Enterprise Data Processing Addendum (DPA)

Data Processing & Architecture Standards

Transparent breakdown of enterprise data flows, model inference isolation, Indian data localization, sub-processors, and Technical & Organizational Measures (TOMs).

Indian Data Localization

Primary database clusters, vector embeddings, and tenant assets are hosted within the sovereign territory of India, aligned with MeitY and DPDP guidelines.

Zero Public AI Model Training

Customer prompts, conversation history, and uploaded knowledge base documents are strictly segregated and NEVER used to train or refine public baseline AI models.

PostgreSQL RLS Isolation

Multi-tenant architecture enforces PostgreSQL Row-Level Security (RLS) dynamically locked to app.current_tenant on every single database transaction.

1. Scope & Processing Roles

For enterprise workspaces, the Customer acts as the Data Fiduciary determining the purposes and lawful bases of its team members' data. Xarwiz Technologies LLP acts as the Data Processor executing operations strictly on documented instructions from the Customer.

2. Technical & Organizational Measures (TOMs)

Encryption in Transit: Mandatory TLS 1.3 encryption across all public APIs and internal microservice channels.

Encryption at Rest: AES-256 storage volume encryption and AES-GCM envelope encryption for stored workspace credentials.

Multi-Tenant Scoping: PostgreSQL Row-Level Security (RLS) policies enforced on all user, conversation, document, and consent tables.

Access Control: Role-Based Access Control (RBAC), multi-factor authentication (MFA), and automated session timeout policies.

Vulnerability Management: Automated dependency auditing, regular static code analysis (SAST), and independent penetration testing.

Incident Notification: Mandatory reporting to CERT-In within 6 hours and customer breach notification without undue delay.

3. Verified Sub-Processors

Sub-Processor	Purpose	Location	Data Transferred
Google Cloud Platform (GCP)	Cloud VM & Database Hosting	India (asia-south2)	Encrypted application data & database volumes
Ollama Local Inference	On-Premise / Local LLM Inference	India (Self-Hosted)	Ephemeral prompt inputs (zero persistent storage)
Razorpay / Cashfree / PhonePe	Payment Processing & Invoicing	India	Billing customer name, email, order amount
Resend	Transactional Email Delivery	Cloud (Global)	Recipient email, verification & privacy alert links

Access Data Principal Rights Portal →