Legal

Data Processing Addendum

Effective September 2, 2026

This Data Processing Addendum ("DPA") forms part of the agreement ("Agreement") between ABE and the customer named in an Order ("Customer") for the ABE service ("Service"), and applies wherever ABE processes Personal Data on Customer's behalf. It is incorporated by reference into every Order.

1. Definitions

"Data Protection Laws" means all laws applying to the processing of Personal Data under the Agreement, including where applicable the GDPR, the UK GDPR, and US state privacy laws. "Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in Data Protection Laws. "Customer Data" means all data, including Personal Data, that Customer makes available to the Service. "Subprocessor" means a third party ABE engages to process Customer Data.

2. Roles

Customer is the controller, or where Customer acts for its own customers, a processor, and ABE is the processor of Personal Data in Customer Data. Each party will comply with Data Protection Laws in its role.

3. Details of processing

Set out in Annex 1.

4. Customer instructions

ABE processes Customer Data only on Customer's documented instructions, which are: the Agreement, this DPA, the policies and settings Customer configures in the Service, including which projects, repositories, and paths ABE may access and what it may change, and written instructions from Customer's named contacts. ABE will tell Customer if it believes an instruction breaches Data Protection Laws. ABE does not use Customer Data to train or improve machine-learning models and does not sell it.

5. Confidentiality of personnel

ABE limits access to Customer Data to personnel who need it to provide the Service, binds them to confidentiality, and trains them on data handling.

6. Security

ABE implements the technical and organizational measures in Annex 2 and will not reduce their overall level of protection during the term.

7. Subprocessors

Customer authorizes the Subprocessors in Annex 3. ABE will give Customer at least 15 business days' written notice before adding or replacing a Subprocessor that will process Customer Data. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection within 30 days, either may terminate the affected part of the Service without penalty. ABE imposes data-protection obligations on each Subprocessor no less protective than this DPA and remains responsible for their performance.

8. Data subject requests

ABE will forward to Customer, without undue delay, any request from a data subject relating to Customer Data and will not respond except to direct the person to Customer, unless Customer instructs otherwise or the law requires. ABE will assist Customer with such requests, taking into account the nature of the processing.

9. Personal data breach

ABE will notify Customer without undue delay and within 48 hours after confirming a personal data breach affecting Customer Data, describing what is known about its nature, the categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed, and will update Customer as more becomes known. ABE will not describe the breach to third parties as Customer's without Customer's consent unless the law requires.

10. Assistance

ABE will assist Customer, at Customer's reasonable cost where the request goes beyond the Service's standard features, with data protection impact assessments, consultations with supervisory authorities, and security assessments that relate to the Service.

11. Audits

On at least 30 days' notice and no more than once per 12 months, or after a personal data breach affecting Customer Data, Customer may audit ABE's compliance with this DPA by reviewing ABE's security documentation, completing a security questionnaire, and, where those are insufficient, an on-site or remote audit during business hours under confidentiality that does not disrupt ABE's operations or expose other customers' data. Customer bears the cost of audits it conducts.

12. Deletion and return

On termination or expiry of the Agreement, and at any time on Customer's written request, ABE will within 30 days delete or return Customer Data at Customer's choice, and will delete remaining copies from backups within 90 days, unless the law requires retention, in which case ABE will isolate and protect the data and process it only for that purpose. ABE will certify deletion on request. Pull requests, branches, comments, and commits ABE delivered into Customer's own systems are Customer's to keep or delete.

13. International transfers

ABE processes Customer Data in the United States. Where Data Protection Laws restrict transfer of Personal Data to the United States, the parties enter into the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where Customer is a processor) and, for UK data, the UK International Data Transfer Addendum, which are incorporated by reference with Customer as data exporter and ABE as data importer, the optional docking clause included, the governing law and forum of Clauses 17 and 18 set to Ireland, and Annexes 1 to 3 of this DPA serving as the Clauses' annexes.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, and the parties' aggregate liability under the Agreement and this DPA together does not exceed the cap in the Agreement.

15. Precedence and term

This DPA prevails over conflicting terms of the Agreement for the processing of Personal Data. It lasts as long as ABE processes Customer Data.

Annex 1: Details of processing

Annex 2: Technical and organizational measures

1. Encryption in transit. TLS 1.2 or higher for all connections between ABE, Customer's systems, and model providers.
2. Credential protection. Connector tokens and API keys are stored encrypted at rest and scoped to the least access needed: read on repositories and trackers, write only to branches, pull requests, and comments, and never to protected branches except under a policy Customer enables.
3. Tenant isolation. Each customer runs in its own deployment with its own configuration, storage, run records, and credentials. No cross-customer caches, indexes, or prompt history.
4. Data minimization. ABE selects the minimum context for each model call rather than sending whole repositories, honors Customer's path exclusions, and applies Customer's configurable redaction patterns to ticket content before model calls.
5. Model-provider settings. ABE uses provider accounts and settings under which Customer Data is not used to train provider models. Retention at the provider is limited to what the provider's terms require for abuse monitoring. Current settings are listed in Annex 3.
6. Least-privilege execution. Workers run with only the credentials and network access their task needs. Temporary workspaces are removed after a run per the retention setting.
7. Spend and action controls. Daily and per-ticket spend ceilings, policy-gated writes, a customer-operated pause, and a global emergency stop.
8. Logging and audit. Every run keeps a record of what it did, what it found, and the policy version applied, with timestamps. Prompt-level content is retained only within run records subject to Customer's retention setting.
9. Access control. Named accounts, multi-factor authentication for ABE personnel, access reviewed quarterly, and access to Customer Data limited to support and incident response.
10. Vulnerability management. Dependencies scanned in CI, security fixes prioritized as S1 or S2 under the SLA, and penetration-test findings tracked to closure.
11. Business continuity. Daily backups of hosted state, 30-day retention, and restores tested at least annually.
12. Incident response. Documented triage, containment, notification under section 9, and post-incident review.
13. Personnel. Confidentiality obligations and data-handling training for all personnel with access.

ABE does not currently hold a SOC 2 or ISO 27001 attestation and does not represent otherwise.

Annex 3: Subprocessors

The current list is also available from ABE on request.

ABE · United States · hello@runabe.ai