Data Processing Agreement
Last updated November 12, 2026
These proposed processing terms describe the arrangement to agree with Secnd before sending personal data through the private beta. A signed agreement must identify the parties, instructions and applicable transfer safeguards.
Roles and instructions
The customer determines the purposes and means of processing its submitted data. Secnd processes that data to provide the requested API service under documented customer instructions. Secnd must notify the customer if an instruction appears to conflict with applicable data protection law.
Scope and duration
Processing consists of receiving API inputs, running inference, returning results and maintaining agreed service records. The signed schedule must define the data categories, affected individuals, purposes and duration. Do not submit sensitive or regulated categories before an appropriate agreement is in place.
No training on customer data
Customer inputs and outputs are not used for model training. Any different use requires a separate explicit agreement and an updated processing assessment; private beta access is not consent to training.
Confidentiality and security
People authorized to access customer data must be bound by confidentiality. Appropriate measures include access controls, protected transport, key management and separation of customer accounts. Specific organizational and technical measures must be recorded in the signed schedule.
Service providers
The parties must identify the subprocessors, locations, notification procedure and objection process before processing begins. Subprocessors must receive equivalent data protection obligations. Secnd remains responsible for its processing commitments.
Assistance and incidents
Secnd will assist with data subject requests, security assessments and regulatory obligations to the extent applicable to its processing. Secnd must notify the customer of a personal data breach without undue delay after becoming aware and provide available information for the customer's response.
Retention and deletion
The signed schedule must specify request-content retention, operational-log retention and the return or deletion process when service ends, including any legal retention obligation. Zero-retention handling must be agreed across the gateway, inference service and logs before it is relied on.
Transfers and review
Where data crosses borders, the parties must identify an applicable transfer mechanism and any required safeguards. Secnd must make information available to demonstrate its obligations and support agreed audits. This page does not claim a certification or replace the executed agreement.
Arrange an agreement
Use the contact page to request the processing schedule and review the applicable providers, locations, security measures and deletion procedure before you send personal data.