Data Processing Agreement

Last updated: 18 October 2026

This Data Processing Agreement covers the hosted Aicura service, the software-as-a-service platform at aicura.app that Aicura runs for its customers. It applies automatically to every customer whose personal information Aicura processes in providing that service, because it forms part of our Terms of Service. There is nothing to sign. If your organisation needs a countersigned copy for its records, email [email protected].

1. The parties

This Data Processing Agreement ("DPA") is between Aicura Pty Ltd. (ABN 85 696 789 876), of Melbourne, Victoria, Australia ("Aicura", "Processor"), and the organisation that has accepted the Terms of Service for the Aicura service ("Customer", "Controller").

It forms part of, and is subject to, the Terms of Service between the parties for the Aicura service (the "Agreement"). In the event of a conflict between this DPA and the Agreement on a matter of personal information processing, this DPA prevails.

2. Definitions

In this DPA, the following terms have these meanings.

• "Personal Information" means information about an identified or reasonably identifiable individual, and includes "personal data" as defined under the GDPR, the UK GDPR and the FADP, "personal information" as defined under the Privacy Act 1988 (Cth), and equivalent terms under other applicable laws.
• "Processing" means any operation performed on Personal Information, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure or destruction.
• "Sub-processor" means any third party engaged by Aicura to process Customer Personal Information.
• "Data Subject" means the individual to whom Personal Information relates.
• "GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom, together with the Data Protection Act 2018.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "FADP" means the Swiss Federal Act on Data Protection of 25 September 2020, and "FDPIC" means the Swiss Federal Data Protection and Information Commissioner.
• "Privacy Laws" means the Privacy Act 1988 (Cth), the GDPR, the UK GDPR, the FADP and any other data protection or privacy law that applies to either party in relation to the Customer Personal Information processed under this DPA.
• "Customer Personal Information" means Personal Information that the Customer or its authorised users upload to, generate within or otherwise make available to the Aicura service.

3. Scope and roles

This DPA applies whenever Aicura processes Customer Personal Information on behalf of the Customer in the course of providing the hosted Aicura service.

• The Customer is the Controller of Customer Personal Information. The Customer determines the purposes and means of the processing.
• Aicura is the Processor and processes Customer Personal Information only on the Customer's documented instructions, as set out in this DPA, the Agreement and the Customer's use of the Aicura service.
• For Personal Information that Aicura collects directly from the Customer's authorised users for the operation of the service (account information, sign-in details, billing records, support correspondence), Aicura acts as a Controller. That processing is governed by Aicura's Privacy Policy rather than this DPA.

4. Subject matter and details of processing

The subject matter, nature, purpose and duration of processing are as follows.

5. Aicura's obligations as Processor

Aicura will do each of the following.

1. Process Customer Personal Information only on the documented instructions of the Customer, as set out in this DPA, the Agreement and the Customer's configuration and use of the service. The Customer's instructions are limited to what is required for Aicura to provide the service.
2. Ensure that personnel authorised to process Customer Personal Information are subject to written confidentiality obligations and have received appropriate training.
3. Implement and maintain the technical and organisational security measures set out in section 7.
4. Assist the Customer, taking into account the nature of the processing, in fulfilling the Customer's obligations to respond to requests from Data Subjects under applicable Privacy Laws (see section 8).
5. Assist the Customer in meeting its own security, breach notification, data protection impact assessment and prior consultation obligations under applicable Privacy Laws, taking into account the nature of the processing and the information available to Aicura.
6. At the Customer's choice, return or delete Customer Personal Information at the end of the provision of the service, in accordance with section 9.
7. Make available to the Customer, on reasonable written request, the information necessary to demonstrate compliance with this DPA. Section 12 sets out the audit framework.
8. Not engage Sub-processors except as permitted by section 6.
9. Immediately inform the Customer if, in Aicura's opinion, an instruction from the Customer infringes applicable Privacy Laws.

6. Sub-processors

The Customer authorises Aicura to engage the Sub-processors listed in Annex A to this DPA, and any additional Sub-processors notified to the Customer in accordance with this section. Aicura will do each of the following.

1. Maintain a current list of Sub-processors at aicura.app/trust/sub-processors/.
2. Notify the Customer at least 30 days before adding or replacing a Sub-processor, by updating that page and by notice to the Customer's primary contact.
3. Impose on each Sub-processor written obligations equivalent in substance to those set out in this DPA.
4. Remain responsible for the acts and omissions of its Sub-processors as if they were the acts and omissions of Aicura.

If the Customer reasonably objects to a new Sub-processor on data protection grounds, the Customer may notify Aicura within the 30-day notice period. The parties will discuss the objection in good faith. If the parties cannot resolve the objection, the Customer may terminate the Agreement with effect from the proposed addition date by written notice, and Aicura will refund the unused portion of the current term, calculated pro rata from the date termination takes effect.

7. Security

Aicura will implement and maintain technical and organisational measures appropriate to the risk of the processing, including the measures described in this section. The current measures are summarised on the Aicura security page and include the following.

• Hosting. Primary infrastructure in AWS ap-southeast-2 (Sydney, Australia), with backups in AWS ap-southeast-4 (Melbourne, Australia), in a separate AWS account locked down for backup-only use.
• AI processing. AI inference through Amazon Bedrock in Australia, using Bedrock's Australian cross-region inference within Sydney or Melbourne, with embeddings generated in Sydney. Inputs and outputs are not used to train or improve foundation models, and model providers cannot access prompts or completions.
• Encryption in transit. TLS 1.2 minimum, TLS 1.3 preferred, on all connections over public networks and to the database and AWS services.
• Encryption at rest. AES-256 encryption using customer-managed AWS KMS keys with automatic annual rotation, held in dedicated AWS accounts separate from the application accounts, with a separate key for the Evidence Vault.
• Tenant isolation. PostgreSQL row-level security enforced on every tenant-scoped table, where the database role used by the tenant API does not have permission to bypass row-level security, and per-request storage credentials pinned to a single tenant's storage area.
• Access management. Authentication via Auth0 (Australian tenant), with multi-factor authentication enabled and prompted based on risk signals. Operator access via AWS Identity Center with federated single sign-on and multi-factor authentication. No long-lived database credentials and no public database endpoints.
• Threat detection and monitoring. AWS GuardDuty, Inspector, Security Hub, Config and CloudTrail across all production accounts, with CloudTrail logs written to a dedicated audit account that the application accounts cannot modify.
• Audit logging. Changes to tenant data recorded in a change log written in the same database transaction as each change and retained for 7 years, and authentication events exported to an AWS S3 bucket under Object Lock in compliance mode for 7 years.
• Evidence Vault. Snapshots of governance events written to a dedicated AWS S3 store under Object Lock in compliance mode for 10 years, replicated to Melbourne, so that no one, including Aicura, can change or delete a snapshot during that period.
• Backups and recovery. Point-in-time recovery on the database, and daily snapshots copied cross-region to Melbourne into a backup vault under a compliance-mode vault lock with a minimum retention of 90 days and a maximum of 7 years. Object storage is versioned and replicated to Melbourne.

Aicura will keep the measures appropriate to the risk over time, and may change specific measures provided the overall level of security is not materially diminished.

8. Assistance with Data Subject requests

Where Aicura receives a request directly from a Data Subject in relation to Customer Personal Information, Aicura will not respond directly (other than to acknowledge receipt and to direct the Data Subject to the Customer where appropriate) and will refer the request to the Customer without undue delay.

Where the Customer receives a request from a Data Subject in relation to Customer Personal Information held within the Aicura service, Aicura will, at the Customer's reasonable request, assist the Customer in responding. Standard assistance is included at no additional charge. Where assistance requires significant or recurring development effort, Aicura may charge reasonable costs, on prior written agreement with the Customer.

The Aicura service includes self-service mechanisms for the Customer to access, correct, export and delete Customer Personal Information held in the AI register, risk assessments, generated policies, support tickets and uploaded documents. The Customer is expected to use these mechanisms in the first instance.

9. Return and deletion of Personal Information

On termination or expiry of the Agreement, or on the Customer's earlier written request, the following applies.

1. Aicura will, at the Customer's election, return Customer Personal Information to the Customer or delete it. The Customer's choice must be communicated within 60 days of termination or expiry. If no choice is communicated, deletion applies.
2. Where return is elected, Aicura will provide an export of Customer Personal Information in a structured, commonly used, machine-readable format (a ZIP archive containing JSON files for each table plus the original uploaded files). Aicura will provide the export as soon as practicable, and in any case within 30 days of the request.
3. Aicura will delete Customer Personal Information held in production systems within 60 days of the cancellation, or within 30 days of an explicit deletion request, whichever is earlier.
4. AI processing logs (prompts and model output) are deleted automatically after no more than 90 days.
5. Evidence Vault snapshots are held under Object Lock in compliance mode for 10 years from when each was written and cannot be deleted by anyone, including Aicura, before that period ends. They are deleted when it ends.
6. Database backups and replicated copies of object storage held in the Melbourne backup account are not edited to remove an individual customer. They expire on their retention schedule, which is no more than 7 years. Aicura uses them only to recover the service after an incident and does not restore deleted Customer Personal Information from them for any other purpose.
7. Aicura may retain a limited set of records (audit logs, billing records, authentication audit logs) for up to 7 years where required by law, to defend against legal claims or to comply with tax obligations. Aicura will not actively process such retained records other than for those limited purposes.

10. Personal Information breach notification

Aicura will, without undue delay and in any event within 24 hours of becoming aware, notify the Customer of any actual or reasonably suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Information.

The notification will include the following, to the extent known and as it becomes available.

• the nature of the breach, including the categories and approximate number of Data Subjects and records affected
• the likely consequences of the breach
• the measures taken or proposed to address the breach, including measures to mitigate possible adverse effects
• the name and contact details of a person within Aicura from whom further information can be obtained

A full incident report will follow within 72 hours of the breach being confirmed. Aicura will cooperate with the Customer in any subsequent investigation and in the Customer's compliance with its own breach notification obligations under applicable Privacy Laws (including the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), Articles 33 and 34 of the GDPR and UK GDPR and Article 24 of the FADP).

Where Aicura itself has a notification obligation under the Notifiable Data Breaches scheme, Aicura will notify the Office of the Australian Information Commissioner directly. The Customer remains responsible for its own regulatory notifications under its own obligations.

11. International transfers

Customer Personal Information processed in the Aicura service is hosted in Australia. A small number of transactional metadata flows pass through Sub-processors located outside Australia, as listed in Annex A.

• Stripe (payment processing), United States
• Resend (transactional email delivery), Japan (AWS Tokyo, ap-northeast-1)
• Cloudflare (DNS, content delivery, web application firewall), global edge, and storage of published Trust Centre pages in Cloudflare R2, Asia-Pacific

For any transfer of Customer Personal Information outside Australia or, where applicable, outside the European Economic Area, the United Kingdom or Switzerland, the following applies.

1. Aicura will take reasonable steps to ensure that the recipient handles the Personal Information in a manner consistent with the Australian Privacy Principles, in particular APP 8.
2. Australia does not have an adequacy decision under the GDPR or the UK GDPR. Where the GDPR applies to a transfer of Customer Personal Information to Aicura, Module Two (controller to processor) of the Standard Contractual Clauses is incorporated into this DPA by reference, with the Customer as data exporter and Aicura as data importer. The selections under those clauses are set out in Annex B.
3. Where the UK GDPR applies to such a transfer, the UK Addendum is incorporated into this DPA by reference, and applies to the Standard Contractual Clauses as set out in Annex B.
4. Australia is not on the Swiss Federal Council's list of countries with adequate data protection. Where the FADP applies to such a transfer, the Standard Contractual Clauses apply to it with the Swiss amendments set out in Annex B.
5. For onward transfers to Sub-processors outside Australia, Aicura will rely on an adequacy decision or on the Sub-processor's data processing terms incorporating the Standard Contractual Clauses (with the UK Addendum or the Swiss amendments, where they apply) or another valid transfer mechanism recognised under the relevant law.
6. If there is a conflict between this DPA and the Standard Contractual Clauses, the UK Addendum or the Swiss amendments, the Standard Contractual Clauses, the UK Addendum or the Swiss amendments prevail.

12. Audits

Aicura will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, including the following.

• this DPA, the Privacy Policy, the Terms of Service, the vendor due diligence page and the other trust pages on the Aicura website
• attestations and certifications held by Aicura's underlying infrastructure providers, available through AWS Artifact under NDA
• written responses to specific reasonable questions raised by the Customer

Direct on-site or remote audits of Aicura's systems by the Customer or its auditors are not offered as standard. Where applicable Privacy Laws, the Standard Contractual Clauses or a regulator with jurisdiction over the Customer require an audit beyond what is set out above, the parties will discuss the scope, timing and cost of accommodating that requirement in good faith. Aicura may charge reasonable fees for the time and materials involved in supporting such an audit.

13. General

Term. This DPA takes effect when the Customer accepts the Agreement (or, for a customer who accepted the Agreement earlier, on 18 October 2026) and continues for the term of the Agreement, plus any periods during which Aicura retains Customer Personal Information under section 9.

Liability. The limitations and exclusions of liability set out in the Agreement apply to claims arising under or in connection with this DPA. Nothing in this DPA limits or excludes liability that cannot lawfully be limited or excluded under applicable law, or any Data Subject's rights under the Standard Contractual Clauses.

Changes. Aicura may update this DPA in the same way it may vary the Agreement, and may update Annex A in accordance with section 6. No update will reduce the overall protection this DPA gives Customer Personal Information. The "Last updated" date at the top shows the current version.

Conflict. In the event of a conflict between this DPA and the Agreement on a matter of personal information processing, this DPA prevails, subject to section 11(e).

Governing law. Except where the Standard Contractual Clauses, the UK Addendum or the Swiss amendments require otherwise, this DPA is governed by the law of Victoria, Australia. Each party submits to the exclusive jurisdiction of the courts of Victoria and the federal courts in Victoria.

Countersigned copy. This DPA binds both parties through the Agreement without a signature. Aicura will provide a countersigned copy on request to [email protected].

Annex A. Sub-processors

The sub-processors page is the authoritative, current list, and it prevails over this table if the two differ. The table shows the list as at the date at the top of this DPA. Aicura will notify the Customer at least 30 days before adding or replacing a Sub-processor.

Annex B. Standard Contractual Clauses selections

This Annex applies only where the Standard Contractual Clauses (Module Two, controller to processor) are required by applicable law to govern transfers of Customer Personal Information.

For transfers subject to the UK GDPR, the parties rely on the UK Addendum (version B1.0), which incorporates the Standard Contractual Clauses above with the modifications required for UK transfers. Table 1 of the UK Addendum is completed with the parties' details in section 1 of this DPA. Table 2 refers to Module Two with the selections above. Table 3 refers to Annexes A and B and sections 4 and 7 of this DPA. For Table 4, either party may end the UK Addendum as its Section 19 allows.

For transfers subject to the FADP, the Standard Contractual Clauses apply with the selections above and the following amendments, in line with the guidance of the FDPIC. Where a transfer is subject to both the FADP and the GDPR, these amendments apply only to the extent the transfer is subject to the FADP.

• The FDPIC is the competent supervisory authority under Clause 13 and Annex I.C for transfers subject to the FADP, alongside the authority named above where the GDPR also applies.
• References to the GDPR are to be read as references to the FADP, and references to provisions of the GDPR as references to the equivalent provisions of the FADP.
• The term "Member State" in Clause 18(c) is not to be read as excluding Data Subjects in Switzerland from bringing a claim in the place of their habitual residence in Switzerland.
• References to the European Union, the Union and EU Member States include Switzerland where needed for Data Subjects in Switzerland to exercise their rights under the Standard Contractual Clauses.