Data Processing Agreement (DPA) & Sub-processors

Data Processing Agreement template

Our DPA between the customer (controller) and AbroadWorks (processor) covers: subject-matter and duration of processing, nature and purpose, categories of personal data and data subjects, obligations of the parties, technical and organisational measures, use of sub-processors, breach notification (72 hours), audit rights, and deletion/return of data at termination.

To receive a signed DPA, contact us from your account email.

Technical & organisational measures (summary)

• TLS in transit; application-layer encryption for secrets.
• Logical tenant-level data isolation.
• Least-privilege access; separate admin panels.
• Daily backups; permanent erasure on account deletion.

Sub-processor list

• xAI (USA) — AI model inference; message content is transmitted to generate replies.
• Other model providers enabled on the platform — used only if selected on your account, and announced on this list.
• DigitalOcean (Singapore region) — hosting and storage.
• Cloudflare (global) — DNS, CDN and security layer.

Changes to this list are announced on this page; objection rights are set out in the DPA.

Note: this is a template and should be reviewed by legal counsel before production use.