Roles and documented instructions
For customer personal data submitted for inference, the customer acts as controller, or as a processor authorized by its controller, and Zrelay acts as processor or subprocessor respectively. Account administration and Zrelay’s own billing and security records are covered separately by the privacy policy.
The proposed processing instructions consist of the service agreement, this addendum, the customer’s API requests and subsequent documented instructions agreed by the parties. Zrelay would process customer data only on those instructions unless law requires otherwise, informing the customer of that requirement where permitted. Zrelay would promptly flag an instruction it considers contrary to applicable data-protection law.
A marketplace sale completed in G2G is a separate seller and checkout relationship governed by G2G’s terms. This draft does not turn G2G into a Zrelay subprocessor or represent that a marketplace transaction has an executed Zrelay DPA.
Confidentiality and security
An executed agreement must require confidentiality or an appropriate statutory duty for people authorized to access customer personal data and proportionate access controls. Organizational implementation still requires verification.
The implementation features in Annex II describe technical controls evidenced in the service. Appropriate measures for a specific customer and data set require review.
Subprocessors
Zrelay uses providers described in the supplier register. Full inference-supplier identities, locations and contractual documents are still being verified for business customers. This draft is not an executed DPA and does not establish a completed GDPR supplier review. Customers may raise data-protection questions through support.
Before an enforceable business processing agreement is offered, applicable written subprocessor duties, change notices and responsibilities must be verified and agreed.
Rights requests and customer assistance
The proposed undertaking is to assist the customer, insofar as possible and taking account of the nature of processing, with access, correction, deletion, restriction, objection and portability requests. Zrelay would forward a request concerning customer-controlled data and avoid responding on the customer’s behalf except on instructions or as required by law.
Zrelay would provide reasonable assistance with security obligations, breach assessment and notification, data-protection impact assessments and prior consultation, taking account of information available to it. The scope and any reasonable charges for substantial assistance must be agreed without preventing legally required assistance.
Personal-data breaches
The proposed undertaking is to notify the customer without undue delay after awareness of a personal-data breach affecting data processed for it, with available details and updates. The incident process and contractual contact need verification before this draft is executed.
Deletion or return
An executed DPA must define return or deletion at the customer’s choice when processing ends, subject to lawful retention. Ordinary inference content is not kept as a conversation archive and cannot be exported from such an archive.
Backup deletion and records retained for lawful operational purposes require an agreed schedule.
Information and audits
Zrelay would make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections by the customer or an auditor mandated by it, as required by applicable law. The parties may agree proportionate confidentiality, security and scheduling arrangements that do not defeat those rights. No SOC 2 report, ISO certification or independent audit is represented as available.
International transfers
Processing locations and onward transfers depend on the service path and providers involved. Applicable transfer mechanisms and any supplementary measures require contractual and factual verification before they are represented as in place.
Annex I — Processing details
- Subject matter and purpose
- Delivery of customer-requested AI inference through the gateway, routing, usage metering, necessary troubleshooting and abuse prevention.
- Nature
- Receipt, inspection, transmission and response delivery; extraction and storage of usage metadata; limited trial diagnostics and derived abuse signals.
- Duration
- The service period, transient request processing and the applicable retention periods for relevant records.
- Data subjects
- Customer personnel, application users and other people whose data the customer includes in requests.
- Types of data
- Customer-selected text, images or file content; resulting outputs; account-linked operational metadata; bounded error diagnostics where applicable.
- Special-category or highly sensitive data
- The service does not provide special-purpose safeguards for highly sensitive data. Customers must complete their own assessment before submitting such data.
- Customer responsibilities
- Lawful instructions, necessary permissions and notices, data minimization, secure credential management and deciding whether the service is appropriate for the intended data.
Annex II — Technical and organizational measures
Features evidenced in the repository include public HTTPS ingress, hashed customer API keys and session tokens, Argon2id account-code verifiers, encrypted pooled upstream credentials, per-account authorization, per-key spending caps, portal CSRF checks and secure session cookies. Internal gateway-to-account-service traffic uses a private HTTP service route; this is not a claim of TLS on every network hop or encryption of every database field.
Container configuration limits privileges for the primary API worker and includes network-policy rules. The gateway removes common client-IP forwarding headers, bounds request sizes and avoids storing ordinary inference conversation bodies in its application database. Trial diagnostic cleanup is configured for 30 days; database backups run daily with removal of backup directories older than 14 days.
These technical measures describe the service implementation and do not constitute a certification or independent audit report.
Annex III — Subprocessor information
The subprocessor and service-provider register identifies the dependencies and distinguishes customer inference processing from Zrelay’s own account, billing and support processing.