This Data Processing Agreement ("DPA") forms part of the Terms of Service and governs how Tawa Guard Ltd ("Tawa Guard", the "Processor") processes Customer Content on behalf of the Customer (the "Controller") in the course of providing the Service.
1. Roles and scope
- For Customer Content — prompts, retrieved content, agent tool inputs/outputs, and files submitted to the Service for scanning or labeling — the Customer is the controller and Tawa Guard is the processor.
- For account, billing, and audit data relating to the Customer's own users, Tawa Guard is the controller — see the Privacy Policy.
- Processing continues for as long as the Customer uses the Service, plus the deletion windows in Section 6.
2. Nature and purpose of processing
Tawa Guard processes Customer Content for one purpose: analysing it with security models and rules to return a verdict and supporting signals to the Customer. Customer Content is not used to train models, is not sold, and is not shared with other customers.
Categories of data subjects and data are determined by the Customer: scanned content typically originates from the Customer's end users and may contain any category of personal data the Customer's application handles. The Customer must not submit special-category data where it is not necessary, and is responsible for its lawful basis to process the content it submits.
3. What is stored — and what is not
| Path | Content persistence |
|---|---|
/v1 scanning endpoints (scan, RAG, agent) | Not persisted by default. The request body is processed in memory and discarded, and only classification metadata and the verdict are stored (timestamps, category, action, confidence, key and environment). If the Customer turns on prompt retention for an app, the scanned text is stored, with provider-managed encryption at rest, in object storage for the period the Customer selects, capped by the plan (24 hours, 7 days, 30 days or 90 days; Enterprise by contract), then deleted. Per-request results include derived classification detail (flagged span positions, categories) but not the text |
| Prompt retention (optional, per app) | Scanned text is stored in object storage for the period the Customer selects, capped by the plan (24 hours, 7 days, 30 days or 90 days; Enterprise by contract), then deleted |
| Labeling datasets (optional feature) | Content the Customer uploads or copies into a dataset is stored until the Customer deletes the workspace |
| Knowledge buckets (optional) | Documents are stored in object storage, and their text chunks and embeddings in our database, until the Customer deletes the document, bucket or workspace |
| Feedback on scans (optional) | A numerical representation (embedding) of each scan is cached for up to 7 days. When a Customer user reports a verdict as wrong, that embedding is retained to match similar future scans, and is deleted under the retention schedule or with the workspace |
| Queues and caches | Transient: queue messages reference payloads by key only; status caches expire within minutes; scan embeddings within 7 days |
Scan verdicts and metadata (without content) are retained for the lifetime of the workspace to provide dashboards, usage metering, and billing.
4. Processor commitments
Tawa Guard will:
- process Customer Content only on the Customer's documented instructions (submitting content to the Service constitutes the instruction to scan it), unless required otherwise by law, in which case Tawa Guard will inform the Customer unless legally prohibited;
- ensure persons authorised to process Customer Content are bound by confidentiality;
- implement appropriate technical and organisational measures, including: encryption in transit; provider-managed encryption at rest for stored content; mandatory multi-factor authentication for all accounts including staff; hashed storage of API keys and invite-link tokens; a tamper-evident (hash-chained) audit log of security-relevant actions; and least-privilege access to production systems;
- notify the Customer without undue delay, and in any case within 72 hours of becoming aware of it, of a personal data breach affecting Customer Content, with the information reasonably required for the Customer's own notification obligations;
- assist the Customer, taking into account the nature of the processing, with data subject requests and with the Customer's obligations under Articles 32–36 UK/EU GDPR;
- make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits (at the Customer's cost, on reasonable notice, no more than once per year absent a breach);
- delete or return Customer Content on termination as described in Section 6.
5. Sub-processors
The Customer provides general authorisation for the sub-processors listed in the Privacy Policy (hosting, database, object storage, queue, payments, identity, worker infrastructure, email, analytics). Tawa Guard will notify customers by email at least 30 days before adding or replacing a sub-processor that processes Customer Content, giving the Customer the opportunity to object. If the Customer reasonably objects and no alternative is available, the Customer may terminate the affected service; Tawa Guard remains liable for its sub-processors' performance.
6. Deletion and return
- Deleting a knowledge document, bucket, workspace, or account through the Service deletes the associated stored Customer Content, subject only to ageing out of encrypted backups (up to 30 days).
- On termination of the Service, Tawa Guard deletes stored Customer Content within 30 days, except where retention is required by law. Scan metadata needed for invoicing and audit is retained per the Privacy Policy's retention table.
- On written request before deletion, Tawa Guard will provide an export of stored Customer Content in a machine-readable format.
7. International transfers
Where processing involves transfers outside the UK/EEA, the parties rely on the UK International Data Transfer Agreement/Addendum and/or EU Standard Contractual Clauses, which are incorporated by reference, alongside the safeguards in Section 4.
8. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms or a signed contract, the signed contract prevails, then this DPA, then the Terms.
9. Changes to this DPA
We will notify customers by email of any material change to this DPA and update the "Last updated" date shown above. Continued use of the Service more than 30 days after notice constitutes acceptance of the updated DPA. If you do not accept a change, see Section 12 of the Terms of Service — where continued provision is no longer possible, we may terminate the Service in line with our terms and any applicable contract, which, depending on that contract, may be without refund or rebate.
10. Contact
Data protection contact: gdpr@tawaguard.com.
To request a signed copy of this DPA or to discuss bespoke terms, contact contact@tawaguard.com or your account contact.