Legal

Data Processing Agreement

Last updated: June 2026

1. Overview

This Data Processing Agreement ("DPA") forms part of the service agreement between Org.Tech (operated by Mind Model AI, "Processor") and the subscribing organization ("Controller") for the provision of managed private AI infrastructure services.

This DPA sets out the terms under which we process personal data on your behalf when delivering our managed AI platform inside your network infrastructure.

2. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person that is processed as part of the services.
  • Processing: Any operation performed on personal data, including collection, storage, retrieval, use, or deletion.
  • Sub-processor: Any third party engaged by Org.Tech to assist in processing personal data on behalf of the Controller.

3. Data residency

All data processed through Org.Tech infrastructure remains within the AWS ca-central-1 region (Canada). Your data never leaves your security boundary. We do not transfer personal data outside of Canada unless explicitly authorized in writing by the Controller.

4. Processing scope

Org.Tech processes data solely for the purpose of delivering managed AI infrastructure services as described in the service agreement. This includes:

  • Operating and maintaining AI compute resources within your AWS environment
  • Managing RAG pipelines and knowledge base indexing
  • Monitoring infrastructure performance and security
  • Providing monthly optimization and security reviews

5. Security measures

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • IAM policies scoped to minimum required permissions
  • VPC isolation ensuring data stays within your network boundary
  • Regular security audits and access reviews
  • Employee access limited to authorized personnel only

6. Sub-processors

Our primary sub-processor is Amazon Web Services (AWS), which provides the underlying cloud infrastructure. All AWS services used are deployed within the Controller's own AWS account and ca-central-1 region.

We will notify you of any changes to sub-processors with reasonable advance notice.

7. Data subject rights

We will assist you in responding to data subject requests (access, correction, deletion, portability) to the extent our services are involved in processing the relevant personal data.

8. Data breach notification

In the event of a personal data breach, we will notify you without undue delay and within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and measures taken to address it.

9. Contact

For questions about this DPA or to request a signed copy, contact us at hello@org.tech.