Data Processing Agreement

Last updated · May 13, 2026

⚠

Draft. This document is a placeholder pending review by qualified counsel before any paid customer signup. Treat it as a description of intent, not a final binding agreement. Email hello@aegent.ai with questions.

This page summarizes how Ægent processes Customer Data on behalf of business customers. The full Data Processing Agreement is available on request for any customer with contractual or compliance requirements.

1. Roles

For Customer Data you upload (deal records, contacts, transcripts, recordings), you are the data controller and Ægent is the data processor. We process this data only on your documented instructions, which are reflected in your use of the Service.

2. Sub-processors

We engage the sub-processors listed in our Privacy Policy (Clerk, Supabase, Vercel, Anthropic, OpenAI, Microsoft, Salesforce). Each sub-processor is bound by terms equivalent to those in this DPA. We will provide reasonable advance notice of new sub-processors via email or in-app notification.

3. Security measures

Data encrypted in transit (TLS 1.2+) and at rest
Authentication via OAuth 2.0 / OpenID Connect (Clerk)
Role-based access control on all production systems
Audit logging on administrative actions
Incident response process for any suspected unauthorized access

4. International transfers

Customer Data may be transferred to and processed in the United States and any other jurisdiction where our sub-processors operate. For EU/UK customers, transfers are made under Standard Contractual Clauses where applicable.

5. Data subject requests

You retain the ability to access, correct, export, or delete Customer Data through the Service. For requests that require our assistance (e.g., data portability requests under GDPR), email hello@aegent.ai and we will respond within 30 days.

6. Breach notification

In the event of a confirmed personal-data breach affecting Customer Data, we will notify affected customers without undue delay and in accordance with applicable law.

7. Termination and return of data

On termination of your subscription, you may export your data via the Service for 30 days. After that, Customer Data is deleted from production systems within 30 days, with backup copies rolling off the backup retention window within an additional 30 days.

8. Audit and assurance

We do not currently hold formal third-party certifications (SOC 2, ISO 27001). On request, we will provide reasonable information necessary to demonstrate compliance with this DPA.

9. Requesting the full DPA

For the executable Data Processing Agreement (suitable for procurement and legal review), email hello@aegent.ai with the entity name and signing contact.