Legal

Data processing addendum

This Data Processing Addendum ("DPA") forms part of the Terms of service between you (the "Customer") and Kasada AI LLC ("Kasada"). It is intended for business customers and applies when Kasada processes personal information contained in Customer Data on the Customer's behalf, under applicable data protection laws, including the California Consumer Privacy Act as amended ("CCPA") and other US state comprehensive privacy laws (together, "Data Protection Laws").

1. Roles

The Customer is the controller (or business) of personal information stored on or processed by its servers, or a processor acting for its own controller. Kasada is the processor (or service provider, as defined in the CCPA) or sub-processor.

1a. Service provider commitments

Kasada will not sell or share Customer Data, as those terms are defined in the CCPA; will not retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with the Customer; will not combine it with personal information Kasada receives from others, except as Data Protection Laws allow; and will notify the Customer if it can no longer meet its obligations under Data Protection Laws. The Customer may take reasonable steps to stop and remediate unauthorized use.

2. Scope of processing

• Subject matter: hosting of virtual and dedicated servers, storage, backups and networking.
• Duration: for the term of the agreement and until deletion under section 9.
• Nature and purpose: storage and transmission as needed to provide the Service. Kasada does not access the contents of servers except on documented instructions, for security, or as required by law.
• Data subjects and categories: determined by the Customer.

3. Instructions

Kasada processes Customer Data only on the Customer's documented instructions, which are given through these terms and the Customer's use of the console and API. Kasada will tell the Customer if it believes an instruction breaks the law.

4. Confidentiality

Everyone at Kasada who may access Customer Data is bound by confidentiality obligations.

5. Security

Kasada implements appropriate technical and organizational measures, including: encryption of data in transit to the control plane, encrypted storage on host servers, isolation of customer servers and networks, anti-spoofing filters, restricted and audited administrative access over private networks with hardware-key authentication, mandatory two-factor authentication for staff, regular patching, and secure erasure of disks when servers are deleted.

6. Sub-processors

The Customer authorizes Kasada to use sub-processors in these categories: infrastructure and data center providers (facilities, hardware and network), backup storage, email and SMS delivery, and payment processing. Each sub-processor is bound by written terms that protect Customer Data at least as well as this DPA, and Kasada remains responsible for them. Kasada will keep a current list available on request and give at least 30 days' notice of new sub-processors that process Customer Data. The Customer may object on reasonable grounds; if no solution is found, the Customer may end the affected Service.

7. Location and transfers

Customer Data on servers is stored in the region the Customer selects for each server (US East, EU Central or US West). Kasada will not move it to another region without the Customer's instruction. Account and billing information is processed in the United States. Where Data Protection Laws require a transfer mechanism for personal information that the Customer places in a region or makes available from a location subject to such requirements, the parties will use an appropriate mechanism (such as standard contractual clauses approved under those laws), which is incorporated by reference where needed.

8. Assistance and breaches

• Kasada will help the Customer respond to data-subject requests and with impact assessments, as far as reasonably possible given the nature of the Service.
• Kasada will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a security breach affecting personal information in Customer Data, with the information reasonably available.

9. Deletion

When the Customer deletes a server or its account ends, Kasada deletes the related Customer Data, including backups, within 30 days unless the law requires otherwise. Disks are securely erased on deletion.

10. Audits

Kasada will make available information needed to demonstrate compliance with this DPA and allow reasonable audits, no more than once a year, with 30 days' notice, at the Customer's cost, subject to confidentiality.

11. Precedence

If this DPA conflicts with the Terms of service on data protection matters, this DPA prevails.

Contact

Data protection questions: privacy@hosting.kasadaai.com.