Data Processing Addendum

This Data Processing Addendum (“DPA”) describes how sys9, Inc. processes personal data on your behalf when you use the Services. It supplements our Terms of Service. A signable version for production use is available on request — contact legal@sys9.ai. The summary below explains our approach.

Roles

For personal data contained in your service data, you are the controller and sys9 is the processor, acting on your documented instructions. For data we collect to run our business (such as account contacts), sys9 is the controller as described in the Privacy Policy.

Scope & purpose

We process personal data only to provide and support the Services, in line with your instructions and applicable law. We don't use your service data to build unrelated products and we don't sell it.

Nature of processing

• Subject matter: provision of the sys9 Services you use.
• Duration: for the term of your use, plus limited retention as described in the Privacy Policy.
• Data subjects & categories: determined by you, based on the data you and your agents submit.

Security

We apply technical and organizational measures appropriate to the risk, including isolation by default — edge-attached secrets (run9), per-agent vault grants (drive9), and per-tenant data branching (db9). See our security page for how these work.

Sub-processors

We use a limited set of sub-processors to operate the Services, each under confidentiality and data-protection obligations. A current list is available on request. We will give reasonable notice of new sub-processors so you can object.

Data subject requests

We will assist you, taking into account the nature of the processing, in responding to requests from data subjects to exercise their rights. Forward requests to privacy@sys9.ai.

International transfers

Where personal data is transferred across borders, we rely on appropriate safeguards as required by applicable law. We can provide details and applicable transfer mechanisms on request.

Return & deletion

On termination, you can export your data, and we will delete or return personal data as described in the Privacy Policy and any agreement between us, except where retention is required by law.

Contact

To request a signed DPA or our sub-processor list, email legal@sys9.ai.