Legal

Data Processing Addendum

The data processing terms we intend to offer. Draft, last updated October 24, 2026.

Draft for legal review. This page is not a signed agreement and does not change your current terms. The signable DPA, with the Standard Contractual Clauses, UK Addendum and annexes attached, will be published here after review.

Draft terms

1. Roles: You (the customer) are the controller, or a processor acting for your own customers. Solvaro is your processor (a "service provider" under CCPA/CPRA). For account, billing and security data about your users, Solvaro is an independent controller under its privacy policy.
2. Instructions: Solvaro processes customer personal data only on your documented instructions: this DPA, your agreement, your org settings, the connectors you add and the actions you approve. We tell you if we believe an instruction breaks the law.
3. Scope of processing: Subject matter: providing the Solvaro investigation desk. Data: ticket content, attachments, logs, code snippets, call audio and transcripts, notes, investigations, Case Memory entries and audit events. Data subjects: your users, your end customers and their staff as they appear in support data. Duration: the term of the agreement plus the deletion period below. Special-category data is not required by the service; please do not connect it.
4. Your AI provider choice: Each org chooses which AI model provider processes its requests. The default is Anthropic (Claude). Other providers, such as OpenAI or xAI, become subprocessors for your org only when an admin selects them. China-based providers (DeepSeek, Moonshot AI/Kimi) are off by default and need an explicit admin opt-in that is recorded in your audit log. Solvaro enforces this in code: requests from your org go only to the provider it selected, and features that need a different provider return an error instead of sending data elsewhere. You can also bring your own provider key, in which case that provider processes data under your own contract with it. See the subprocessors page.
5. No training, limited retention: Solvaro does not use customer data to train or fine-tune any model unless your org admin opts in to training data collection; it is off by default. Anthropic, OpenAI, Google and xAI state in their API terms that they do not train on API data by default. DeepSeek’s API terms do not say this, which is one reason it needs an explicit opt-in. Where a provider offers zero data retention, we request it for platform keys; where it does not, the provider’s retention period is listed on the subprocessors page.
6. Case Memory and learning: Case Memory stores confirmed root causes per org, after automatic removal of emails, IPs, phone and card numbers, keys, tokens, passwords, customer IDs and any terms you mark as never-store. It never mixes data between orgs. Admins set its retention (default 365 days), can purge it at any time, and can view a log of every read and write. Cross-customer pattern learning is off unless you opt in, and even then only de-identified patterns seen at several orgs are used. Raw customer content never leaves your org.
7. Subprocessors: You give general authorization to the subprocessors listed on our subprocessors page. We give at least 30 days’ notice (by email to subscribers and on the page) before adding or replacing one, and you may object on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund. Each subprocessor is bound by written terms at least as protective as this DPA, and we remain liable for them.
8. Security: Solvaro maintains the technical and organisational measures in Annex II, including per-org isolation on every request, TLS in transit, encryption at rest with AES-256 for the hosted database, its volumes and backups (provided by our host, Railway), application-level encryption (Fernet: AES-128-CBC with HMAC-SHA256) of connector credentials and bring-your-own AI keys before they are stored, role-based access, MFA for staff accounts (being rolled out), logging and vulnerability management. Details are on the security page.
9. Confidentiality: Only personnel who need access to run or support the service can reach customer data. They are bound by written confidentiality obligations and trained on security.
10. Breach notification: We notify you without undue delay, and no later than 48 hours after we become aware of a personal data breach affecting your data, so you can meet the 72-hour GDPR deadline and Canadian and US notice duties. We share what we know, update you as we learn more, and help you notify regulators and people affected.
11. Assistance: We help you answer data subject requests (access, correction, deletion, portability, objection), carry out impact assessments and consult regulators, taking into account what information we hold.
12. Return and deletion: You can export your data through the product exports (Case Memory, insights, feedback and meeting exports) or ask us for a full export at any time. Within 30 days after the agreement ends, we delete your org data from production systems, and backups (an encrypted database copy taken at least weekly and kept for no more than 35 days) age out within 35 days, unless the law requires us to keep it. We confirm deletion in writing on request.
13. Audits: We make available the information needed to show compliance with this DPA: security questionnaire answers, our policies and, once issued, our SOC 2 report. If that is not enough, you may run an audit once a year with 30 days’ notice, at your cost, under confidentiality, or sooner after a breach or a regulator’s request. Solvaro holds no SOC 2 or ISO 27001 report yet; SOC 2 Type I is in progress.
14. International transfers: Solvaro is a Canadian company. Hosting is in the United States. For transfers of EU/EEA data we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, or Module 3 where you are a processor). For UK data, we use the ICO International Data Transfer Addendum. For Swiss data, the SCCs as adapted for Switzerland. We keep a transfer impact assessment for each subprocessor country, and we only route your data to China if you opt in.
15. Canada: For personal information under PIPEDA and Quebec’s Law 25, Solvaro protects it with comparable safeguards when transferred outside Canada, supports your privacy impact assessments for transfers outside Quebec, and notifies you of confidentiality incidents that pose a risk of serious harm.
16. California (CCPA/CPRA): Solvaro will not sell or share personal information, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the service, and will not combine it with data from other sources except as the law allows. We comply with the CCPA and notify you if we can no longer meet it. You may take reasonable steps to stop unauthorised use.

Annexes in the signable version

Annex I: parties, data categories, data subjects, purposes, retention.
Annex II: technical and organisational security measures.
Annex III: subprocessors, per AI provider you select.

Need a DPA for a pilot or procurement? Email daarishlomo@gmail.com and we will send the current draft for your review.