality undertaking.
• Ongoing and documented AI Literacy and GDPR training for staff with access to Personal Data.
• Internal AI use policy (BYOAI): development with Claude Code does not include Customer Substantive Data; only code and development prompts.
• Breach procedure documented in the internal SECURITY_RUNBOOK.md, with a notification period to the Customer of ≤ 24 hours (clause 8).
• Annual review of the technical and organisational measures, with an update of this Annex where appropriate.

A.III.11 What Alethexis expressly declares it does NOT do

• Does not sell Substantive Data to third parties under any circumstances.
• Does not use Substantive Data to train its own or third-party AI models.
• Does not carry out profiling on the Substantive Data.
• Does not access the Customer's functional sections except for technical support with the Customer's explicit authorisation and a record of the action in the audit log.
• Does not take automated decisions with legal effects on the Customer or on its Data Subjects (plans and access are contracted, not assigned algorithmically).
• Does not incorporate generative AI within the Service in Wave 1 (canonical decision of Alethexis).

The retention periods applicable to the Service, their basis and the role in which Alethexis acts in each case are set out in Alethexis's retention matrix, whose content is summarised as follows:

Database backups are kept for 7 days plus the current day's. During that period, the data of a closed account are still present in the backups. The backups do not include objects held in the file storage Service.