Deployed OS Data Processing Agreement
Version 1.0 · Effective from 15 October 2026 · Current version · Version history
Fingerprint: 11b3c1dab6ed
What changed in this version
- First published version.
This Data Processing Agreement (the "DPA") applies between a customer (the "Customer") and Popoli AB, a Swedish company with registration number 559348-1509, operating under the brand Deployed AI ("Deployed"), when the Customer has signed an order form for Deployed OS that refers to this DPA (an "Order Form"). The DPA forms part of the Deployed OS Service Agreement (the "Service Agreement"). Terms defined in the Service Agreement have the same meaning in this DPA.
1. Roles and purpose#
1.1When delivering the Service, Deployed processes personal data on the Customer's behalf. The Customer is the controller and Deployed is the processor.
1.2This DPA meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Annex 1 describes the processing. Annex 2 sets out the security measures. Sub-processors and approved transfers are listed on Deployed's Sub-processors page (getdeployed.ai/legal/subprocessors).
1.3Customer-specific instructions, such as the Customer's contact person for data protection or a different retention period, may be set out in the Order Form, and then form part of Annex 1.
2. Processing on instructions#
2.1Deployed processes personal data only to provide the Service under the Service Agreement, this DPA and the Customer's documented instructions in Annex 1, unless required to do otherwise by EU or member state law. In that case, Deployed informs the Customer of that legal requirement before processing, unless the law prohibits it.
2.2Deployed must inform the Customer immediately if, in Deployed's opinion, an instruction infringes the GDPR or other data protection law.
2.3The Customer owns the personal data. Deployed may not use it to train or fine-tune AI models, and may not disclose it to other customers.
2.4The Customer is responsible for having a legal basis for the processing and for informing the data subjects about it.
3. Deployed's obligations#
3.1Only personnel who need access to deliver the Service may have access to the personal data. All such personnel are bound by a duty of confidentiality, which continues after this DPA ends.
3.2Deployed assists the Customer in responding to requests from data subjects, such as requests for access or erasure, and in meeting the Customer's obligations under Articles 32 to 36 of the GDPR. Deployed forwards any such request it receives directly to the Customer without delay, and no later than within 48 hours.
3.3Deployed keeps a record of its processing activities on the Customer's behalf as required by Article 30(2) of the GDPR.
4. Security#
4.1Deployed implements appropriate technical and organisational security measures in accordance with Article 32 of the GDPR, including at least the measures set out in Annex 2.
5. Personal data breaches#
5.1Deployed notifies the Customer in writing without undue delay, and no later than 48 hours after becoming aware of a personal data breach, by email to the Customer's reference person stated in the Order Form, or to another contact that the Customer has given in writing.
5.2The notice describes what has happened, the approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information that is not available at once may be provided in stages.
6. Sub-processors#
6.1The Customer gives Deployed general authorisation to engage sub-processors. The sub-processors listed on the Sub-processors page in the version in effect on the date the Order Form is signed are approved.
6.2Deployed notifies the Customer by email at least fourteen (14) days before adding or replacing a sub-processor, and publishes a new version of the Sub-processors page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot agree, the Customer may terminate the Service Agreement to end when the change takes effect, and Deployed refunds the fees paid in advance for the period after termination.
6.3Deployed has written agreements with its sub-processors that impose at least the same obligations as this DPA, and is responsible for its sub-processors as for itself.
7. Location and transfers outside the EU/EEA#
7.1The Customer's personal data is stored in the EU/EEA, in the location stated on the Sub-processors page.
7.2Some sub-processors, such as the providers of network protection, email delivery and sign-in, are established outside the EU/EEA or may process personal data outside it. Such processing may only take place to the extent listed on the Sub-processors page and with a valid legal basis under Chapter V of the GDPR, such as an adequacy decision, including the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.
7.3Deployed's own personnel may access the Service from outside the EU/EEA only to the extent listed on the Sub-processors page, under Deployed's control and subject to the obligations in this DPA.
8. Audits#
8.1On request, Deployed provides the Customer with the information needed to demonstrate compliance with this DPA.
8.2The Customer, or an independent auditor appointed by the Customer and bound by confidentiality, may audit Deployed's compliance with this DPA once per calendar year, and in addition after a personal data breach or at the request of a supervisory authority, with thirty (30) days' written notice. Each party bears its own costs, unless the audit reveals a material breach of this DPA by Deployed.
9. Deletion and return#
9.1When the Service Agreement ends, Deployed deletes or returns the Customer's personal data, as the Customer chooses, within thirty (30) days, including copies held by sub-processors, and confirms this in writing. Encrypted backups are not changed but expire and are deleted automatically, no later than thirty (30) days after that.
9.2Personal data that Deployed must keep by law is deleted when the legal obligation to keep it ends.
10. Liability#
10.1Liability towards data subjects follows Article 82 of the GDPR.
10.2Administrative fines are borne by the party on which they are imposed.
10.3In all other respects, the limitation of liability in the Service Agreement applies.
11. Term, versions and governing law#
11.1This DPA applies for as long as Deployed processes personal data on the Customer's behalf. Sections 2.3, 3.1, 9 and 10 continue to apply after it ends.
11.2Versions of and changes to this DPA follow section 17 of the Service Agreement. This DPA is published at getdeployed.ai/legal/dpa.
11.3This DPA is governed by Swedish law. Disputes are settled in accordance with the Service Agreement.
Annex 1: Description of the processing#
| Service | Deployed OS under the Service Agreement: the Customer's Instance with its company-specific MCP connection, Skills, teams, roles, Guardrails, Connectors and governance log. |
|---|---|
| Purpose | To deliver the Service: managing User accounts and access rights, providing Skills and Guardrails to Users' AI Tools, relaying calls through Connectors to the Customer's systems, sending invitations and sign-in emails, keeping a governance log of usage and access, and providing support, operations and troubleshooting. |
| Nature of the processing | Storage, retrieval, transmission, logging, backup and deletion. |
| Categories of data subjects | The Customer's Users of the Service, such as employees and consultants. People whose data is held in the Customer's systems or Customer Content, such as customers, contacts and employees. |
| Types of personal data | Account data: name, work email address, password hash or sign-in provider identifier, and two-factor settings. Session data: session token, IP address and browser user agent. Memberships, teams, roles and invitations. Governance log: who did what and when (audit log), and which Skill or Connector each User called and when (usage events), without content. Customer Content, including comments and uploaded files. For each connected system: an encrypted access token, the account label (such as the account's email address) and the access granted. Content from the Customer's systems that a User retrieves through a Connector passes through the Service to the User's AI Tool and is not stored by the Service. |
| Special categories of personal data | Not processed intentionally. The Customer is responsible for not adding such data to Skills and for which systems it connects to the Service. |
| Location | Stored in the EU, in the location stated on the Sub-processors page, unless the Order Form states otherwise. |
| Duration | For as long as the Service Agreement applies, and then until deletion under section 9. |
| Retention | Sessions: 7 days. Invitations: 7 days by default. Usage events: 90 days by default, adjustable by the Customer from 7 to 365 days. Audit log: 365 days by default, adjustable by the Customer from 90 days to 7 years. Customer Content: for as long as the Instance exists. When a User is disabled, their sessions, AI Tool authorisations and connected accounts are removed at once. Backups: up to 4 weeks. On termination: section 9 applies. |
| AI model training | Personal data may not be used to train, fine-tune or improve AI models, either by Deployed or by its sub-processors. |
| AI Providers and other Customer providers | The Customer's AI Tools, such as Claude and ChatGPT, the systems the Customer connects through Connectors, and any AI model service that the Service calls with the Customer's own API key are the Customer's own providers. They are not sub-processors of Deployed. The processing that takes place at each of them is governed by the Customer's own agreement with that provider. |
| Customer contact for data protection | The Customer's reference person stated in the Order Form, or another contact that the Customer has given in writing. |
Annex 2: Technical and organisational security measures#
| Access control | Roles (Admin, Editor and Member) and access per team and skill package. Least-privilege access. Access is revoked centrally, and a disabled User is blocked at once. |
|---|---|
| Authentication | Sign-in with email and password with optional two-factor authentication, or with the Customer's Microsoft or Google account. Single sign-on with the Customer's identity provider on the Enterprise Plan. |
| Separation | Each customer has its own isolated Instance, and data is kept separate per customer. |
| Encryption | Encryption in transit (TLS). Data at rest is encrypted by the hosting provider. Access tokens for connected systems are stored encrypted. Backups are encrypted with AES-256 with a dedicated key. |
| Deployed personnel access | Access to production is limited to named Deployed engineering staff, through personal accounts with multi-factor authentication, and is logged. |
| Logging | Every call to a Skill or Connector is recorded in the governance log, which the Customer can export. Application logs redact email addresses and secrets, and contain no IP addresses or request content. No external logging or error-tracking service is used. |
| Backups | Daily and weekly encrypted backups, stored in the same EU location as the Service, retained for up to 4 weeks. Restores are tested. |
| Incident handling | A documented incident process, with notice to the Customer under section 5. |
| Data protection contact at Deployed | Poyan Karimi, poyan@getdeployed.ai |