Data processing agreement
Effective (published before launch) · (published before launch) OÜ, Estonia · Art. 28 GDPR
Scope
This Data Processing Agreement (DPA) governs the processing of personal data by Ahrigate ('Processor') on behalf of the customer ('Controller') in connection with the Ahrigate API gateway service.
Processing details
Subject matter: API request routing. Duration: term of service agreement. Nature: transit of requests to the model provider selected by the customer, and logging of usage metadata. Purpose: service delivery and billing. Data categories: API usage logs (model id, token count, timestamp, API key identifier) and any personal data contained in requests the customer chooses to send. Data subjects: end users of the customer's application.
Sub-processors
The customer gives general authorisation for Ahrigate to engage the following sub-processors. Ahrigate will update this list before adding or replacing a sub-processor (published before launch).
- Vercel Inc. — Fallback website hosting (not active unless we fail over to it) — Functions configured for Vercel (fra1, Frankfurt); global edge network
- Clerk, Inc. — Authentication and account management — (published before launch)
- Neon, Inc. — PostgreSQL database — (published before launch)
- Upstash, Inc. — Key-value cache / rate limiting — (published before launch)
- Telegram Messenger Inc. — Internal operational alerts (no customer content) — (published before launch)
- Amazon Web Services, Inc. — Primary website hosting, API gateway hosting and AWS Bedrock model access — Website: AWS Lightsail, Frankfurt (eu-central-1); gateway: AWS, Frankfurt (eu-central-1); Bedrock region (published before launch)
- OpenAI, L.L.C. — Model provider (processes the prompts you send to OpenAI models) — United States (provider-determined); (published before launch)
- Anthropic, PBC — Model provider (processes the prompts you send) — United States (provider-determined)
Security measures
Ahrigate implements technical and organisational measures appropriate to the risk, as described on the Security page. A fuller description of measures is available on request.
Governing law
This DPA is governed by the laws of Estonia. The competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).