Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Controller") and Zynth Media Technology (the "Processor") for Perihelium. It applies where we process personal data of your end-users on your behalf — the identities, credentials, and access records your organization manages in the platform.

You determine the purposes and means of that processing; we process it only to provide the Service and on your documented instructions, including as configured through the product.

• Subject matter: identity and access management for your end-users and agents.
• Nature: substantially automated. Access and authentication events are evaluated continuously by automated detection, and autonomous agent identities act within the platform. Automated protective measures may contain an agent identity, revoke sessions or tokens, or throttle requests; automated decision-making is described in our Privacy Policy.
• Duration: for the term of your use of the Service.
• Categories of data subject: your workforce, customers, and machine/agent identities.
• Categories of personal data: identifiers (email, name), authentication data (hashed credentials, MFA/passkey material), and access/security event logs.

• Process personal data only on your documented instructions, including for international transfers.
• Ensure personnel authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see below).
• Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations.
• Delete or return personal data at the end of the engagement, as described below.
• Make available information necessary to demonstrate compliance and allow for reasonable audits.

We maintain a defense-in-depth security program: encryption in transit (TLS); application-level encryption of stored authenticator (MFA) secrets, webhook signing secrets and single-sign-on client secrets, with keys held outside the database; Argon2id hashing of passwords and recovery codes; database backups encrypted on our server before they leave it; tenant isolation enforced at the database with row-level security; least-privilege database roles; a tamper-evident, hash-chained audit log; egress network controls; and a signed, digest-pinned software supply chain. The Service is designed to fail closed. These measures are described further in our Privacy Policy and Trust Centre.

You provide a general authorization for us to engage the sub-processors below to help deliver the Service. Each is bound by data-protection terms consistent with this DPA. We will give notice of any intended addition or replacement so you may object on reasonable data-protection grounds.

The managed offering is hosted in Singapore (APAC). Where a sub-processor processes personal data outside your region, we rely on appropriate transfer safeguards, such as standard contractual clauses. If you self-host, personal data remains within your own infrastructure and no transfer to us occurs.

The platform provides built-in tools — the Privacy & Data centre — for access, export, rectification, and erasure of end-user data, so you can respond to data-subject requests directly. Where you need additional assistance, we will provide it taking into account the nature of the processing.

Erasure through the platform removes the person's profile, sign-in credentials and passkeys, their memberships in every organization and the identity-provider identifier held on them, their connected-app consents (and ends their live sessions), the IP address on their consent history, the email address, IP address and session identifier on the security events of their own actions, and the address held in the 30-day security investigation store. On the request itself it removes the email address, IP address and free-text description. It does not alter the tamper-evident audit log, which is retained so that its integrity can be proven and records a keyed pseudonym in place of an email address and the network of an IP address in place of the address itself (entries written before that change can still contain an IP address or email address recorded when an action took place), and it refuses to erase a person who is the only active owner of an organization that is still active, because that would leave the organization without an owner.

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to help you meet your own notification obligations. The platform's detection and audit spine is designed to surface such events quickly.

On termination, and at your choice, we will delete or return the personal data we process on your behalf, and delete existing copies unless retention is required by law. For self-hosted deployments, deletion is under your control.

When an organization is deleted on the platform we can restore it for 30 days. After that we delete every record the organization owned, including its members' memberships, settings, credentials, integrations and logs, and keep only the tamper-evident audit log (which holds a keyed pseudonym and a truncated network address, not a mailbox address) and an empty record of the organization's identifier. Copies in backups are deleted as the backups expire, within 120 days of the organization being deleted.

For any question about this DPA, and for notices under it, contact legal@zynthmedia.com. Security matters may also be raised at security@zynthmedia.com.