acuvis
Sign in

DPA

Data Processing Agreement.

A signed GDPR Art. 28 DPA is available for every paid plan and on request for free-tier accounts that need one for their own compliance file.

What is included

  • Art. 28 GDPR data processor undertakings: instruction-only processing, confidentiality, technical and organisational measures, sub-processor obligations, audit rights, deletion and return of data on termination.
  • International transfers: Acuvis is established in the EU (Poland). Where a sub-processor outside the EEA receives personal data, the transfer relies on the EU-U.S. Data Privacy Framework if that sub-processor is certified, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914, module 3, processor-to-processor) in that sub-processor's data processing terms. Customers established outside the EEA can request module 4 (processor-to-controller).
  • UK International Data Transfer Addendum (ICO) for customers with UK data subjects.
  • An annex listing all current sub-processors and their roles, including the AI inference providers that receive diff content (currently Fireworks AI and OpenAI) — see /sub-processors.
  • Technical and organisational measures annex (TOMs): per-review microVM isolation, TLS encryption in transit, role-based access controls, audit-log hashing, backups, and the incident response process.
  • Personal-data breach notification commitment: notice to the controller without undue delay, in any event within 48 hours of becoming aware.

How to put it in place

  1. Mail legal@acuvis.dev with subject "DPA request" and your organisation name as registered in Acuvis.
  2. We send you a copy of our standard DPA pre-filled with your entity details. The document is signed electronically (DocuSign or equivalent).
  3. Counter-signed copy returns within two business days. You receive a PDF for your compliance file, and we mark the org account as "DPA in force" in our records.

Custom redlines

Enterprise customers may negotiate specific clauses. For self-serve and indie tiers, redlines are accepted only on a best-effort basis — the standard DPA covers Art. 28 GDPR in full and is sufficient for most controllers. Material deviations require an enterprise contract and are priced accordingly.

What this DPA does not cover

The DPA addresses Acuvis's role as processor. The general commercial relationship — pricing, service availability, liability cap — is governed by the Terms of Service. Privacy practices that apply to all users with or without a signed DPA are in the Privacy Policy.