Data Processing Agreement

Data Processing Agreement (DPA) · GDPR Art. 28 · CORTEX-Persist v0.3.0b8 · May 13, 2026

1. Parties

This DPA is entered into between Borja Fernández Angulo ("Processor") and the subscribing client ("Data Controller").

2. Object & Nature of Processing

CORTEX-Persist acts as a Processor when processing personal data on behalf of the Controller via the API. The nature of the processing is the persistence and retrieval of facts and memory vectors of AI agents.

3. Types of Personal Data

Category	Examples	Purpose
Identifiers	User IDs, tenant_id	Tenant isolation
Session data	Timestamps, trace_ids	Audit & debugging
Agent data	Facts, semantic vectors	Agent memory

4. Obligations of the Processor

Process data solely based on documented instructions from the Controller.
Ensure that authorized persons commit to confidentiality.
Implement appropriate technical and organizational measures (encryption, SHA3-256 hashing, Ed25519 signatures).
Notify security breaches within 72 hours.
Delete or return all personal data upon termination of the contract.

5. Subprocessors

Subprocessor	Purpose	Country
Stripe, Inc.	Payment processing	USA (SCCs)
Vercel, Inc.	Frontend hosting	USA (SCCs)

6. Audits

The Controller may request compliance audits with a 30-day notice. CORTEX-Persist provides cryptographic evidence via the Forensic Audit Ledger (SHA3-256).

7. DPA Contact

To exercise rights under this DPA: dpa@cortexpersist.com