Data processing agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between the Customer (controller) and Sotto Solutions (processor). It applies where we process personal data on the Customer's behalf under the EU GDPR, the UK GDPR or the Israeli Privacy Protection Law.

1. Details of processing

• Purpose: checking messages users are about to send to AI tools for sensitive information, applying the Customer's policy, and providing the dashboard.
• Duration: the term of the subscription, plus the deletion periods in section 8.
• Data subjects: the Customer's users; people mentioned in messages users check.
• Data: user account data (email, name, role); message text, and text read from attached files, submitted for a cloud check (transient); detection hints and device-generated topic summaries (transient); content-free usage counters; policy definitions. Messages may incidentally contain special categories of data; Celato is designed to detect them and not to retain them.
• Nature: in-memory analysis of message and attached-file text without storage; storage of account data, encrypted policies and counters.

2. Our obligations

We process personal data only on the Customer's documented instructions (the Terms, this DPA and the Customer's settings); ensure that anyone with access is bound by confidentiality; apply the measures in Annex 1; assist the Customer with data subject requests and impact assessments; and provide the information needed to demonstrate compliance.

3. Subprocessors

The Customer authorizes the subprocessors listed at Subprocessors. We give at least 30 days' notice of new subprocessors on that page and by email to admins; the Customer may object on reasonable grounds and, if we cannot resolve the objection, terminate. We impose equivalent data protection terms on each subprocessor.

4. International transfers

Hosting and storage are in the EU. AI processing of cloud checks takes place in the United States, under the Standard Contractual Clauses in the AI processing provider's data processing terms. The provider's name is given to the Customer on request.

5. Security incidents

We notify the Customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Customer's data, with the information needed for the Customer's own notifications.

6. Audits

On request (at most once a year, with 30 days' notice) we answer reasonable security questionnaires and provide available third-party reports of our subprocessors. On-site audits only where required by law or a supervisory authority.

7. Customer obligations

The Customer is responsible for the lawfulness of its instructions, for informing its users, and for the content of its policies.

8. Deletion and return

When the Customer deletes its organization, or on termination, we delete the Customer's personal data from production systems immediately; backups are overwritten within 7 days. Message text is never retained. An export of account and policy data is available on request before deletion.

Annex 1 — Technical and organizational measures

• TLS for all traffic; encryption at rest; protected-topic definitions encrypted with an application key (AES-256-GCM) bound to the organization.
• Message text processed in memory only and excluded from all logs; automated tests enforce it.
• On-device history encrypted with a non-extractable key, never sent to us.
• Least-privilege service accounts; secrets in a managed secret store; administrator access with two-factor authentication.
• Database reachable only through an authenticated connector, with encrypted connections only.
• Daily backups kept 7 days, with tested restores; monitoring and alerting; spending and abuse limits.
• Sign-in with one-time emailed codes (stored hashed, valid 15 minutes, limited attempts).
• Automated secret scanning of all code on every change.