Data Processing Agreement

1. Scope

This Data Processing Agreement (“DPA”) supplements the Terms of Service between YourCompany (“Processor”) and you (“Controller”) where you use Ramsio Verify to process personal data of your end users.

This DPA applies when your product acts as a data controller and your end users' personal data is processed through Ramsio Verify's backend services.

2. Subject Matter and Duration

Processing takes place for the duration of the product's active integration and ceases upon offboarding. Data retention periods are defined in our Privacy Policy.

3. Processor Obligations

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures.
• Assist the Controller in fulfilling data subject rights requests.
• Delete or return all personal data upon termination of services.
• Make available all information necessary to demonstrate compliance.

4. Sub-processors

YourCompany uses the following categories of sub-processors:

• Payment processors — Stripe (US) and Razorpay (India), where payment processing applies.
• Email delivery — Resend for transactional emails.
• Error monitoring — Sentry for application error tracking.
• Infrastructure — Cloud hosting provider as configured by the Controller.

5. Security Measures

Ramsio Verify implements the following security measures as documented in our security architecture:

• Passwords hashed with bcrypt (cost factor 12).
• JWT tokens with 15-minute access token expiry.
• HTTPS-only data transmission.
• Role-based access control (RBAC) across all endpoints.
• Rate limiting on all authentication endpoints.
• Audit logging of all administrative actions.

6. Data Subject Rights

Ramsio Verify provides built-in Data Subject Request (DSR) functionality supporting access, deletion, portability, and rectification requests in compliance with GDPR, CCPA, and India DPDPA 2023.

7. International Data Transfers

Where personal data is transferred outside the EEA or India, such transfers are made pursuant to appropriate safeguards including Standard Contractual Clauses or equivalent mechanisms.

8. Request a Custom DPA

Product teams requiring a fully executed DPA or custom addenda should contact the platform team. We will respond within 5 business days.