Legal

Data Processing Agreement

Last updated: October 23, 2026

1. Scope and Incorporation

This Data Processing Agreement ("DPA") is between episki, llc ("episki") and the customer that has agreed to the episki Terms of Service or a Signed Agreement ("Customer"). It forms part of the Terms and any Signed Agreement (together, the "Agreement") and applies whenever episki processes Customer Personal Data in providing the Service. No signature is needed for it to apply. If Customer needs a countersigned copy for its records, we will provide one on request at hello@episki.com; a countersigned copy has the same terms as this page.

If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail. Protected health information is governed by a Business Associate Agreement, where one is in effect (Terms §20.4). Capitalized terms not defined here have the meanings given in the Terms.

2. Definitions

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA").
"Customer Personal Data" means personal data within Customer Data that episki processes on Customer's behalf.
"Controller," "processor," "data subject," "personal data," "processing," and "supervisory authority" have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws (such as "business" and "service provider" under the CCPA) have corresponding meanings.
"Sub-processor" means a third party that episki engages to process Customer Personal Data.
"Personal Data Breach" means a Security Incident (Terms §20.2) affecting Customer Personal Data.
"Standard Contractual Clauses" means the clauses approved by European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

3. Roles of the Parties

Customer is the controller of Customer Personal Data, or a processor acting for its own customers, and episki is its processor or sub-processor. Where an Operator Partner administers a workspace for an end customer, the partner may act as a processor for the end customer and episki acts as its sub-processor. The end customer's rights in Terms §8 apply.

episki is a controller of the account, billing, and usage data it collects to run its business. That processing is described in our Privacy Policy and is not covered by this DPA.

4. Processing Instructions

episki will process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise; in that case, episki will tell Customer before processing unless the law prohibits it. Customer's instructions are the Agreement, any order forms, and Customer's configuration and use of the Service, including the integrations, agents, and MCP servers it sets up. Additional instructions must be in writing and consistent with the Agreement. episki will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for having a lawful basis for the processing, giving any notices and obtaining any consents required, and the accuracy of Customer Personal Data. Customer will not submit special categories of personal data except as needed for its compliance program.

episki will not use Customer Personal Data to train any AI model (Terms §5.6).

5. episki Personnel

episki limits access to Customer Personal Data to personnel who need it to provide the Service, and makes sure they are bound by confidentiality obligations.

6. Security

episki maintains the technical and organizational measures described in Annex 2 and in our security documentation at trust.episki.com. We may update these measures, but we will not materially reduce the overall protection of Customer Personal Data during Customer's subscription term.

7. Sub-processors

Customer gives episki general authorization to engage Sub-processors. Our current Sub-processors are listed at trust.episki.com. episki will:

bind each Sub-processor by written contract to data protection obligations no less protective than this DPA;
give at least thirty (30) days' notice before a new Sub-processor processes Customer Personal Data, by updating the list and notifying subscribers to it, or by email to Customer's workspace administrators; and
remain responsible to Customer for its Sub-processors' performance of these obligations.

Customer may object to a new Sub-processor on reasonable data protection grounds by writing to us within the notice period. We will work in good faith to address the objection, for example by offering a way to avoid the Sub-processor. If we cannot, Customer may terminate the affected part of the Service by written notice, and we will refund prepaid fees for it for the unused remainder of the term.

8. Data Subject Requests and Assistance

If episki receives a request from a data subject about Customer Personal Data, we will pass it to Customer and not respond ourselves, except to direct the data subject to Customer. The Service lets Customer access, correct, export, and delete Customer Personal Data, and we will give Customer reasonable further help to respond to data subject requests.

Taking into account the nature of the processing and the information available to us, episki will give Customer reasonable help with data protection impact assessments and consultations with supervisory authorities that relate to the Service.

9. Personal Data Breaches

episki will notify Customer of a Personal Data Breach without undue delay, and in any case within seventy-two (72) hours after confirming it. As information becomes available, we will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. We will take reasonable steps to contain and remediate the breach and help Customer meet its own notification obligations.

10. Return and Deletion

When the Agreement ends, Customer may export Customer Personal Data as described in Terms §15. episki will then delete Customer Personal Data from active systems within thirty (30) days after the Read-Only Period, or the Transition Period for a Sponsored Workspace, and backups expire within thirty (30) days after that. episki may keep Customer Personal Data where the law requires, and will keep it protected under this DPA for as long as it does. On request, episki will confirm the deletion in writing.

11. Audits

On request, episki will make available the information reasonably needed to show its compliance with this DPA, including our security documentation, any third-party audit reports or certifications we hold, and answers to reasonable security questionnaires. This information is episki's Confidential Information.

If that information is not enough to meet a requirement of Data Protection Laws, or a supervisory authority requires it, or following a Personal Data Breach, Customer may audit episki's compliance with this DPA, by itself or through an independent auditor bound by confidentiality. Audits are limited to once in any twelve (12) months, need at least thirty (30) days' written notice, take place during business hours without unreasonable disruption, and are at Customer's expense.

12. International Transfers

episki is based in the United States, and Customer Personal Data may be processed in the United States and in the countries where our Sub-processors operate. Workspaces with the Regional Data Residency add-on store Customer Data at rest in the chosen region, as described in our Privacy Policy.

EEA. For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA, with Customer as data exporter and episki as data importer, as follows: Module Two applies where Customer is a controller and Module Three where Customer is a processor; the optional docking clause in Clause 7 applies; Clause 9 option 2 applies, with the notice period in §7 of this DPA; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by the law and courts of Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA. Where episki is certified under the EU-US Data Privacy Framework, it may rely on that certification instead.

UK. For transfers from the UK, the UK Addendum applies to the Standard Contractual Clauses as completed above. The information in Tables 1 to 3 of the UK Addendum is set out in this DPA and its Annexes, and neither party may end the UK Addendum under its Section 19.

Switzerland. For transfers from Switzerland, the Standard Contractual Clauses apply as completed above, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and "Member State" including Switzerland, so that data subjects in Switzerland can enforce their rights there.

13. US State Privacy Laws

Where the CCPA or a similar US state law applies, episki is Customer's service provider, contractor, or processor, and Customer discloses Customer Personal Data to episki only for the limited and specified purpose of providing the Service. episki will not:

sell or share Customer Personal Data, as those terms are defined in the CCPA;
retain, use, or disclose it for any purpose other than providing the Service, or outside the direct business relationship with Customer, except as the law permits; or
combine it with personal data from other sources, except as the law permits.

episki will comply with the applicable obligations of these laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet them. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

14. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, and this DPA does not create a separate or additional cap. This section does not limit any party's liability to data subjects under the Standard Contractual Clauses or Data Protection Laws where that liability cannot be limited.

15. Changes and Term

This DPA is a Service Policy under the Terms and changes only as described in Terms §17. We may also update it as needed to reflect changes in Data Protection Laws or new transfer mechanisms. We will not make an update that materially reduces the overall protection of Customer Personal Data during Customer's subscription term. This DPA lasts for as long as episki processes Customer Personal Data.

Annex 1: Details of Processing

Data exporter: Customer, as identified in its account or Signed Agreement. Role: controller or processor. Contact: Customer's workspace owner.
Data importer: episki, llc, Pennsylvania, USA. Role: processor or sub-processor. Contact: hello@episki.com.
Data subjects: Customer's users, employees, and contractors; contacts at Customer's vendors, auditors, and customers; and individuals whose personal data appears in evidence, assessments, or other Customer Data.
Categories of personal data: names, email addresses, job titles, and contact details; account identifiers and authentication data; IP addresses, device data, and activity in audit logs; and personal data contained in uploaded evidence, AI prompts and output, and data received through integrations.
Special categories: none intended. Customer may submit them only as needed for its compliance program. The measures in Annex 2 apply to them.
Frequency: continuous, for the term of the Agreement.
Nature and purpose: hosting, storage, AI processing, integration syncing, publishing through the Trust portal, and support, to provide the Service under the Agreement.
Duration and retention: the term of the Agreement, plus the export and deletion periods in §10.
Sub-processors: as listed at trust.episki.com, for the same nature, purpose, and duration.
Competent supervisory authority: the authority determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Technical and Organizational Measures

Encryption: Customer Data is encrypted in transit with TLS and at rest.
Access control: role-based access and least privilege for episki personnel, and workspace roles, single sign-on, and multi-factor settings for Customer's users.
Workspace isolation: Customer Data is logically separated by workspace, and tokens, integrations, and credentials are scoped to a workspace.
Logging: audit logging of access to and changes in Customer Data, including actions by agents and AI features.
AI safeguards: approvals and safety floors for agent actions, and no training of AI models on Customer Data by episki or its AI Sub-processors.
Vulnerability management: regular security assessments and remediation of identified vulnerabilities.
Incident response: documented procedures to identify, contain, and notify Personal Data Breaches (§9).
Resilience: backups of Customer Data, kept on the schedule in §10.
Sub-processor management: security and privacy review before engagement, and written data protection terms (§7).
Personnel: confidentiality obligations and need-to-know access (§5).

More detail is in our security documentation at trust.episki.com.

Annex 3: Sub-processors

The current list of Sub-processors, with their purpose and location, is published at trust.episki.com and is incorporated into this DPA.

episki, llc · Pennsylvania, USA