1. Role of the Parties
Customer acts as the Data Controller (or Business under CCPA) and Mindaeon, Inc. acts as the Data Processor (or Service Provider) with respect to personal data processed within Customer's isolated Mindaeon workspace.
2. Annex II — Technical & Organizational Security Measures (TOMs)
- Cryptographic Tenant Isolation: Dedicated PostgreSQL 18 schemas / Row-Level Security policies and per-tenant OpenBao Transit keys (AES-256-GCM / Ed25519).
- Tamper-Evident Audit Trail: Every administrative action and agent tool invocation is recorded in a SHA-256 hash-chained ledger.
- Pre-Execution Secret & PII Redaction: Automated entropy and pattern redaction before any prompt leaves the local workspace boundary.
- Supply-Chain Integrity: All client binaries and appliance bundles are signed with Ed25519 (
release-prod-2026-01) and accompanied by SLSA v1.0 provenance.
3. International Transfers & SCC Incorporation
Where personal data originating in the EEA, UK, or Switzerland is transferred outside those jurisdictions, Module Two (Controller-to-Processor) and Module Three (Processor-to-Processor) of the European Commission Standard Contractual Clauses (Decision 2021/914) apply automatically.
4. Counter-Signed DPA Requests
Enterprise procurement teams requiring a counter-signed PDF copy of this DPA or custom data residency schedules may request one via mindaeon.com/contact or privacy@mindaeon.com.