Data processing

For customer personal data, request an applicable Data Processing Agreement (DPA) before production onboarding. This page explains the scope to resolve; it is not an executed DPA, a signed transfer instrument or a claim that an agreement is already in place.

Email compliance@nyraxis.io with your contracting entity, deployment type, jurisdictions and intended data categories. Do not include real workload data. Separately agreed terms govern where applicable.

• Purpose: authorized agent evaluation, telemetry, testing, reporting and agreed support.
• Data: account-linked identifiers, submitted text, agent and tool metadata, test inputs, findings and reports; exact fields depend on the integration and capture ceiling.
• People: customer personnel and people whose information the customer lawfully includes in its workload.
• Duration: service term, configured workload retention, agreed return/deletion process and any legally necessary retention.
• Roles: customer instructions for customer content; separate controller purposes for Nyraxis account, security and business records.

The agreement should cover documented instructions, confidentiality, technical and organizational measures, subprocessors and change/objection procedures, data-subject request assistance, incident notification without undue delay where required, DPIA assistance, audit information, and return/deletion including backups.

Specify access roles, supported data categories, prohibited sensitive data, notification contacts, deletion evidence and any incident or audit costs. Do not assume a public page alone settles these contractual obligations.

Attach the actual provider entities, regions, approved external model/judge endpoints, support locations and alert/export destinations. Identify required EEA/UK or other international transfer mechanisms and assessments. Review the provider directory; the operative schedule must match your deployment.

Agree the active-record window and deletion procedure separately from infrastructure logs, saved test cases, invoices and backups. Verify scheduled cleanup in operation. A retention setting is not proof of a completed deletion and metadata-only capture does not erase old content.

Customers should export needed evidence before termination, revoke credentials and address copies they sent to third-party systems. Contact us to coordinate organization-wide deletion and any lawful retention exceptions.

Start with synthetic markers and verify captured records, exports, role boundaries, failure behavior, selected providers, cleanup and recovery. The product is not presented as SOC 2 certified, a BAA-backed health-data service, or universally GDPR/DPDP compliant. Request deployment-specific evidence and complete the required agreements before using restricted data.