The Arabic version of this document is the authoritative legal text. This English translation is provided for convenience; in case of any discrepancy, the Arabic version prevails.
Data Processing Agreement (DPA)
Controller: [Customer legal entity], [Customer registered address] Processor: MainCore Technologies, Kingdom of Saudi Arabia Effective: 16 July 2026 Applicable: GDPR Article 28, Saudi PDPL
1. Scope
This DPA applies to Personal Data that Controller uploads to the Service and Processor processes on Controller's behalf. It supplements the Terms of Service.
2. Subject matter & duration
Subject matter: processing of Personal Data via CoreShield's Detect → Cloak → Send → Restore pipeline. Duration: the term of the underlying subscription plus any period during which residual Personal Data is retained per Section 8.
3. Nature & purpose
Processing enables Controller to use external LLMs on documents containing Personal Data without exposing that Personal Data to those LLMs. Original values are sealed in an AES-256-GCM vault; only cloaked derivatives leave Controller's environment.
4. Types of data & categories of data subjects
Types: as determined by Controller's uploads — typically names, national IDs, IBANs, medical record numbers, addresses, phone numbers, email addresses.
Data subjects: as determined by Controller — typically Controller's employees, customers, patients, counterparties, or the subjects of documents Controller processes.
5. Processor obligations
Processor will:
- (a) Process Personal Data only on Controller's documented instructions.
- (b) Ensure personnel processing Personal Data are bound by confidentiality.
- (c) Implement appropriate technical and organizational measures per Annex B.
- (d) Engage sub-processors only per Section 6.
- (e) Assist Controller in fulfilling data-subject rights (Article 12–22 GDPR / PDPL equivalents).
- (f) Notify Controller of a Personal Data Breach without undue delay, and within 72 hours where feasible.
- (g) On termination, delete or return all Personal Data per Section 8.
6. Sub-processors
Processor's sub-processor list is at Annex A. Controller consents to the current list. Processor will notify Controller of additions with 30 days' notice; Controller may object during that period.
7. Data residency & international transfers
The current pilot is hosted on Microsoft Azure (UAE North region) and processes synthetic data only — no real customer Personal Data. Real customer data will be hosted on infrastructure inside the Kingdom of Saudi Arabia. Licensed in-Kingdom cloud providers are currently under evaluation, including STC Cloud, and the final provider will be determined before any real data is processed. [OWNER DECISION: final in-Kingdom cloud provider] The migration to in-Kingdom infrastructure will be completed upon the first real customer contract, before any real customer Personal Data is processed. Where any transfer outside the in-Kingdom region occurs, it relies on EU Standard Contractual Clauses or an equivalent PDPL-approved mechanism. Under the Send verb, only cloaked text (never original values) is transmitted to the external LLM provider.
8. Return & deletion
On termination, Processor will delete Personal Data within 30 days unless Controller instructs return in a machine-readable format. Backups purge on their normal 90-day rolling cycle. Audit-chain records are retained for 7 years as required by NCA-ECC.
9. Audits
Once per year (or after a Personal Data Breach), Controller may audit Processor's controls, on 30 days' notice, at Controller's cost, subject to Processor's reasonable confidentiality and security requirements. Processor's SOC-2 Type II report (once obtained) satisfies routine audit needs.
10. Liability
Liability under this DPA is subject to the limitation of liability in the Terms of Service. Sub-processor breaches are Processor's responsibility as if committed by Processor.
Annex A — Approved sub-processors
Verified against the deployed pilot configuration on 2026-08-08. Only sub-processors genuinely in use are listed. This document requires a Saudi lawyer's sign-off before publication.
| Sub-processor | Purpose | Data category received | Hosting region |
|---|---|---|---|
| Microsoft Azure | Cloud hosting: compute (AKS), block/object storage, managed PostgreSQL, and Key Vault (encryption-key custody). All platform infrastructure runs here. | All platform data. Original personal-data values are AES-256-GCM encrypted at rest in the vault; only cloaked derivatives are processed outside the vault. | UAE North (uaenorth) — current pilot. [OWNER DECISION: production/sovereign hosting region — the pilot runs in Azure UAE North, NOT inside KSA; the intended production region is not yet deployed] |
| OpenAI | External LLM inference (model gpt-4o-mini) for the Send verb. | Cloaked text only — tokenized placeholders; never original personal-data values. | [OWNER DECISION: OpenAI API data-processing region + signed OpenAI DPA / zero-retention terms — not verifiable from our cluster; OpenAI's default API region is the United States] |
Not currently engaged (configured-capable but not wired in the deployed pilot as of 2026-08-08; must not be presented as active sub-processors until enabled): Anthropic, Google (Gemini), and Azure OpenAI (alternative LLM providers — no API keys deployed, not in AI_FALLBACK_CHAIN); AWS and STC Cloud (STC Cloud is a planned migration target only); Sentry and PostHog (no error-tracking or analytics tooling is deployed).
Annex B — Technical & organizational measures
- Encryption at rest: AES-256-GCM
- Encryption in transit: TLS 1.3+
- Access control: RBAC (12-level hierarchy), MFA required for admin roles
- Audit chain: SHA-256 hash-chain per event, Vault-Transit HMAC (HSM in Sovereign)
- Backup: daily encrypted snapshots, 30-day retention
- Incident response: 24/7 on-call rotation, incident runbook in
docs/runbooks/ - Personnel: background checks + confidentiality agreements + annual security training
- Physical: data center facilities meeting NCA ECC-2:2024 physical security requirements
Signatures
Controller: ______________________________ Date: ____________
Processor: ______________________________ Date: ____________