Data Processing Addendum

Scope and definitions

This Data Processing Addendum (“DPA”) applies when Aethric LLC (“Aethric”) processes Customer Personal Data on behalf of a customer (“Customer”) in providing Anthenos under the Terms of Service or another agreement between them (the “Agreement”). It takes effect when Customer accepts the Agreement.

• “Data Protection Laws” means the laws on the processing of personal information that apply to a party’s processing under the Agreement, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (“CCPA”).
• “Customer Personal Data” means personal information in Customer Content that Aethric processes on Customer’s behalf.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data”, “processing”, “service provider” and similar terms have the meanings given in the Data Protection Laws. Capitalised terms not defined here have the meanings in the Agreement.

Controller and processor roles

• Customer is the controller of Customer Personal Data, and Aethric is its processor. Where Customer is itself a processor for another controller, Aethric is Customer’s subprocessor, and Customer confirms that its controller has authorised these terms.
• Aethric is a controller of the personal information it processes to run its own business — account, billing, security and website information — as the Privacy Policy describes. This DPA does not apply to that information.
• Customer is responsible for the lawfulness of the Customer Personal Data it provides or authorises Anthenos to access, including having a lawful basis and giving any notices required, and for the instructions it gives.

Details of the processing

• Subject matter and nature. Anthenos is an AI operator for the customer and procurement portals that suppliers, manufacturers, distributors and other businesses work in. It handles routine portal work — such as acknowledging purchase orders, submitting invoices, uploading shipping and fulfilment information, and checking order, invoice, shipment and payment statuses — detects exceptions, asks a person to approve sensitive actions, and keeps a record of everything it does.
• Purpose. Providing, securing and supporting Anthenos for Customer under the Agreement, including executing the portal workflows Customer authorises, verifying results, detecting exceptions, requesting approvals and keeping execution records.
• Duration. The term of the Agreement, and afterwards until deletion as this DPA describes.
• Data subjects. Customer’s personnel and authorised users; personnel and contacts of Customer’s customers, suppliers and other business partners whose details appear in purchase orders, invoices, shipment information, portal records and documents.
• Categories of personal data. Names, business contact details (such as work email addresses, phone numbers and business addresses), job titles, identifiers used in portals and business systems, credentials Customer provides for its portals and systems, and other personal information contained in business documents and records.
• Special categories. Anthenos is not designed to process special categories of personal data or data about criminal convictions, and Customer will not submit them unless the parties agree in writing.

Processing instructions

• Aethric will process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise, in which case Aethric will tell Customer first unless the law prohibits it.
• The Agreement, this DPA, and Customer’s use and configuration of Anthenos — including the portals and systems it connects, the workflows it authorises and its approval policies — are Customer’s complete instructions. Further instructions must be agreed in writing.
• Aethric will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.
• Aethric will not sell Customer Personal Data, use it for advertising, or use it to train AI models.

Confidentiality

Aethric will ensure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, whether contractual or statutory, and has access only as needed to provide, secure and support Anthenos.

Security measures

Aethric will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to individuals. The measures in place are described in the Annex. Aethric may update them, provided the update does not materially reduce the overall protection of Customer Personal Data.

Subprocessors

• Customer gives Aethric general authorisation to engage subprocessors. The current list is on the Subprocessors page.
• Aethric will impose on each subprocessor data protection terms that protect Customer Personal Data to the standard this DPA requires, and remains responsible to Customer for its subprocessors’ performance of those obligations.
• Aethric will update the Subprocessors page before a new subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds by writing to hello@aethric.llc within 30 days of the update. The parties will then discuss the concern in good faith; if it cannot be resolved, Customer may terminate the affected part of the service and receive a refund of any prepaid fees for the period after termination.

International transfers

Aethric is based in the United States, and Customer Personal Data may be processed in the United States and in other countries where Aethric and its subprocessors operate. Where Data Protection Laws restrict a transfer of Customer Personal Data out of the European Economic Area, the United Kingdom or Switzerland, the parties agree that the transfer is made under the European Commission’s Standard Contractual Clauses (Module Two, or Module Three where Customer is a processor), the UK International Data Transfer Addendum, or the equivalent Swiss mechanism, as applicable, which are incorporated into this DPA by reference, with the details of the processing above completing their annexes — unless another valid transfer mechanism applies.

Data subject requests

Taking into account the nature of the processing, Aethric will assist Customer, by appropriate technical and organizational measures where possible, in responding to requests from individuals to exercise their rights under Data Protection Laws. If Aethric receives such a request about Customer Personal Data directly, it will refer the individual to Customer and will not respond itself except to do so, unless the law requires otherwise. Anthenos lets Customer export its data and delete its workspace from Settings.

Security incidents

Aethric will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the incident, the data and individuals affected, its likely consequences, and the measures taken or proposed to address it, and Aethric will provide further information as it becomes available. Aethric will take reasonable steps to contain and investigate the incident and to reduce its effects, and will reasonably assist Customer with any notification Customer must make. Notice of a Security Incident is not an admission of fault.

Assessments and consultation

Taking into account the nature of the processing and the information available to it, Aethric will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of Customer in relation to Anthenos.

Deletion and return of data

• During the term, Customer can export its data from Settings, and delete connected systems, credentials, its workspace and its account.
• When the Agreement ends, Customer may export its data before deleting its workspace. Aethric will delete Customer Personal Data when the workspace is deleted, or on Customer’s written request, except for copies Aethric must keep by law, and copies in backups, which are deleted as the backups expire and are not used in the meantime.
• Aethric’s security audit log is append-only and is kept after a workspace is deleted, as a record of what happened; it holds limited personal information, such as the email address of the person who acted. Aethric will protect anything it keeps under this DPA for as long as it keeps it.

Audits and cooperation

• Aethric will make available to Customer, on request, the information reasonably necessary to demonstrate its compliance with this DPA, including answers to reasonable security and privacy questionnaires, no more than once a year unless a Security Incident or a supervisory authority requires otherwise.
• Where that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may audit Aethric’s compliance with this DPA, itself or through an independent auditor bound by confidentiality, on at least 30 days’ written notice, during business hours, in a way that does not disrupt the service or expose other customers’ data, and at Customer’s expense.
• Where Aethric holds a current third-party certification or audit report relevant to Anthenos, it may satisfy an audit request by providing it.
• Each party will cooperate with the other, and with supervisory authorities, as Data Protection Laws require.

US state privacy laws

Where the CCPA or a similar US state privacy law applies, Aethric is a service provider or processor. Aethric will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside its direct business relationship with Customer; will not combine it with personal information it receives from others, except as the law permits; will comply with the obligations that apply to it and provide the same level of privacy protection the law requires; and will notify Customer if it can no longer meet those obligations. Customer may take reasonable steps to stop and remedy unauthorised use of Customer Personal Data.

Term, liability and precedence

• This DPA lasts for as long as Aethric processes Customer Personal Data.
• Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws do not allow them.
• If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses control.
• This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses require otherwise. Aethric LLC’s registered address is To be confirmed by Aethric LLC: the registered address of Aethric LLC.

Annex: technical and organizational measures

• Encryption in transit. Anthenos is served only over HTTPS, with HSTS.
• Encryption of secrets at rest. Portal credentials, signed-in sessions, API keys and references to connected accounts are encrypted with AES-256-GCM. Passwords for Anthenos are stored only as scrypt hashes; session secrets only as keyed hashes.
• Credential handling. What a person types into secure sign-in is encrypted while waiting to be entered and deleted once entered. Credentials are decrypted only on Aethric’s servers when a workflow needs them, and are not sent to AI models or to the browser. Logs are written with passwords, tokens and keys removed.
• Access control. Role-based access within each workspace (owner, admin, operator, viewer); rate-limited sign-in; sessions that expire after 30 days.
• Isolation. Every query is scoped to the requesting user’s workspace, taken from their session and never from the request, and covered by automated tests.
• Approval controls. A per-workspace policy decides which portal actions are automatic, need approval, or are never automatic, with limits a workspace cannot relax; approvals are refused when the facts behind them have changed.
• Logging and verification. An append-only security audit log; a timeline for every work item; results read back from the portal and kept as evidence.
• Application security. A strict Content-Security-Policy; outbound requests checked against private networks on every redirect; uploaded files checked against their contents and never executed; content read from portals and documents treated as data, not instructions.
• Availability. Health checks with automatic restart of failed processes, structured logs, and operational alerts.
• Data minimisation and retention. Only what a model needs is sent to it, with secrets and token-like values removed; ended sessions, finished jobs and closed sign-ins are deleted on a schedule.