Data Processing Addendum

1. Scope and incorporation

This Addendum forms part of the Terms of Service between you (“Customer”) and Enkeon(“Enkeon”). It applies whenever Enkeon processes personal data on the Customer's behalf in providing the service.

“Data Protection Law” means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the India Digital Personal Data Protection Act 2023 to the extent its relevant provisions are in force, the California Consumer Privacy Act, and any other applicable privacy law. Terms such as “controller”, “processor”, “personal data” and “processing” carry the meanings given in that law. If this Addendum conflicts with the Terms of Service, this Addendum governs for matters of data protection.

2. Roles of the parties

For Customer Personal Data — the personal data contained in content the Customer or its end-users submit to the service — the Customer is the controller and Enkeon is the processor. Where the Customer is itself a processor for another controller, Enkeon is a sub-processor and this Addendum applies accordingly.

Enkeon is an independent controller for the limited data it processes for its own purposes: Customer account records, billing, security and audit logging, and site analytics. Its Privacy Policy governs that data.

The Customer is responsible for the lawfulness of the personal data it submits, for having a valid legal basis, and for providing the notices and obtaining the consents its own end-users are entitled to.

3. Details of processing (Article 28(3))

4. Enkeon's obligations

Enkeon will:

1. 01Process Customer Personal Data only on the Customer's documented instructions, including as to international transfers. The agreement, this Addendum, and the Customer's use of the service constitute those instructions. If law requires processing beyond them, Enkeon will inform the Customer first unless that law prohibits it.
2. 02Ensure that everyone authorised to process Customer Personal Data is bound by an obligation of confidentiality.
3. 03Implement and maintain the technical and organisational measures described in section 7.
4. 04Engage sub-processors only under section 5, on terms no less protective than this Addendum, and remain fully liable for their performance.
5. 05Assist the Customer in responding to data subject requests, as set out in section 6.
6. 06Assist the Customer with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available.
7. 07Delete or return Customer Personal Data at the end of the service, as set out in section 10.
8. 08Make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, as set out in section 11.

Enkeon will tell the Customer if, in its opinion, an instruction infringes Data Protection Law.

5. Sub-processors

The Customer gives general written authorisation for Enkeon to engage sub-processors. The current list is published at thinkingroot.com/subprocessors and forms part of this Addendum.

Enkeon will give at least 30 days' notice before a new sub-processor begins processing, by email to subscribers of that page. The Customer may object on reasonable data-protection grounds within that period. The parties will work in good faith to resolve it; if they cannot, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

Each sub-processor is bound by a written contract imposing obligations equivalent to this Addendum. Enkeon remains fully liable to the Customer for their acts and omissions.

6. Data subject requests

The service gives the Customer direct, self-service means to access, export, correct and delete personal data within its projects — including deleting an individual memory or every memory derived from a source, with search indexes rebuilt so deleted material stops being retrievable.

Where a data subject contacts Enkeon directly about Customer Personal Data, Enkeon will not respond substantively but will refer them to the Customer and inform the Customer promptly. To the extent the Customer cannot satisfy a request through the service itself, Enkeon will provide reasonable assistance at no additional charge.

7. Security measures (Article 32)

Enkeon maintains at least the following:

• Encryption in transit — TLS on all external connections. Deployment access controls govern origin access.
• Encryption at rest — provided by the underlying infrastructure. Connector access tokens are additionally encrypted with XSalsa20-Poly1305 authenticated encryption; project secrets use sealed-box asymmetric encryption where the storing component holds only the public key and cannot decrypt them.
• Tenant isolation — per-project engine containers and database volumes, with scoped end-user stores where configured. Shared control-plane records are governed by organisation and project access controls.
• Authentication — Argon2id password hashing at OWASP-recommended parameters; session and API credentials stored only as BLAKE3 hashes with 192 bits of entropy.
• Access control — role-based access scoped by organisation membership, with per-key capability restrictions and rate limiting.
• Logging and monitoring — audit records of privileged actions and service health monitoring.
• Resilience — encrypted off-host backups on an approximately five-minute cycle, with a documented restore procedure.
• Least privilege — production access limited to personnel who require it, over authenticated channels.

Enkeon may update these measures as the service evolves, provided the overall level of security is not reduced.

8. Personal data breach

Enkeon will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point — to the extent that information is available, with updates as the investigation proceeds.

Enkeon will not make public statements identifying the Customer without the Customer's consent, except where legally required.

9. International transfers

Configured processing includes Frankfurt and Sweden, US audio processing and secondary backups, global web and security delivery, and service administration from India. The sub-processor list describes provider-specific locations; the service is not EU-only.

Where Data Protection Law restricts a transfer, the parties agree that the European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated by reference and apply:

• Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is itself a processor.
• Clause 7 (docking) applies. Clause 9 option 2 (general written authorisation) applies with the 30-day notice period in section 5. Clause 11 does not include the optional independent dispute-resolution body. Clause 17 selects the law of Ireland, and Clause 18(b) the courts of Ireland.
• Sections 3 and 7 and the sub-processor list describe processing and security measures. Required Annex I party details, contacts, competent authority and transfer particulars must be completed for the relevant parties; these descriptions alone do not complete every SCC annex.
• For restricted UK transfers, the ICO’s International Data Transfer Addendum must be completed with the required party and transfer tables. For Switzerland, the applicable Swiss adaptations must be included, with the Swiss FDPIC identified where required.

Where a sub-processor is certified under the EU–US Data Privacy Framework, that certification operates as an additional safeguard and not as a replacement for the Clauses. A transfer assessment and any necessary supplementary measures must support restricted transfers. Contact Enkeon to obtain and complete the relevant transfer documentation before relying on it for a regulated deployment.

10. Deletion and return

The Customer may use available export tools during the service term and should arrange export before terminating access. There is no automatic 30-day post-termination access entitlement unless agreed in writing. At the end of processing, Enkeon will, at the Customer’s choice, return or delete Customer Personal Data and delete remaining copies, unless applicable law requires retention.

Contact [email protected] to coordinate the scope, format and completion of a return or deletion request, including shared chat, connector records and project knowledge. Active-service deletion and backup expiry are separate. Backup copies are restricted from ordinary use and must expire through the applicable storage lifecycle; a single-cycle purge is not promised. Deletion instructions must be reapplied if a backup is restored. Required legal retention remains subject to this Addendum.

11. Audits

Enkeon will make available the information necessary to demonstrate compliance with this Addendum. On request it will complete a reasonable security questionnaire, no more than once a year unless a breach or a regulator requires otherwise.

Where documentation is genuinely insufficient to satisfy a regulator, the Customer may conduct an audit itself or through an independent auditor who is not a competitor of Enkeon, on 30 days' notice, during business hours, no more than once a year, subject to confidentiality, and in a manner that does not disrupt the service or compromise the data of other customers. Each party bears its own costs.

12. United States state privacy law

For personal information subject to the California Consumer Privacy Act, Enkeon acts as a “service provider” and, for other US state laws, as a “processor.” Enkeon:

• Will not sell or share personal information, as those terms are defined by the CCPA.
• Will not retain, use or disclose personal information for any purpose other than performing the services specified in the agreement, or as otherwise permitted by the CCPA.
• Will not retain, use or disclose personal information outside the direct business relationship between the parties.
• Will not combine personal information received from the Customer with personal information from other sources, except as the CCPA permits.
• Provides the same level of privacy protection the CCPA requires of a business, and will notify the Customer if it determines it can no longer do so.
• Grants the Customer the right to take reasonable steps to ensure personal information is used in a compliant manner, and will remediate unauthorised use.

The specific business purposes are the provision, maintenance and security of the Enkeon platform as described in the agreement. Enkeon certifies that it understands and will comply with these restrictions.

13. General

The liability limits in the Terms of Service apply to this Addendum. This Addendum takes effect on the earlier of the Customer's acceptance of the Terms of Service or first use of the service, and remains in force for as long as Enkeon processes Customer Personal Data. Every version is numbered and retained; material changes are notified at least 30 days in advance.

Current sub-processors are listed in full at /subprocessors (11 entries). Questions about this Addendum: [email protected].