Last updated: September 4, 2026 · Version 2.1 (Zero-Storage Processing Model)
Effective date: August 5, 2026
This Data Processing Addendum ("DPA") is entered into between the customer entity identified in the main Service Agreement ("Controller") and Tuteliq AB, Organization Number 5594811217, Sweden, with a UK establishment (number BR028608) at 3rd Floor, Elite House, 60 Rodney Street, Liverpool, L1 9AD, United Kingdom, email dpo@tuteliq.ai ("Processor" or "Tuteliq"). This DPA supplements the Terms of Service and constitutes a binding agreement for all personal data processing by Tuteliq on behalf of the Controller.
1. Tuteliq's Zero-Storage Processing Model
1.1 What This DPA Covers
This DPA governs Tuteliq's processing of personal data on the Controller's behalf, built around one fundamental principle: Tuteliq does not store any customer data.
1.2 The Processing Model
What happens:
- Controller submits content (text, images, audio, video) containing personal data via an encrypted API.
- Tuteliq receives and processes the content in real time using AI detection.
- Tuteliq generates results (an incident report with detection findings).
- Tuteliq encrypts the results using the Controller's private key.
- Tuteliq returns encrypted incidents to the Controller.
- Tuteliq deletes the original content immediately after processing.
- Tuteliq never retains, backs up, or stores any customer data.
What this means:
- Original customer data is deleted immediately after processing.
- Incident reports are encrypted to the Controller; the Controller stores them, not Tuteliq.
- Only the Controller has the private key; Tuteliq cannot decrypt incidents.
- Customer content retention is zero days (immediate deletion). Incident metadata is stored only where the Controller enables incident logging.
- Customer data never enters backup systems.
- Training on customer data is impossible, since none is retained.
1.3 Subject Matter and Duration of Processing
Processing type: real-time content analysis for threat detection, immediate generation of incident reports, immediate deletion of analyzed content.
Processing duration: processing time is milliseconds (real time); content retention is 0 seconds (deleted immediately after processing); incident generation occurs within seconds; the DPA runs from service start until termination.
1.4 Nature of Processing
What is processed: text content (messages, posts, comments), audio/voice data (calls, voice messages), images (photos, screenshots, graphics), and video data (videos, livestreams, recordings).
How it is processed: intake via encrypted API, real-time AI detection, threat assessment, incident generation, immediate deletion of original content.
Processing types: collection (intake via API), analysis (AI/detection), result generation (incident creation), encryption (with Controller's key), return (send to Controller), erasure (immediate deletion).
1.5 Types of Personal Data Processed
Data categories that may be included in submitted content:
- Identifiers: usernames, IDs, email addresses, phone numbers
- Content data: text, audio, images, video
- Metadata: timestamps, locations, device types
- Behavioral data: usage patterns, interactions
- Special categories: health information, beliefs (if present in submitted content)
Important: this data is processed only while analyzing content and is deleted immediately after generating results.
2. Processing Instructions and Limitations
2.1 Processing Scope
The Processor shall:
- Process only as instructed by Controller via the Terms of Service
- Analyze submitted content in real time for threat detection
- Generate incident reports with detection results
- Return encrypted incidents using Controller's private key
- Delete all original content immediately after processing
- Not expand processing without written authorization
2.2 What Processor Will Not Do
The Processor explicitly does not:
- Store customer data (content is deleted immediately)
- Back up customer content
- Use customer data for training purposes
- Share customer data with third parties for secondary purposes
- Perform profiling or behavioral analysis on customers
- Retain data beyond immediate processing
- Decrypt incident reports (Controller has the key)
2.3 Authorized Processing Activities
The Controller authorizes the Processor to:
- Receive content via encrypted API
- Perform real-time AI-based threat detection
- Generate incident reports (detection results)
- Encrypt incidents with the Controller's private key
- Return encrypted incidents to the Controller
- Delete original content immediately
3. Processor Obligations
3.1 Confidentiality
- Ensure all staff with access to systems sign confidentiality agreements
- Limit access to authorized personnel only
- Maintain confidentiality even after employment ends
- Provide annual privacy/security training
- Treat information with reasonable care
Since Tuteliq does not retain customer data, confidentiality applies to system access and configuration, incident encryption/decryption processes, customer account information, and audit logs and metadata.
3.2 Security Measures (Article 32)
Encryption
- Data in transit: TLS 1.3, with TLS 1.2 enforced as the minimum (256-bit minimum), all API communications encrypted, end-to-end encryption for content submission
- Data at rest: AES-256 across the database and storage layer; identity verification PII and billing details additionally encrypted at the application layer with AES-256-GCM keys held outside the database; customer content is not stored at all
- Incidents encrypted with the customer's private key; only the customer can decrypt (Processor never has the key)
Access Controls & Infrastructure
- Role-based access control (RBAC) and multi-factor authentication for admin access
- Principle of least privilege; automatic session timeout after 30 minutes of inactivity by default (users may optionally extend their own session to 12 hours on their device); audit logging of all access
- Firewalls, DDoS protection, intrusion detection, 24/7 monitoring, secure data center facilities, regular penetration testing
Testing and Certification
- Annual penetration testing
- Quarterly vulnerability scanning
- SOC 2 Type II attestation (in progress, not yet issued)
- ISO 27001 certification (in progress, not yet issued)
- Regular security assessments
3.3 Sub-Processors (Article 28(2)-(4))
Current sub-processors:
Sub-processor
Purpose
Location
Data retention
Google Cloud Platform
Infrastructure hosting and LLM inference
Frankfurt, DE (EU)
Zero customer data
Upstash
Redis caching and rate limiting
EU (GCP Belgium)
Ephemeral, auto-expired
Supabase
Database and hosting for the customer account dashboard, including billing/subscription state
Stripe
Payment processing
Ireland (EU), US operations
Billing data only
All sub-processors process customer data using the same zero-storage model: real-time processing only, immediate deletion of customer data, no retention or backup of customer content.
Sub-processor DPAs
- All sub-processors have signed Data Processing Agreements
- All require security equivalent to the Processor
- All are restricted to specified purposes only
- All are prohibited from further data sharing
Current list: tuteliq.ai/legal/subprocessors
Adding New Sub-Processors
- Processor notifies Controller (30 days advance notice)
- Notification includes: name, location, function, security measures
- Controller has 30 days to object
- No objection means approval
- Objection means the customer may terminate (30 days notice, no penalty)
3.4 Assistance with Data Subject Rights
Since the Processor deletes customer data immediately, assistance focuses on the following:
Right of Access (Article 15)
Controller may request what personal data the Processor has. Since content is deleted immediately, the response is "no customer content retained." Account information can be accessed. Incident reports are stored by the Controller, not the Processor.
Right to Rectification (Article 16)
The Processor can correct account information within 5 days. No customer data is retained to rectify. Incident reports are managed and corrected by the Controller.
Right to Erasure (Article 17)
Already done by default: the Processor deletes content immediately, so no additional deletion is needed. Account data is deleted within 30 days of a request, with confirmation provided within 30 days.
Right to Restriction (Article 18)
Not applicable to content, since it is already deleted. Account data can be restricted if needed.
Right to Portability (Article 20)
The Controller's account data is portable within 30 days. Customer content is already deleted and unavailable. Incidents are managed by the Controller's own incident data.
Right to Object (Article 21)
Data subjects may object to processing. Processing based on a law enforcement need may continue; processing based on legitimate interest is reviewed upon objection.
3.5 Breach Notification (Article 33/34)
If a security incident occurs:
- Notification timeline: without undue delay and within 72 hours of becoming aware
- Content: nature, scope, likely consequences, mitigation measures
- Cooperation: full investigation and updates provided
- Remediation: corrective actions implemented immediately
Mitigating Factors for Customer Data
Since the Processor deletes content immediately:
- If a breach is discovered after deletion, no customer content is exposed
- The Processor has no customer data to breach in most scenarios
- An account data breach is separate from content processing
- Incidents are encrypted and only decryptable by the customer (Tuteliq has no key)
4. Data Protection Officer and Contact
Data Protection Officer
Email: dpo@tuteliq.ai Response: within 10 business days (30 days maximum) Available for all GDPR inquiries
Support
Email: support@tuteliq.ai Portal: tuteliq.ai/support
Legal
Email: legal@tuteliq.ai
5. Deletion and Return of Data
5.1 Customer Content: Immediate Deletion
During processing, original content is processed and deleted within milliseconds. It is never stored on Tuteliq systems, never backed up, and never retained.
5.2 Incident Reports
Incident reports are encrypted with the Controller's key. The Processor sends them to the Controller and does not store them; the Controller manages incident storage.
5.3 Account Data Upon Termination
Timeline: account data is deleted within 30 days; backups are purged within 60 days; a written certificate is provided.
Method: cryptographic erasure and physical destruction, secure and irreversible deletion, backup purge after the retention period.
6. Audit Rights and Compliance
6.1 Customer Audit Rights
Documentation review: processing records available within 20 days; security policies and certifications; staff training records; compliance documentation.
On-site audits: one audit per year included; 30 days' notice required; Processor covers costs; subsequent audits are covered by the customer's travel/time.
Third-party audits: authorized auditors may conduct audits, must sign an NDA, with scope defined in advance.
6.2 Compliance Verification
Processor provides:
- Annual compliance certification
- SOC 2 Type II audit reports (in progress)
- ISO 27001 certificate (in progress)
- Attestations of GDPR compliance
7. International Data Transfers
7.1 Data Residency
All data processing occurs in the EU/EEA; infrastructure is located in the EU; there are no transfers outside the EU/EEA except sub-processors with SCCs.
Current locations: Google Cloud Platform (Frankfurt, Germany, EU); Supabase (Frankfurt, Germany, EU); Stripe (Ireland, EU, with US operations and an EU representative).
7.2 Transfers Outside EU/EEA
For necessary transfers, Standard Contractual Clauses (SCCs) are in place, with supplementary safeguards implemented, in compliance with GDPR Chapter 5.
Current status: minimal transfers, primarily Stripe for payment processing.
8. Term and Termination
8.1 Term
Effective upon service agreement execution; continues for the service duration; ends when all data is deleted (which happens immediately).
8.2 Termination Rights
By Controller: if the Processor breaches material obligations (30 days cure period after notice), immediate termination for security breaches, no penalty on early termination.
By Processor: if law prevents continued processing, or performing obligations becomes impossible, with 30 days notice to the Controller.
8.3 Effects of Termination
Processing stops immediately; account data is deleted within 30 days; written confirmation is provided; cooperation continues for wind-down.
9. Liability and Governing Law
9.1 Processor Liability
Subject to the liability caps in the Service Agreement: maximum of 12 months of fees paid, or $100 USD, whichever is greater, except for gross negligence, willful misconduct, fraud, or security breaches.
9.2 Shared Responsibility
The Processor is not liable for:
- Harm from the Controller's failure to secure API credentials
- Consequences of Controller delays in breach notification
- Regulatory fines where the Controller is co-responsible
- Actions based on the Controller's improper instructions
9.3 Governing Law and Jurisdiction
This DPA is governed by the laws of Sweden, without regard to its conflict-of-laws principles. Any dispute arising out of or in connection with this DPA, including any question regarding its existence, validity, or termination, shall be submitted to the exclusive jurisdiction of Gävle tingsrätt (Gävle District Court) as court of first instance.
10. Entire Agreement and Amendments
10.1 Incorporation
This DPA, together with the Service Agreement, constitutes the entire data processing agreement.
10.2 Amendments
- The Processor may amend to comply with law (30 days notice)
- Material changes require Controller consent
- GDPR always takes precedence
Appendix A: Sub-Processors
See the current, maintained list at tuteliq.ai/legal/subprocessors (also available as a static page at /legal/subprocessors.html).
Appendix B: Processing Summary
Customer Data Processing
- Type: real-time content analysis
- Duration: milliseconds (processing time only)
- Retention: zero (immediate deletion)
- Backup: no customer data in backups
- Training: no training on customer data
- Sharing: no sharing with third parties
Account Data Processing
- Type: account management, billing
- Duration: subscription + 30 days
- Retention: necessary for operations
- Backup: standard backups with encryption
- Sharing: only sub-processors (under DPA)
Request a Signed DPA
Enterprise customers can request a signed copy of this DPA.
Data Protection Officer: dpo@tuteliq.ai
Legal: legal@tuteliq.ai
Frequently asked questions
Who is the controller and who is the processor under this DPA?
The customer entity identified in the Terms of Service is the Data Controller and determines the purposes and means of processing. Tuteliq AB acts as the Data Processor, processing personal data strictly on the Controller's documented instructions.
Does Tuteliq store the content submitted for analysis?
No. Tuteliq operates a zero-storage processing model. Submitted content is analyzed in real time, an incident report is generated and encrypted with the Controller's private key, and the original content is deleted immediately after processing. Tuteliq never retains, backs up, or trains on customer content.
Who can decrypt the incident reports Tuteliq returns?
Only the Controller. Incidents are encrypted using the Controller's private key before being returned, and Tuteliq never holds that key, so it cannot decrypt incident reports.
Where is data processed and who are the sub-processors?
Sub-processors are Google Cloud Platform (Frankfurt, DE), Upstash (EU, GCP Belgium), Supabase (Frankfurt, DE) and Stripe (Ireland/US). The current list is published at tuteliq.ai/legal/subprocessors. Customers receive 30 days' advance notice of any new sub-processor and can object under this DPA.
How can I execute this DPA?
The DPA is available for e-signature via your Tuteliq dashboard on Business and Enterprise plans, or can be countersigned as a standalone document by contacting dpo@tuteliq.ai.