org.tech / Legal / Data Processing Agreement

Data Processing Agreement

How we handle and protect your data as a managed AI service provider, and the terms that apply when we process personal data on your behalf.

Last updated June 2026

1. Overview

This Data Processing Agreement ("DPA") forms part of the service agreement between Org.Tech (operated by Mind Model AI Inc., "Processor") and the subscribing organization ("Controller") for the provision of managed private AI infrastructure services.

This DPA sets out the terms under which we process personal data on your behalf when delivering our managed AI platform within the AWS environment you control.

2. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person that is processed as part of the services.
  • Processing: Any operation performed on personal data, including collection, storage, retrieval, use, or deletion.
  • Sub-processor: Any third party engaged by Org.Tech to assist in processing personal data on behalf of the Controller.

3. Data residency

Data at rest is stored in the AWS region selected for your deployment. Inference is processed by the managed AI model service and, unless your deployment is pinned to a region, may be processed in another region. We do not transfer personal data outside the region configured for your deployment unless explicitly authorized in writing by the Controller, or as required for the managed model service to process an inference request as described above.

4. Processing scope

Org.Tech processes data solely for the purpose of delivering managed AI infrastructure services as described in the service agreement. This includes:

  • Operating and maintaining AI compute resources within your AWS environment
  • Managing RAG pipelines and knowledge base indexing
  • Monitoring infrastructure performance and security
  • Providing monthly optimization and security reviews

5. Security measures

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • IAM policies scoped to minimum required permissions
  • Private network endpoints for inference, available on Standard and Strict tier deployments, keeping inference traffic off the public internet within the AWS environment you control; Baseline tier deployments connect to the managed model service over its public endpoint with TLS in transit
  • Regular security audits and access reviews
  • Employee access limited to authorized personnel only

6. Sub-processors

Our primary sub-processor is Amazon Web Services (AWS), which provides the underlying cloud infrastructure. All AWS services used are deployed within the Controller's own AWS account, in the AWS region configured for the Controller's deployment.

We will notify you of any changes to sub-processors with reasonable advance notice.

7. Data subject rights

We will assist you in responding to data subject requests (access, correction, deletion, portability) to the extent our services are involved in processing the relevant personal data.

8. Data breach notification

In the event of a personal data breach, we will notify you without undue delay and within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and measures taken to address it.

9. Contact

For questions about this DPA or to request a signed copy, contact us at hello@org.tech.