Parties
This Data Processing Agreement ("DPA") forms part of the agreement for SynkVault services ("Agreement") between:
- Cybernetic Labs Ltd, a company registered in England & Wales ("Processor", "SynkVault"); and
- The customer identified in the Agreement ("Controller", "Customer").
It reflects the requirements of Article 28(3) UK GDPR and, where the Customer is established in the EEA, Article 28(3) EU GDPR.
1. Definitions
Terms such as "personal data", "processing", "data subject", "personal data breach", "supervisory authority" have the meanings given in the UK GDPR / EU GDPR. "Sub-processor" means any third party engaged by SynkVault to process Customer Personal Data.
2. Subject Matter, Nature and Purpose of Processing (Art. 28(3) chapeau)
| Item | Description |
|---|---|
| Subject matter | Provision of the SynkVault ontology-based knowledge platform: document ingestion, knowledge-graph construction, semantic search, AI-assisted classification/extraction/insights, and conversational access to tenant knowledge. |
| Duration | Term of the Agreement, plus the deletion period in §10. |
| Nature of processing | Storage, structuring, indexing, retrieval, OCR, AI/LLM analysis (classification, extraction, summarisation, chat), backup, deletion. |
| Purpose | Solely to provide and support the services per the Customer's documented instructions; no processing for SynkVault's own purposes. |
2.1 Categories of Data Subjects
Employees, contractors and other authorised users of the Customer; and any individuals whose personal data appears in content the Customer uploads (e.g. persons named in documents, emails, or web captures via the SynkVault Chrome extension).
2.2 Categories of Personal Data
- Account data: name, email, organisation membership, role, authentication identifiers (Supabase Auth), TOTP MFA enrolment status.
- Content data: any personal data contained in documents, knowledge-base entries, graph entities, search indexes and conversation history the Customer submits. The Customer controls what it uploads.
- Usage/telemetry data: application performance and error telemetry (New Relic, EU ingest), server logs.
- Special categories: not required by the service. The Customer must not upload special-category data unless expressly agreed.
3. Processor Obligations — Documented Instructions (Art. 28(3)(a))
SynkVault shall process Customer Personal Data only on the Customer's documented instructions (the Agreement, this DPA, and use of product controls), including with regard to international transfers, unless required by UK/EU law — in which case SynkVault will inform the Customer before processing unless the law prohibits it.
4. Confidentiality (Art. 28(3)(b))
Personnel authorised to process Customer Personal Data are bound by contractual confidentiality obligations or an appropriate statutory duty.
5. Security of Processing (Art. 28(3)(c), Art. 32) — see Annex II
SynkVault implements the technical and organisational measures set out in Annex II, which reflect the measures deployed as of 2026-07-27.
6. Sub-processors (Art. 28(3)(d), 28(2), 28(4))
- The Customer grants general written authorisation for the sub-processors set out in the sub-processor register.
- SynkVault will give at least thirty (30) days' notice of intended additions/replacements; the Customer may object on reasonable data-protection grounds.
- SynkVault imposes data-protection obligations on each sub-processor equivalent to this DPA and remains liable for their performance.
7. Assistance with Data Subject Rights (Art. 28(3)(e))
SynkVault will assist the Customer, insofar as possible, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).
SynkVault provides the Customer's administrators with controls to delete user accounts and to delete an organisation and its associated tenant data, and supports export of knowledge-base content. Where a request cannot be fulfilled through these controls, SynkVault will provide reasonable assistance on request.
Response commitment: SynkVault forwards any request it receives directly to the Customer without undue delay and assists within ten (10) business days, in any case supporting the Customer's statutory one-month deadline.
8. Personal Data Breach Notification (Art. 28(3)(f), Art. 33)
SynkVault will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and no later than seventy-two (72) hours, providing the information reasonably required for the Customer's Art. 33/34 obligations.
9. DPIA and Prior-Consultation Assistance (Art. 28(3)(f))
SynkVault will provide reasonable assistance with Customer data protection impact assessments and consultations with the ICO or other supervisory authorities, taking into account the nature of processing and information available to SynkVault.
10. Deletion or Return of Data (Art. 28(3)(g))
On termination, SynkVault will, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies unless UK/EU law requires storage.
- Organisation deletion removes Supabase rows and the tenant's SurrealDB namespace.
- Trash retention is configurable (
organization_preferences.trash_retention_days) with a server purge stage. - Managed backups: Supabase PRO daily backups (confirmed running). Deleted data persists in backups until backup expiry.
11. Audits and Information (Art. 28(3)(h))
SynkVault will make available information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by the Customer or its mandated auditor, subject to reasonable notice, frequency limits of once per twelve (12) months, confidentiality, and no access to other customers' data. Where available, SynkVault may satisfy audit requests by providing third-party certifications or reports.
12. International Transfers — see Annex I §C
Customer Personal Data is stored in the UK and EEA (see Annex I). SynkVault shall not transfer Customer Personal Data outside the UK/EEA except (a) to sub-processors in the sub-processor register under a valid transfer mechanism (UK IDTA / UK Addendum to EU SCCs / adequacy regulations), or (b) on the Customer's documented instructions.
13. Liability, Order of Precedence, Governing Law
Liability under this DPA is subject to the limitations set out in the Agreement. In the event of a conflict between this DPA and the Agreement, this DPA prevails in respect of data-protection matters. This DPA is governed by the laws of England and Wales.
Annex I — Details of Processing
A. Data storage locations (evidenced from infrastructure, 2026-07-26/27)
| Store | Location | Data held | Transfer basis |
|---|---|---|---|
Supabase (Postgres + Vault), project ref fikqrdxiubedfjqblvfw |
UK (eu-west-2, London) |
Users, organisations, memberships, billing, CRM, API keys, secrets | Domestic (UK) — none needed |
| SurrealDB Cloud | Ireland (aws-euw1) |
Tenant documents, knowledge graph, search indexes, conversations | UK adequacy regulations (EEA) |
| GCP (GKE + Artifact Registry) | UK (europe-west2) |
Compute, container images, transient processing | Domestic (UK) — none needed |
B. Processing operations
Ingestion (upload, Chrome-extension capture), OCR (Google Document AI, pinned eu location), AI classification/extraction/summarisation/chat (LLM APIs via LiteLLM), graph construction, indexing/search, storage, backup, deletion.
C. Non-UK/EEA processing
- OpenAI, Google (Gemini), Anthropic and OpenRouter LLM APIs receive document content for AI features (server:
bots/shared/llm_resolver.py, LiteLLM routing). - ipinfo.io (US) receives IP addresses for geolocation.
- Former Qdrant US cluster (embeddings, AWS us-west-2) decommissioned 2026-07.
Annex II — Technical and Organisational Measures (Art. 32)
Reflects the measures deployed as of 2026-07-27.
- Access control & authentication: ES256 JWTs with JWKS verification; org-scoped multi-tenancy enforced via row-level security (ZDL RLS policies keyed on
org_id); hashed API keys; TOTP MFA available to users. - Encryption in transit: TLS via managed certificates; HTTP→HTTPS redirect enforced; TLS 1.2 floor with modern cipher suites;
sslmode=requireon Postgres connections. - Encryption at rest: managed-provider encryption (Supabase, SurrealDB Cloud, GCP); credentials in Supabase Vault.
- Network security: default-deny ingress and egress Kubernetes NetworkPolicies with least-privilege allows; per-tier ServiceAccounts with no Kubernetes API access.
- Hardened workloads: all containers non-root, Linux capabilities dropped; production debug/telemetry disabled; production log level INFO.
- Tenant isolation: dedicated SurrealDB namespace per organisation; deletion removes the namespace.
- Backups & availability: Supabase daily managed backups (PRO tier).