Data Processing Agreement

1. Scope and Roles

The Customer is the Controller, ApexID is the Processor. ApexID processes personal data only on documented instructions from the Customer and only as necessary to provide the Services.

2. Categories of Personal Data

• Customer account data: name, work email, company name, role.
• Content data: reviews, replies, notes and metadata submitted by the Customer's users.
• Technical data: IP addresses, user-agent, session cookies (essential only).

3. Technical & Organizational Measures (TOMs)

• Encryption at rest: AWS KMS Customer Managed Keys, auto-rotated yearly.
• Encryption in transit: TLS 1.2+ enforced (Policy-Min-TLS-1-2-2019-07).
• Tenant isolation: PostgreSQL Row-Level Security + dedicated DB role apexid_app.
• Network: private VPC (10.0.0.0/16), AWS WAF, no public RDS/OpenSearch endpoints.
• Access control: AWS Cognito with MFA, least-privilege IAM, CloudTrail audit logs.

4. Sub-processors

The Customer authorizes ApexID to engage the following sub-processors:

• Amazon Web Services EMEA SARL — cloud infrastructure, exclusively eu-central-1 (Frankfurt).
• Stripe Payments Europe, Ltd. — payment processing.
• Amazon SES — transactional email delivery.

5. Data Subject Rights

ApexID assists the Customer in responding to data subject requests (access, rectification, erasure, portability) within 72 hours of notification. Contact: dpa@apexid.site.

6. Data Breach Notification

ApexID notifies the Customer without undue delay (target: within 24 hours) after becoming aware of any personal data breach, per GDPR Art. 33.

7. Data Residency & Return

All Customer data is stored in AWS eu-central-1 (Frankfurt, Germany). Upon termination, ApexID deletes all Customer data within 30 days, unless legally required to retain it.