Logo

Palindrome Data Processing and Security Addendum

Last updated: August 20, 2026

This Data Processing and Security Addendum ("DPA") forms part of the agreement between Palindrome Labs, Inc. ("Palindrome") and the customer identified in an Order Form ("Customer"). The Agreement consists of the Master Services Agreement (the "MSA"), each Order Form, this DPA, and each incorporated exhibit or schedule. This DPA takes effect on the effective date of the first Order Form.

1. Definitions

1.1 Applicable Data Protection Law means a law that applies to Palindrome's processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the EU GDPR as incorporated into United Kingdom law ("UK GDPR"), the Swiss Federal Act on Data Protection, and applicable U.S. state comprehensive privacy laws.

1.2 Customer Personal Data means Personal Data contained in Customer Data that Palindrome processes on Customer's behalf.

1.3 Personal Data means information defined as personal data, personal information, or a similar term under Applicable Data Protection Law.

1.4 Process and processing mean an operation performed on Personal Data, including collection, storage, use, disclosure, transmission, alteration, retrieval, or deletion.

1.5 Security Incident means a confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, or destruction of Customer Data while that data is in the possession or control of Palindrome or a Subprocessor.

A Security Incident does not include an unsuccessful access attempt, scan, probe, vulnerability, alert, or event that does not result in a confirmed compromise of Customer Data. It also does not include an incident affecting a Customer-Directed Service unless Palindrome caused the incident through its breach of the Agreement.

1.6 Subprocessor means a third party that Palindrome appoints to process Customer Data on Customer's behalf to provide the Services. A Customer-Directed Service is not a Subprocessor.

Capitalized terms not defined in this DPA have the meanings stated in the MSA.

2. Scope, Roles, and Instructions

2.1 Customer acts as the controller, business, or equivalent entity for Customer Personal Data. Palindrome acts as Customer's processor, service provider, or contractor.

2.2 Customer instructs Palindrome to process Customer Personal Data to:

  • provide, secure, maintain, and support the Services;
  • apply Customer's configurations and documented instructions;
  • prevent and address fraud, abuse, Security Incidents, and technical problems;
  • comply with law; and
  • perform the Agreement.

The Agreement, Customer's use and configuration of the Services, and documented support requests constitute Customer's instructions. Palindrome will notify Customer if Palindrome believes an instruction violates Applicable Data Protection Law, unless law prohibits notice.

2.3 Customer will ensure that its instructions comply with law and that it has a lawful basis, rights, notices, and consents for the processing. Customer will not submit Customer Personal Data that the Agreement prohibits or use the Services to process regulated data without first obtaining Palindrome's written agreement.

2.4 Sections 4 through 7 and Section 10 apply to all Customer Data, whether or not Customer Data contains Personal Data. The other data-protection provisions of this DPA apply to Customer Personal Data.

3. Processing Restrictions

3.1 Palindrome will process Customer Personal Data only under Customer's documented instructions, the Agreement, and applicable law.

3.2 Palindrome will not:

  • sell Customer Personal Data;
  • share Customer Personal Data for cross-context behavioral advertising;
  • process Customer Personal Data for targeted advertising;
  • retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as the Agreement or law permits;
  • combine Customer Personal Data with Personal Data received from another person or collected from Palindrome's own interaction with an individual, except as Applicable Data Protection Law permits a processor or service provider to combine it; or
  • use Customer Personal Data to train or fine-tune a general-purpose machine-learning or artificial-intelligence model.

3.3 Palindrome certifies that it understands and will comply with the restrictions in this Section. If Palindrome determines that it can no longer meet an obligation imposed by Applicable Data Protection Law, it will notify Customer as required by law. Customer may take reasonable steps to stop and remediate unauthorized processing.

3.4 The MSA governs Aggregated Data. Data qualifies as Aggregated Data only after it no longer identifies and cannot reasonably be used to identify Customer, an Authorized User, or an individual. Palindrome will not attempt to re-identify Aggregated Data.

4. Personnel and Confidentiality

4.1 Palindrome will limit access to Customer Personal Data to personnel and contractors who need access to perform the Agreement.

4.2 Palindrome will require those persons to protect Customer Personal Data through written confidentiality obligations or professional duties of confidentiality.

4.3 Palindrome will provide appropriate privacy and security training to personnel whose roles involve access to Customer Personal Data.

5. Security Program

5.1 Palindrome will maintain administrative, technical, and organizational safeguards appropriate to the nature of Customer Data and the risks of processing. The safeguards will include the measures in Schedule 2.

5.2 Palindrome may update its safeguards as technology and risks change. An update will not materially reduce the overall protection of Customer Personal Data during the term of the Agreement.

5.3 Customer remains responsible for:

  • configuring the Services and Customer-Directed Services appropriately;
  • managing Authorized Users, credentials, roles, and access;
  • reviewing Customer's use of features that collect prompt text, responses, tool content, attachments, file history, source code, or similar content;
  • securing systems and networks that Customer controls; and
  • notifying Palindrome promptly of suspected unauthorized use.

6. Subprocessors

6.1 Customer authorizes Palindrome to use the Subprocessors listed in the Trust Center.

6.2 Palindrome will bind each Subprocessor by written terms that require data-protection and security obligations appropriate to the Customer Data and services involved. Palindrome remains responsible for a Subprocessor's performance of those obligations to the same extent Palindrome would be responsible if it performed the processing itself.

6.3 Palindrome will provide at least 15 days' advance notice before authorizing a new Subprocessor to process Customer Data, unless an emergency creates a security or service-availability need that makes advance notice impracticable. In an emergency, Palindrome will provide notice as soon as practicable.

6.4 Customer may object to a new Subprocessor within 10 days after notice on reasonable, documented data-protection grounds. The parties will work in good faith to address the objection. If they cannot resolve it, Palindrome may avoid using the Subprocessor for Customer, or Customer may terminate the affected Services and receive a refund of prepaid fees for the unused terminated period. This termination and refund are Customer's sole remedies for a Subprocessor objection.

7. Security Incidents

7.1 Palindrome will notify Customer without undue delay, and no later than 72 hours, after confirming a Security Incident, unless law requires earlier notice. Palindrome will not delay a reasonable investigation to defer notice.

7.2 Notice will include information reasonably available to Palindrome concerning:

  • the nature of the Security Incident;
  • the categories of affected Customer Personal Data and individuals;
  • the likely consequences;
  • containment and remediation measures; and
  • a contact for follow-up questions.

Palindrome may provide information in phases as its investigation develops.

7.3 Palindrome will take reasonable steps to contain, investigate, and remediate a Security Incident and prevent a recurrence. Palindrome will preserve relevant evidence as required by its incident-response procedures and law.

7.4 Customer is responsible for determining whether to notify individuals, regulators, or other parties, except to the extent Applicable Data Protection Law requires Palindrome to provide a notice directly. Palindrome will provide reasonable assistance based on the nature of its processing and the information available to it. Customer will not identify Palindrome in a public statement concerning a Security Incident without prior consultation, except where law requires identification.

7.5 A Security Incident notice is not an admission of fault or liability. Sections 10 and 11 of the MSA govern indemnification and liability.

8. Assistance and Individual Rights

8.1 Taking into account the nature of processing, Palindrome will provide reasonable assistance that Customer needs to respond to a verified request from an individual concerning Customer Personal Data.

8.2 If Palindrome receives a request concerning Customer Personal Data directly from an individual, Palindrome will direct the individual to Customer and will not respond substantively unless Customer instructs Palindrome or law requires a response.

8.3 Palindrome will provide reasonable information and assistance for Customer's data-protection impact assessment, regulator consultation, or legally required compliance assessment when the request relates to Palindrome's processing under the Agreement.

8.4 Palindrome may charge reasonable fees for assistance that requires material work beyond the standard Services, unless Applicable Data Protection Law requires Palindrome to provide the assistance without charge or the assistance results from Palindrome's breach.

9. Compliance Information and Audits

9.1 Palindrome's security program is currently independently audited against the SOC 2 Type II standard; a current report will be available under NDA through the Trust Center.

9.2 Before a current report is available, or when a report does not address a reasonable material concern, Customer may submit a reasonable written security questionnaire no more than once in a 12-month period. The annual limit does not apply after a confirmed Security Incident affecting Customer or when a regulator requires additional information.

9.3 Customer will first use reports, certifications, summaries, and written responses that Palindrome provides. If Applicable Data Protection Law requires an additional audit and the available materials are insufficient, the parties will agree on a scope, timing, duration, confidentiality protections, and an independent auditor. An audit will occur during normal business hours, avoid disruption, protect other customers' information, and not include penetration testing or access to systems without Palindrome's written approval.

9.4 Customer will bear its audit costs unless the audit identifies Palindrome's material breach of this DPA. Palindrome may charge reasonable fees for assistance beyond its standard compliance program.

10. Retention, Return, and Deletion

10.1 Unless an Order Form establishes a different period, Palindrome will apply a rolling 365-day retention period to Customer Data in active and queryable systems. Palindrome may retain particular records for a shorter period based on the applicable feature or Customer configuration.

10.2 After the Agreement expires or terminates, Palindrome will make the remaining Customer Data available for export for 30 days unless an Order Form states another period. Customer is responsible for completing its export during that period.

10.3 After the export period ends, Palindrome will begin deleting or irreversibly de-identifying Customer Data. Palindrome will complete deletion from active systems within 60 days and from backups, disaster-recovery systems, and archival systems within 365 days after the export period ends.

10.4 Until deletion, Palindrome will continue to protect retained Customer Data under this DPA and will not use it except for security, restoration, legal compliance, or deletion. Restoring a backup does not restart a retention period; Palindrome will reapply the deletion schedule to restored data.

10.5 Palindrome may retain Customer Data subject to a legal hold for the period law requires. Palindrome will isolate the retained data from ordinary use where practicable and delete it when the legal obligation ends.

10.6 Sections 10.1 through 10.5 do not apply to Aggregated Data that satisfies Section 5.6 of the MSA.

11. Data Locations and Transfers

11.1 Palindrome is based in the United States and may process Customer Personal Data in the United States and other locations used by an authorized Subprocessor.

11.2 If Applicable Data Protection Law requires a transfer mechanism for Customer Personal Data, Schedule 3 incorporates the applicable transfer terms. The parties will cooperate to implement another valid mechanism if a court or regulator invalidates or requires changes to those terms.

11.3 Customer will not use the Services to transfer Customer Personal Data in violation of law or a written data-residency commitment.

12. Liability, Indemnification, and Order of Precedence

12.1 Sections 10 and 11 of the MSA govern indemnification and liability arising from this DPA. This DPA does not create an indemnity separate from Section 10.4 of the MSA or an indemnity that an Order Form states through an express amendment to the MSA.

12.2 This DPA controls over a conflicting MSA or Order Form provision concerning Personal Data processing or Customer Data security. An Order Form modifies this DPA only if it identifies the DPA provision and states the amendment.

12.3 The Privacy Policy and Cookie Policy are public notices. They do not replace or amend this DPA.

12.4 Nothing in the Agreement limits a data subject's rights or a party's liability to the extent the EU SCCs, UK Addendum, or other mandatory transfer terms prohibit that limitation.

13. General

13.1 This DPA terminates when Palindrome completes its processing of Customer Personal Data, except for provisions that must survive to protect retained data or enforce accrued rights.

13.2 If a provision of this DPA is unenforceable, the remaining provisions remain effective.

13.3 The governing-law and notice provisions in the MSA apply to this DPA, except where Schedule 3 requires another law or forum for international transfer terms.

Schedule 1: Processing Details

Subject matter

Palindrome processes Customer Personal Data to provide an AI observability, optimization, governance, and related services platform.

Duration

Processing continues for the term of the Agreement and the deletion period in Section 10.

Frequency

Palindrome processes Customer Personal Data on a continuous or event-driven basis as Customer and its Authorized Users use the Services, and as needed for support, security, and deletion.

Nature and purpose

  • ingesting, storing, organizing, analyzing, and displaying AI and developer-tool telemetry;
  • producing usage, cost, performance, governance, security, and optimization information;
  • providing recommendations, classifications, routing, alerts, and related features;
  • authenticating users, administering organizations, and enforcing access controls;
  • supporting integrations and Customer configurations;
  • providing support and maintaining service reliability; and
  • detecting and responding to fraud, abuse, security incidents, and technical problems.

Categories of Customer Personal Data

  • names, work email addresses, account, organization, user, device, and session identifiers;
  • employment, team, role, manager, and attribution information;
  • IP addresses, device, browser, operating-system, application, and security information;
  • model, token, cost, latency, usage, request, and response telemetry;
  • prompts, responses, transcripts, prompt and response metadata, and output classifications;
  • tool inputs, tool outputs, tool calls, attachments, and MCP connection data;
  • source-code, file-history, file-snapshot, configuration, workspace, and editor or agent activity; and
  • support information and other content that Customer or an Authorized User submits.

Categories of individuals

  • Customer employees, contractors, agents, and Authorized Users;
  • customer administrators, billing contacts, and support contacts; and
  • individuals whose information appears in Customer Data submitted by Customer or an Authorized User.

Sensitive data

The Services do not require Customer to submit sensitive or special-category data unless an Order Form states otherwise. Customer controls whether Customer Data contains such information and must not submit it without an appropriate lawful basis and Palindrome's written authorization.

If Palindrome authorizes sensitive or special-category data in an Order Form, the access restrictions, encryption, logging, and other safeguards in Schedule 2 apply to that data. The Order Form will identify any additional safeguards.

Schedule 2: Security Measures

Palindrome will maintain a security program that includes the following controls, as appropriate to the Services and risks:

Access and personnel security

  • role-based access and least-privilege principles for Customer Data;
  • authentication controls for production and administrative systems;
  • confidentiality obligations for personnel with access to Customer Personal Data;
  • access review and removal procedures; and
  • security awareness and role-appropriate training.

Encryption and infrastructure

  • encryption of Customer Data in transit using industry-standard transport encryption;
  • encryption of Customer Data at rest in production storage systems;
  • environment, network, and logical-access controls designed to limit unauthorized access; and
  • cloud infrastructure safeguards and restrictions on public access.

Application and operational security

  • logging and monitoring appropriate to production systems;
  • vulnerability identification, assessment, and remediation processes;
  • change-management and deployment controls;
  • backup, recovery, and service-resilience procedures; and
  • safeguards designed to maintain tenant separation.

Incident response

  • a documented incident-response process;
  • procedures for investigation, containment, remediation, and communication;
  • escalation to responsible personnel; and
  • post-incident review appropriate to the severity of the event.

Subprocessor and risk management

  • risk-based review of Subprocessors that process Customer Data;
  • written data-protection and security obligations; and
  • periodic review of the security and compliance program.

Data lifecycle

  • retention controls for active and queryable systems;
  • deletion and de-identification procedures;
  • controls restricting the use of retained backup or archival data; and
  • deletion verification appropriate to the system and storage medium.

Schedule 3: International Transfer Terms

1. European Economic Area

1.1 If Customer transfers Customer Personal Data protected by the EU GDPR to Palindrome in a country that lacks an adequacy decision, the parties incorporate the standard contractual clauses in European Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") as follows:

  • Module Two applies when Customer is a controller and Palindrome is a processor.
  • Module Three applies when Customer is a processor and Palindrome is a subprocessor.
  • Clause 7, the optional docking clause, applies.
  • In Clause 9, Option 2 applies and the notice period in Section 6.3 of this DPA applies.
  • In Clause 11, the optional independent dispute-resolution language does not apply.
  • In Clause 17, Option 1 applies. The law of the EU Member State where Customer is established governs. If that law does not permit third-party beneficiary rights under the EU SCCs or Customer is not established in an EU Member State, Irish law governs.
  • Under Clause 18, courts corresponding to the law selected under Clause 17 have jurisdiction.
  • The competent supervisory authority under Clause 13 will be determined under the EU SCCs based on Customer's establishment, Article 27 representative, or the location of affected data subjects, as applicable. Customer will identify the competent supervisory authority in the applicable Order Form or other written transfer documentation before relying on the EU SCCs.

1.2 Schedule 1 to this DPA supplies the information required by Annex I to the EU SCCs. Schedule 2 supplies Annex II. The Trust Center subprocessor list supplies Annex III. Palindrome is the data importer. Customer is the data exporter. The parties' MSA and Order Form contact and signature information supplies the remaining party details.

2. United Kingdom

2.1 For a restricted transfer subject to the UK GDPR, the parties incorporate the Part 2 mandatory clauses of ICO Addendum template B1.0, laid before Parliament on February 2, 2022 under section 119A of the Data Protection Act 2018, including revisions made under Section 18 of those clauses (the "UK Addendum").

2.2 The EU SCC selections in Section 1 of this Schedule and the information in the Agreement complete Tables 1 through 3 of the UK Addendum. For Table 4, neither party may end the UK Addendum under Section 19 solely because the Information Commissioner issues a revised approved addendum.

3. Switzerland

3.1 For Customer Personal Data protected by Swiss data-protection law, the EU SCCs apply with these changes:

  • references to the EU GDPR include the Swiss Federal Act on Data Protection;
  • references to an EU Member State include Switzerland;
  • the term "personal data" includes personal data protected by Swiss law;
  • the Swiss Federal Data Protection and Information Commissioner acts as the competent supervisory authority for transfers governed by Swiss law; and
  • data subjects in Switzerland may enforce rights under the EU SCCs as Swiss law permits.

4. Transfer Assessments and Government Requests

4.1 Each party will provide information that the other reasonably needs to assess a regulated transfer. Palindrome will use the safeguards in Schedule 2 and will notify Customer if Palindrome determines that it can no longer comply with the applicable transfer terms.

4.2 Palindrome will review a government demand for Customer Personal Data and, where reasonable and lawful, challenge a demand that conflicts with law or exceeds the requesting authority's powers. Palindrome will provide notice to Customer before disclosure unless law prohibits notice. If law prohibits notice, Palindrome will use lawful efforts to obtain permission to provide notice.

Schedule 4: Subprocessor Information

Palindrome maintains its current list of Subprocessors, their functions, and their processing locations in the Trust Center. That list forms part of this DPA. Section 6 governs notice of changes and Customer objections.