Data Processing Agreement (DPA)

Enterprise GDPR & Privacy Commitments

For organizations processing personal data subject to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), or India Digital Personal Data Protection Act (DPDPA), Operon provides a standardized, pre-signed Data Processing Addendum (“DPA”).

Our DPA incorporates the European Commission's Standard Contractual Clauses (SCCs) to provide legal mechanisms for lawful international data transfers.

Key Provisions Covered in our DPA

• Processing Restrictions: Customer data is processed strictly to execute requested agent runs, playbooks, and storage operations.
• Security Safeguards: Cryptographic envelope encryption for BYOK keys, strict tenant isolation, and audited access controls.
• Sub-processor Notification: 14-day advance notice for any new authorized sub-processors listed in our Sub-processors Directory.
• Data Subject Rights Assistance: Tools and API endpoints to export, modify, or permanently delete customer data upon request.
• Incident Notification: Prompt written notification of any verified security incident affecting customer personal data without undue delay.

How to Execute a Custom DPA

Enterprise customers requiring customized terms, audit agreements, or counter-signed execution copies can reach out directly to our compliance counsel: