Xnode Cortx Data Processing Addendum

1. How Xnode Cortx handles data

1.1 Customer Data stays in the Customer Environment. Xnode Cortx is software that Customer deploys and operates in its own Customer Environment. Prompts, AI Output, documents, knowledge bases, audit logs and other Customer Data are processed and stored there, and in the Models Customer chooses to connect. XNODE has no standing access to the Customer Environment.

1.2 When XNODE processes Customer Personal Data. XNODE processes Customer Personal Data only in these situations:

1. Support Access: when Customer grants XNODE access to the Customer Environment for installation, support or troubleshooting, for the duration of that access;
2. Support Materials: when Customer sends XNODE logs, screenshots, files or other materials in a support request; and
3. Account and Usage Data: when XNODE receives Authorized User and administrator identifiers and contact details as part of license administration, Usage Data under Section 5.4 of the Agreement, and service notifications.

1.3 Scope. This DPA applies only to Customer Personal Data that XNODE processes in the situations in Section 1.2. Processing that Customer performs with the Software in the Customer Environment is Customer's own processing and is not processing by XNODE.

2. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

1. "Applicable Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA"), and other US state privacy laws.
2. "Customer Personal Data" means Personal Data that XNODE processes on Customer's behalf under the Agreement in the situations described in Section 1.2.
3. "Personal Data" means information relating to an identified or identifiable natural person, or that is otherwise "personal data" or "personal information" under Applicable Data Protection Laws.
4. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while in XNODE's possession or under XNODE's control.
5. "Sub-processor" means a third party that XNODE engages to process Customer Personal Data.
6. "Standard Contractual Clauses" or "SCCs" means the clauses adopted by the European Commission in Decision (EU) 2021/914.
7. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
8. "Controller", "processor", "data subject", "processing", "business", "service provider" and "supervisory authority" have the meanings given in Applicable Data Protection Laws.

3. Roles and instructions

3.1 Roles. Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own controllers, and XNODE is Customer's processor or sub-processor. For the CCPA, Customer is the business and XNODE is the service provider.

3.2 Instructions. XNODE will process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and the instructions Customer gives when it grants Support Access or submits a support request. XNODE will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, unless the law prohibits that notice.

3.3 CCPA. XNODE will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; or combine it with Personal Data XNODE receives from others, except as the CCPA permits. XNODE will notify Customer if it can no longer meet its obligations under the CCPA. XNODE understands and will comply with these restrictions.

3.4 Details of processing. The subject matter, nature, purpose and duration of processing, and the categories of Personal Data and data subjects, are set out in Annex 1.

4. No model training

XNODE will not use Customer Personal Data or any other Customer Data to train, retrain, fine tune or otherwise improve any machine learning model, whether owned by XNODE or a third party, and will contractually prohibit its Sub-processors from doing so. XNODE will not sell, license or disclose Customer Personal Data for advertising or analytics. Any training or fine tuning that Customer performs with Models it connects to the Software is Customer's own activity and outside this DPA.

5. XNODE's obligations

5.1 Confidentiality. XNODE will ensure that personnel who process Customer Personal Data are bound by confidentiality obligations and have received appropriate data protection training.

5.2 Security. XNODE will implement and maintain the technical and organizational measures in Annex 2. XNODE may update those measures, provided the updates do not materially reduce the overall protection of Customer Personal Data.

5.3 Support Access. XNODE will use Support Access only as Customer directs and for the purpose for which Customer granted it, will access only what is reasonably needed for that purpose, and will not copy Customer Personal Data out of the Customer Environment except as needed to resolve the support request.

5.4 Data subject requests. If XNODE receives a request from a data subject relating to Customer Personal Data, XNODE will promptly forward it to Customer and will not respond except to acknowledge receipt, unless Customer authorizes it. Taking into account the nature of the processing, XNODE will give Customer reasonable assistance in responding to data subject requests.

5.5 Assessments and AI transparency. On reasonable request, XNODE will give Customer information reasonably available to XNODE to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities, and to meet its transparency obligations for automated decision making under Applicable Data Protection Laws and AI-specific laws. The Software provides audit logging and human review controls that Customer can configure in the Customer Environment; Customer is responsible for configuring and operating them and for responding to data subjects.

6. Customer's obligations

Customer will (a) have a lawful basis and provide any notices and obtain any consents required for XNODE's processing under this DPA; (b) ensure its instructions comply with Applicable Data Protection Laws; (c) share with XNODE, in Support Materials and through Support Access, only the Personal Data reasonably needed to resolve the support request; (d) not provide XNODE with special categories of Personal Data or protected health information unless the parties first sign a business associate agreement or other written terms covering that data; and (e) be responsible for the security, configuration and processing of Customer Data in the Customer Environment, including access controls, retention settings and human review of AI Output.

7. Sub-processors

7.1 Authorization. Customer gives XNODE general authorization to engage Sub-processors. The current list is in Annex 3.

7.2 Flow down. XNODE will impose on each Sub-processor written data protection obligations no less protective than this DPA, including the prohibition on model training in Section 4, and remains responsible for each Sub-processor's performance.

7.3 Changes. XNODE will give at least 30 days' notice before adding or replacing a Sub-processor, by updating Annex 3 and notifying customers who subscribe to updates at legal@xnode.ai. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Order, and XNODE will refund prepaid fees for the remaining Subscription Term of that Order. For the SCCs, this Section 7 applies under Clause 9(a), Option 2.

8. Personal Data Breaches

8.1 Notice. XNODE will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. XNODE will provide further information as it becomes available.

8.2 Cooperation. XNODE will take reasonable steps to contain and remediate the breach and will reasonably cooperate with Customer's investigation and notifications. XNODE's notice of a breach is not an acknowledgment of fault or liability.

8.3 Incidents in the Customer Environment. Security incidents in the Customer Environment are Customer's responsibility. Customer will promptly notify XNODE of any incident that affects the Software or its License Keys, and XNODE will provide reasonable support under the Agreement.

9. Government requests

If XNODE receives a legally binding request from a public authority for Customer Personal Data, XNODE will, unless legally prohibited, promptly notify Customer; challenge the request where it has reasonable grounds to believe it is unlawful; disclose only the minimum required; and document the request and its response. XNODE will not voluntarily disclose Customer Personal Data to any public authority.

10. International transfers

10.1 Locations. XNODE and its Sub-processors process Customer Personal Data in the locations listed in Annexes 1 and 3. XNODE will not transfer Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision except under the mechanisms in this Section 10.

10.2 EU transfers. The SCCs are incorporated into this DPA and apply to those transfers, with Customer as data exporter and XNODE as data importer, as follows: Module Two applies where Customer is a controller, and Module Three where Customer is a processor; Clause 7 (docking clause) applies; under Clause 9(a), Option 2 applies with the notice period in Section 7.3; the optional language in Clause 11(a) does not apply; under Clause 17, the governing law is the law of Ireland; under Clause 18(b), the courts are those of Ireland; and Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.

10.3 UK transfers. The UK Addendum is incorporated into this DPA and applies to transfers subject to the UK GDPR. Table 1 is completed with the parties' details in Annex 1, Tables 2 and 3 are completed by Section 10.2 and Annexes 1 to 3, and for Table 4 either party may end the UK Addendum as set out in its Section 19.

10.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply as set out in Section 10.2, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and the term "Member State" read to allow data subjects in Switzerland to bring claims in their place of habitual residence.

10.5 Conflict. If the SCCs or the UK Addendum conflict with this DPA, the SCCs or the UK Addendum prevail for the transfers they govern.

11. Audits

11.1 Reports. On written request, and subject to confidentiality obligations, XNODE will provide its most recent SOC 2 Type II report, its ISO/IEC 27001 and ISO/IEC 42001 certificates, a summary of its most recent third party penetration test, and responses to one reasonable security questionnaire per year. Customer agrees that these materials will be used first to demonstrate XNODE's compliance with this DPA.

11.2 Audits. If those materials are not reasonably sufficient to demonstrate compliance, or a supervisory authority requires it, or following a Personal Data Breach, Customer may audit XNODE's compliance with this DPA, no more than once in any 12 month period (except as a supervisory authority requires or following a Personal Data Breach), on at least 30 days' written notice, during normal business hours, and at Customer's cost unless the audit finds material non-compliance. Audits will not include access to XNODE's source code, other customers' information, or information subject to legal privilege. Customer may use an independent auditor bound by confidentiality who is not a competitor of XNODE.

12. Return and deletion

Within 30 days after the end of the Agreement, XNODE will delete Customer Personal Data in its possession, including Support Materials, or return it if Customer asks before the end of that period, and will certify deletion on request. XNODE may keep copies that the law requires it to retain, and copies in routine backups until they are overwritten in the ordinary course, in each case kept confidential and not otherwise processed. Customer is responsible for deleting Customer Data in the Customer Environment.

13. Liability

Each party's liability arising out of or relating to this DPA, including under the SCCs and the UK Addendum to the extent permitted by Applicable Data Protection Laws, is subject to the exclusions and limitations of liability in the Agreement, and this DPA does not create any separate or additional liability. Nothing in this Section limits the rights of data subjects under the SCCs or the UK Addendum.

14. Term, precedence and changes

14.1 Term. This DPA applies for as long as XNODE processes Customer Personal Data and survives the end of the Agreement until that processing ends.

14.2 Precedence. For the processing of Customer Personal Data, the order of precedence is the SCCs and UK Addendum (for transfers they govern), then this DPA, then the Agreement. In all other respects, including liability, the Agreement governs.

14.3 Changes. XNODE may update this DPA by posting a new version at this page. Updates apply to new Orders and renewals, except that XNODE may make changes required by Applicable Data Protection Laws or a supervisory authority at any time, provided they do not materially reduce the protection of Customer Personal Data.

14.4 Health information. This DPA does not cover protected health information under HIPAA. XNODE will consider entering into a business associate agreement on request.

14.5 Contact. Questions about this DPA, notices under it, and requests for Annex 3 updates go to legal@xnode.ai.

Annexes

Annex 1: Details of processing

Annex 2: Technical and organizational measures

XNODE's measures (for Customer Personal Data in XNODE's possession and for Support Access):

• Security program: an information security management system certified to ISO/IEC 27001, an AI management system certified to ISO/IEC 42001:2023, and an annual SOC 2 Type II examination.
• Access control: role based access on a least privilege basis; multi-factor authentication for XNODE personnel on systems that hold Customer Personal Data; access removed promptly when personnel leave or change roles.
• Support Access: only through a session Customer approves, limited to named XNODE personnel, and logged.
• Encryption: Customer Personal Data encrypted in transit with TLS 1.2 or higher and at rest with AES-256 or equivalent on XNODE systems.
• Personnel: confidentiality agreements, security and privacy training at hire and annually, and background checks where permitted by law for personnel with access to Customer Personal Data.
• Secure development: secure software development practices, digitally signed container images and Helm charts, a software bill of materials on request, vulnerability management, and an annual third party penetration test.
• Incident response: a documented incident response plan with defined escalation, tested at least annually.
• Deletion: secure deletion of Support Materials under the retention periods in Annex 1.

Controls available to Customer in the Software (configured and operated by Customer in the Customer Environment): role based access control; single sign-on through SAML or OIDC; audit logging of AI requests and administrative actions; configurable retention for AI interaction logs; guardrails, data loss prevention policies and human approval workflows; and deployment options including air-gapped environments with offline license validation.

Annex 3: Sub-processors

Cloud hosting. XNODE hosts its license service and support systems with one or more of the cloud hosting providers listed above, in United States regions, and may move between them without further notice under Section 7.3. Each is bound by the obligations in Section 7.2, including the prohibition on model training. XNODE currently uses Microsoft Azure.

XNODE's affiliate Xnode AI Private Limited (Hyderabad, India) provides engineering and support services and may process Customer Personal Data during Support Access and in Support Materials. Models that Customer connects to the Software are Customer's own providers, not XNODE Sub-processors.