Data Processing Agreement.
For enterprise customers.

1. Definitions

Terms not defined here have the meanings given in the DPDP Act 2023 or our Terms of Service. Where this DPA refers to “Customer”, that means you, the entity that has signed up for an enterprise subscription; “LexVio” means Global Synapse Technologies; and “Personal Data” means data of Data Principals that the Customer uploads, generates, or processes via the Service.

2. Roles

• Customer acts as the Data Fiduciary in respect of Personal Data it submits to or generates via the Service.
• LexVio acts as a Data Processor (under contract) processing such Personal Data on the Customer's instructions, only for the purposes of providing the Service.
• For Personal Data LexVio collects directly (account holders, billing contacts), LexVio acts as Data Fiduciary; see our Privacy Policy.

3. Scope and instructions

LexVio shall process Personal Data only on the documented instructions of the Customer, which are deemed to include: (a) use of the Service's features as configured by Customer-authorised users; (b) compliance with applicable law; and (c) responses to lawful requests by competent authorities. LexVio shall not access Personal Data except as necessary to deliver the Service.

4. Customer obligations

• Customer warrants that it has lawful basis (consent, statutory legitimate use, or other) to process Personal Data via the Service.
• Customer is responsible for the accuracy and lawfulness of Personal Data it uploads.
• Customer shall not upload data of children below 18, sensitive categories not permitted under the Customer's own privacy notice, or data prohibited by law.
• Customer is the sole point of contact for Data Principals (its users, employees, counterparties) for rights requests; LexVio assists as set out in §8 below.

5. Confidentiality

LexVio personnel with access to Personal Data are bound by contractual confidentiality obligations and have completed mandatory privacy and security training. Access is logged and reviewed periodically.

6. Security measures (Annex)

LexVio implements the following technical and organisational measures. Each line below describes what is in place today; where a measure is in progress, it says so.

• Encryption — uploaded documents, data exports and database backups are written to object storage with server-side encryption at rest (AES-256; a customer-managed KMS key where the deployment configures one). Traffic is encrypted in transit with TLS 1.2 or later, TLS 1.3 where the client supports it.
• Access control — role-based access within the Service; least-privilege defaults; LexVio-internal administrative endpoints are restricted to super-admin accounts of LexVio's own organisation. LexVio staff do not read Customer documents; access is limited to logged security or abuse investigations, or support the Customer asks for.
• Logging — append-only audit logs, enforced by database triggers that reject updates and deletes; retained for at least seven years.
• Backups — a database-backup job (nightly dump, integrity-checked, written to object storage in ap-south-1 with server-side encryption) is available and is switched on per deployment by the operator. We do not publish a backup retention period or a restore-test cadence until each is one we can evidence.
• Vulnerability management — automated dependency and static-analysis scans run weekly in CI. A third-party penetration test has not yet been performed; when one is, its date will be published on /trust.
• Identity documents — a document the Customer files under the identity category is stored only: it is never sent to an AI model, never embedded and never indexed for retrieval, and no analysis can be requested on it.
• Customer-set retention — an organisation admin can set a retention period per document category and for meeting audio; a daily job deletes the stored file when the period ends and keeps the record that it did. With no period set, content is kept until the Customer deletes it.
• Customer access policies — an organisation admin can restrict access by IP allowlist, by platform (web or phone) and by maximum session age; every authenticated request is checked against them. Multi-factor authentication is not offered today.
• Client portal — a client contact signs in only through a one-use link, valid for 15 minutes, sent to the contact's email address on file. The contact sees only what a live share grants, and revoking the share closes access on the next request.
• AI safeguards — every model vendor is reached only through a gated client: an air-gapped deployment (the AIR_GAPPED setting) disables every external model vendor and all telemetry; user-supplied text is screened for prompt injection before any model sees it; each request carries input and output token caps; and each organisation has a daily AI-spend ceiling that stops further model calls when reached. An organisation admin can further lower the model tier used, switch individual AI features off, and set the organisation's own daily AI spend cap; prompt-injection detections are recorded as a hash of the content, never the text.
• Personnel — background-checked staff; off-boarding deprovisioning within 24 hours.
• Certifications — SOC 2 (Security and Confidentiality criteria): controls mapped and evidence collected in-product; not yet audited. ISO/IEC 27001: not yet certified. Current status is published on /trust.

7. Sub-processors

Customer authorises LexVio to engage sub-processors to deliver the Service. The list below is the current, complete list. It is also published in machine-readable form at /api/v1/privacy/subprocessors, derived from the running deployment's configuration — an air-gapped deployment reports an empty list. Locations are those of the processing endpoint, as best we can state them.

• Amazon Web Services (ap-south-1, Mumbai, India) — object storage for uploaded documents, data exports and backups; transactional email. Receives uploaded documents, account data and backups.
• Anthropic (United States) — model inference for contract analysis, redlining and the copilot. Receives document text and prompt content submitted for analysis. Under Anthropic's API terms, customer content is not used to train its models.
• OpenAI (United States) — text embeddings for search and retrieval; multi-agent contract analysis when Deep Audit is used; speech-to-text transcription of meeting recordings (Meeting Intelligence); speech-to-text for voice dictation. Receives chunks of uploaded documents, document text submitted for analysis, meeting audio together with the resulting transcript, and dictated audio with its transcript (LexVio does not retain dictated audio). Under OpenAI's API terms, customer content is not used to train its models.
• Google (United States) — multi-agent contract analysis when Deep Audit is used. Receives document text submitted for analysis. Under Google's API terms, customer content is not used to train its models.
• LlamaParse (United States) — document parsing and text extraction. Receives uploaded document files.
• Deepgram — speech-to-text transcription of voice input. Receives the raw audio you record or upload, in full. Processing region: not selected by our integration, so we do not assert one. Transfer safeguard: being confirmed.
• Twilio — WhatsApp delivery of notifications and assistant replies. Receives message bodies, including AI-generated replies, and recipient phone numbers. Location and transfer safeguard: being confirmed.
• Karza (India) — KYC verification for marketplace professionals. Receives PAN, name and bank-account details, and Aadhaar on the offline-verification path. Data processing agreement: being confirmed.
• Razorpay (India) — payment processing for INR subscriptions. Stripe — payment processing where a subscription is billed in another currency. Neither receives document content.
• PostHog — product analytics (consent-gated on the marketing site; disabled entirely on an air-gapped deployment).
• Sentry — error monitoring (scrubbed of Personal Data; disabled entirely on an air-gapped deployment).

For the AI vendors above, the transfer basis is the vendor's data processing addendum together with Standard Contractual Clauses. Where an entry says “being confirmed”, LexVio has not yet verified that vendor's processing location or transfer safeguard and will update this list when it has; the machine-readable register carries the same flag.

Customer-configured channels.An organisation admin may connect the organisation's own email relay (SMTP), SMS provider (MSG91 with DLT registration) or WhatsApp Business account (Meta), using the organisation's own credentials. Those providers act under the Customer's own contract with them and are the Customer's processors, not LexVio sub-processors, so they are not listed above. Credentials are stored encrypted and are never returned in full. If LexVio ever sends SMS or WhatsApp messages through an account of its own, that provider will be added to this list first.

LexVio will give Customer at least 30 days' advance notice (by email to the account's primary admin) of any new or replacement sub-processor. Customer may object by terminating its subscription for cause if it cannot reach a workable accommodation.

8. Assistance with Data Principal rights

LexVio will, taking into account the nature of processing, provide reasonable assistance to enable Customer to respond to Data Principal rights requests (access, correction, erasure, nomination, consent withdrawal). Standard self-service tooling is available in the app (Settings → Privacy: data export and account deletion); complex cases handled via support@globalsynapsetech.com within 5 business days.

9. Personal data breach notification

LexVio will notify Customer of a confirmed Personal Data breach without undue delay and in any event within 24 hours of confirmation. Notification will include the nature of the breach, categories and approximate number of Data Principals affected, likely consequences, and remediation measures. LexVio will independently make the notifications that laws binding on LexVio require — to CERT-In under its 2022 Directions, and to the Data Protection Board of India and affected Data Principals under DPDP Act §8(6) once those provisions are in force.

10. Audit rights

LexVio does not currently hold SOC 2 or ISO 27001 certification; see our Trust Centre for current status. Where LexVio obtains such attestations, it will make the then-current reports available on reasonable request, at intervals not more than annually, under appropriate confidentiality. Until then, LexVio will respond to reasonable written security questionnaires. Where Customer reasonably requires a direct audit (e.g. regulator-mandated), parties will agree on scope, timing, and cost in writing.

11. Cross-border transfers

Uploaded documents, data exports and backups are stored in India (AWS ap-south-1, Mumbai). Document, prompt and audio content is transmitted to the sub-processors in §7 for model inference, parsing and transcription; the AI vendors' endpoints are served from the United States, and the location of each other sub-processor is stated in §7. These transfers are made to jurisdictions not restricted by the Central Government under DPDP Act §16, under the contractual safeguards recorded in §7.

12. Return or deletion

On termination of the Service, LexVio will, at Customer's choice and within 30 days, either return or securely delete all Personal Data, subject to legal retention requirements (e.g. 8-year billing records under the Companies Act 2013).

13. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the Terms of Service. Nothing limits liability that cannot be limited under applicable law.

14. Order of precedence

If there is a conflict between this DPA and the Terms of Service, this DPA prevails in respect of the processing of Personal Data.

15. Signing this DPA

Enterprise customers are deemed to accept this DPA when they execute a Master Subscription Agreement or Order Form referencing this URL. Customers requiring a counter-signed copy should contact info@globalsynapsetech.com; we typically counter-sign within 5 business days.