AIDR

Legal

Data Processing Addendum: summary (draft)

What a data processing addendum between your organization and Singularity AIDR is expected to cover. This is a summary of intent, not the contract.

Singularity Research & Development · Effective date: TBD

Draft pending legal review — effective date TBD. This page is a plain-language draft written by the product team. It has not been reviewed or approved by counsel, is not a binding contract and may change. Do not rely on it for a purchasing, legal or compliance decision, and do not send production or personal data on the strength of this page.
No executable DPA exists yet. The full template is being prepared for counsel. We cannot sign a DPA today, and this page does not create any obligation.

Roles

For dashboard records about your agents, users and security events, your organization is the controller and Singularity Research & Development acts as processor. For website enquiries and our own account administration we act as controller.

Subject matter and data

  • Purpose: operate the hosted control plane and dashboard for the agents you enroll.
  • Data subjects: your developers and administrators, and people named in event data.
  • Categories: account identifiers, agent and installation identifiers, security events (verdicts, rule identifiers and, depending on the redaction mode, hashes or text of commands, URLs and paths), audit entries and billing contacts.
  • Duration: the term of the order plus a deletion or return period to be agreed.

What the template is expected to commit us to

  • Process personal data only on your documented instructions.
  • Keep personnel with access bound to confidentiality.
  • Apply the technical and organizational measures summarised on the security page, and no more than is true today.
  • Use only the providers on the subprocessor list, and give notice of changes. The notice period and objection process are to be agreed.
  • Help with data-subject requests and with your assessments, within reasonable limits.
  • Notify you of a personal-data breach without undue delay. The target time is to be agreed.
  • Return or delete your data at the end of the service, subject to backup expiry.
  • Allow reasonable audits or provide equivalent information.

International transfers and residency

Provider regions are not yet confirmed and regional placement (EU, US, APAC) is not available. Transfer mechanisms such as standard contractual clauses will be attached once the regions and providers are final.

Requesting the template

If your procurement process needs the DPA template, or a security and privacy questionnaire answered, ask via the legal contact. We will say plainly which answers are not yet available.