Snapshot 235986
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content
Data Processing Agreement
Argus Platform
This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written or electronic agreement between TrustScale, Inc. ("TrustScale", "Processor", or "we") and the entity agreeing to these terms ("Customer", "Controller", or "you") for the provision of the Argus platform and related services (the "Services"). This DPA applies to the extent that TrustScale processes Personal Data on behalf of Customer in the course of providing the Services. This DPA is designed to ensure compliance with the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.
1. DEFINITIONS
"Customer Data" means any data, including Personal Data, that Customer submits to the Services for processing, including content from Customer's large language models (LLMs), prompts, responses, and related metadata.
"Data Protection Laws" means all applicable laws relating to data protection and privacy, including the GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA), and any other applicable data protection legislation.
"Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
"Personal Data" means any information relating to a Data Subject that is processed by TrustScale as part of the Services.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
"Sub-processor" means any third party engaged by TrustScale to process Customer Data on behalf of Customer.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
2. SCOPE AND ROLES
2.1 Roles of the Parties. With respect to Customer Data:
Customer is the Controller and determines the purposes and means of processing Personal Data.
TrustScale is the Processor and processes Personal Data on behalf of Customer in accordance with Customer's documented instructions.
2.2 Customer Obligations. Customer represents and warrants that:
It has all necessary rights and consents to provide Customer Data to TrustScale for processing;
Its instructions to TrustScale comply with all applicable Data Protection Laws;
It has provided appropriate notices to, and obtained any necessary consents from, Data Subjects as required by applicable law.
3. PROCESSING OF CUSTOMER DATA
3.1 Documented Instructions. TrustScale shall process Customer Data only in accordance with Customer's documented instructions, unless required to do so by applicable law. Customer's instructions are documented in this DPA, the Terms of Service, and any applicable Order Form. Customer instructs TrustScale to process Customer Data for the following purposes:
Providing the Argus platform services, including guardrails, hallucination detection, and content verification;
Querying external reference sources to verify claims and return analysis results;
Any other purposes set forth in the Terms of Service or agreed in writing.
3.2 Lawfulness of Instructions. If TrustScale believes that an instruction from Customer infringes Data Protection Laws, TrustScale shall promptly notify Customer. TrustScale shall not be required to assess whether Customer's instructions comply with applicable law, except where such non-compliance is reasonably apparent.
3.3 Details of Processing. The details of the processing, including the subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects, are set forth in Annex 1 to this DPA.
4. DATA HANDLING
4.1 Real-Time Processing. Customer Data is processed in real-time to provide the Services. Customer Data is deleted immediately upon delivery of the API response to Customer.
4.2 No Data Retention. TrustScale does not retain Customer Data after processing is complete. TrustScale does not use Customer Data to train, improve, or develop AI models.
4.3 Reference Data. To provide accurate verification results, TrustScale maintains a cache of publicly available reference data sourced from third-party providers (such as Diffbot). This reference data is not derived from or linked to Customer Data and is shared across all customers as a common knowledge base.
4.4 Integration Data. Where Customer enables integrations with third-party document repositories (such as Microsoft SharePoint, Google Drive, or similar services), TrustScale accesses Customer-designated repositories solely to perform verification services. TrustScale may store excerpts, snippets, or quotations from integrated content ("Integration Data") to support and document verification results. Integration Data is:
(a) accessible only to authorized users within Customer's account (non-administrative users see only their own verification results; account administrators may view results across all team members);
(b) retained for the duration of Customer's active account;
(c) deleted upon account termination or upon Customer's revocation of the applicable integration; and
(d) not used to train, improve, or develop AI models.
5. CONFIDENTIALITY
TrustScale shall ensure that any person authorized to process Customer Data is subject to appropriate confidentiality obligations (whether contractual or statutory) and has received appropriate training regarding their data protection responsibilities.
6. SECURITY MEASURES
6.1 Security Controls. TrustScale shall implement and maintain appropriate technical and organizational measures to protect Customer Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures shall be appropriate to the harm that might result from such events and the nature of the data being protected. The current security measures are described in Annex 2.
6.2 SOC 2 Compliance. TrustScale maintains SOC 2 Type 1 certification, with Type 2 certification in progress. Upon Customer's written request (no more than once per twelve-month period), TrustScale shall make available a summary copy of its current SOC 2 report, subject to confidentiality obligations.
6.3 Security Updates. TrustScale may update its security measures from time to time, provided that such updates do not materially decrease the overall level of protection.
7. SUB-PROCESSORS
7.1 General Authorization. Customer provides general authorization for TrustScale to engage Sub-processors to process Customer Data. The current list of Sub-processors is set forth in Annex 3 and available at https://trustscale.ai/en/trust-subprocessors.
7.2 Notification of Changes. TrustScale shall notify Customer at least thirty (30) days before adding or replacing any Sub-processor by updating the Sub-processor list and notifying Customer via email.
7.3 Objection Right. Customer may object to a new Sub-processor by notifying TrustScale in writing within fifteen (15) days of receiving notice. If Customer objects on reasonable data protection grounds, the parties shall discuss the concerns in good faith. If the parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Services without penalty by providing written notice.
7.4 Sub-processor Obligations. TrustScale shall ensure that each Sub-processor is bound by data protection obligations no less protective than those in this DPA. TrustScale remains liable for the acts and omissions of its Sub-processors.
8. DATA SUBJECT RIGHTS
8.1 Assistance. Taking into account the nature of the processing, TrustScale shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws.
8.2 Data Subject Requests. If TrustScale receives a request directly from a Data Subject, TrustScale shall promptly forward the request to Customer and shall not respond to the Data Subject directly except to acknowledge receipt and advise the Data Subject to contact Customer.
8.3 Costs. TrustScale may charge reasonable fees for assistance with Data Subject requests that are manifestly unfounded, excessive, or require substantial effort beyond standard functionality.
9. PERSONAL DATA BREACH
9.1 Notification. TrustScale shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. Such notification shall include, to the extent known: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) the likely consequences of the breach; and (d) measures taken or proposed to address the breach.
9.2 Cooperation. TrustScale shall cooperate with Customer and provide reasonable assistance to enable Customer to comply with its breach notification obligations under applicable Data Protection Laws.
9.3 No Admission. TrustScale's notification of or response to a Personal Data Breach shall not be construed as an admission of fault or liability.
10. DATA RETENTION AND DELETION
10.1 No Retention. Customer Data is processed in real-time and deleted immediately upon delivery of the API response. TrustScale does not retain Customer Data.
10.2 Integration Data Retention. Integration Data (excerpts stored to support verification results from third-party integrations) is retained for the duration of Customer's active account. Upon account termination, all Integration Data is deleted within thirty (30) days. Customer may also delete Integration Data by revoking the applicable third-party integration, which will remove stored excerpts associated with that integration.
10.3 Deletion Confirmation. Because Customer Data is not retained, no deletion request is required upon termination of the Services. Upon Customer's written request, TrustScale shall provide written confirmation that no Customer Data is retained in TrustScale's systems.
10.4 Legal Requirements. Notwithstanding the foregoing, TrustScale may retain Customer Data to the extent required by applicable law, provided that TrustScale shall notify Customer of such requirement unless prohibited by law from doing so.
11. AUDIT RIGHTS
11.1 Audit Information. TrustScale shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations set forth in this DPA and applicable Data Protection Laws.
11.2 Third-Party Audits. Customer's audit rights may be satisfied by: (a) TrustScale providing its SOC 2 report; (b) TrustScale providing written responses to reasonable audit questionnaires submitted by Customer (no more than once per year); or (c) if the foregoing are insufficient for Customer to verify compliance, Customer or its appointed third-party auditor may conduct an on-site audit with at least thirty (30) days' written notice, during normal business hours, and subject to reasonable confidentiality requirements. Customer shall bear the costs of any such audit.
12. INTERNATIONAL DATA TRANSFERS
12.1 Processing Location. Customer Data is processed in the United States using Amazon Web Services (AWS) infrastructure.
12.2 Transfer Mechanisms. To the extent that TrustScale processes Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland that constitutes a restricted transfer, the parties agree that the Standard Contractual Clauses (Module 2: Controller to Processor) shall apply, as set forth in Annex 4. TrustScale agrees to abide by and process such Personal Data in compliance with the SCCs.
12.3 Supplementary Measures. TrustScale implements supplementary technical and organizational measures to protect transferred data, including encryption in transit and at rest, access controls, and security monitoring.
13. LIABILITY
The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service or other agreement between the parties governing the Services.
14. GENERAL PROVISIONS
14.1 Conflicts. In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters. In the event of a conflict between this DPA and the Standard Contractual Clauses, the SCCs shall prevail.
14.2 Amendments. TrustScale may update this DPA from time to time to reflect changes in legal requirements or our processing practices. Material changes will be notified to Customer at least thirty (30) days before taking effect.
14.3 Severability. If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
14.4 Governing Law. This DPA shall be governed by the laws specified in the Terms of Service, except that the Standard Contractual Clauses shall be governed by the law of the EU Member State specified therein.
ANNEX 1: DETAILS OF PROCESSING
A. Subject Matter and Duration
TrustScale processes Customer Data to provide the Argus platform services, including AI guardrails, hallucination detection, and content verification. Processing occurs in real-time for the duration of each API request.
B. Nature and Purpose of Processing
Receiving and analyzing content from Customer's large language models (LLMs)
Querying external reference sources to verify factual claims
Applying guardrails, safety filters, and hallucination detection
Returning analysis results, verdicts, and citations to Customer
C. Categories of Data Subjects
Data Subjects may include any individuals whose Personal Data is contained in the content processed through Customer's LLMs, which may include:
Customer's end users and customers
Customer's employees and contractors
Any other individuals referenced in LLM prompts or responses
D. Types of Personal Data
Customer Data may contain any types of Personal Data that appear in LLM conversations, which may include:
Names and contact information
Identification numbers
Professional and employment information
Financial information
Communications and correspondence
Any other Personal Data submitted by Customer or its users
E. Special Categories of Data
Customer Data may incidentally contain special categories of data (sensitive data) such as health information, religious or philosophical beliefs, or other sensitive data, depending on the nature of Customer's LLM use case. Customer is responsible for ensuring appropriate legal basis and safeguards for any such data.
F. Retention Period
Standard API Processing: Customer Data submitted via API is processed in real-time and deleted immediately upon delivery of the response. TrustScale does not retain Customer Data from standard API requests.
Integration Data: Where Customer enables third-party integrations (such as Microsoft SharePoint), TrustScale stores excerpts or snippets from integrated content to support verification results. Integration Data is retained for the duration of Customer's active account and deleted within thirty (30) days of account termination or revocation of the applicable integration.
Reference Data: TrustScale maintains a cache of publicly available reference data from third-party sources (such as Diffbot) to support verification services. This cache does not contain Customer Data.
ANNEX 2: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
TrustScale implements the following technical and organizational measures to protect Customer Data:
A. Access Control
Role-based access controls limiting access to Customer Data to authorized personnel
Multi-factor authentication for all system access
Regular access reviews and prompt deprovisioning
Unique user identification and authentication
B. Encryption
Encryption of data in transit using TLS 1.2 or higher
Encryption of data at rest using AES-256 or equivalent
Secure key management practices
C. Infrastructure Security
Hosted on Amazon Web Services (AWS) with SOC 2 certified infrastructure
Network segmentation and firewalls
Intrusion detection and prevention systems
Regular vulnerability scanning and penetration testing
D. Operational Security
Security incident response procedures
Regular security awareness training for personnel
Background checks for employees with access to Customer Data
Logging and monitoring of system access and activities
E. Business Continuity
Regular data backups with tested recovery procedures
Disaster recovery planning
Redundant systems and failover capabilities
F. Certifications
SOC 2 Type 1 certification (Type 2 in progress)
ANNEX 3: LIST OF SUB-PROCESSORS
The following Sub-processors are authorized to process Customer Data:
Sub-Processor Location Purpose Transfer Mechanism
Amazon Web Services, Inc. United States Cloud infrastructure and hosting SCCs
Diffbot United States Knowledge graph and reference data SCCs
This list is current as of the date of this DPA. For the most current list and to subscribe to change notifications, visit https://trustscale.ai/en/trust-subprocessors.
ANNEX 4: STANDARD CONTRACTUAL CLAUSES
For transfers of Personal Data from the European Economic Area, United Kingdom, or Switzerland to TrustScale in the United States, the parties agree to the Standard Contractual Clauses (SCCs) as follows:
A. EU Transfers
The EU SCCs (Commission Implementing Decision (EU) 2021/914) are incorporated by reference, with the following specifications:
Module 2 (Controller to Processor) applies
Clause 7 (Docking Clause): Not applicable
Clause 9 (Sub-processors): Option 2 (General written authorization) applies; time period for objection is 15 days
Clause 11 (Redress): Optional language is not included
Clause 17 (Governing Law): Laws of Ireland
Clause 18 (Choice of Forum): Courts of Ireland
B. UK Transfers
For transfers from the United Kingdom, the UK Addendum to the EU SCCs (issued by the UK Information Commissioner) is incorporated and applies in addition to the EU SCCs.
C. Swiss Transfers
For transfers from Switzerland, the EU SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR shall be understood as references to the Swiss Federal Act on Data Protection (FADP).
D. SCC Annexes
The Annexes to the SCCs are completed as follows:
Annex I.A (List of Parties): Data exporter is Customer; Data importer is TrustScale, Inc.
Annex I.B (Description of Transfer): As set forth in Annex 1 to this DPA
Annex I.C (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the data exporter is established
Annex II (Technical and Organizational Measures): As set forth in Annex 2 to this DPA
Annex III (Sub-processors): As set forth in Annex 3 to this DPA
ACCEPTANCE
This DPA is entered into and becomes a binding part of the Terms of Service as of the date last agreed by the parties (the "DPA Effective Date").
For click-through acceptance: By clicking "I Accept" or similar affirmation when presented with this DPA during account registration or service activation, Customer agrees to be bound by the terms of this DPA as of the date of such acceptance, and no physical signature is required.
We use essential and analytics cookies to run this site and understand how it is used. Marketing cookies are only set if you accept them. You can opt out at any time. Read our Cookie Policy.