Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between a customer firm (the “Data Fiduciary”) and AI Foundry Ventures (“Breez”, the “Data Processor”) and governs the processing of personal data under India’s DPDP Act, 2023.

1. Roles

The firm determines the purposes and means of processing and is the Data Fiduciary. Breez processes personal data only on the firm’s documented instructions, as the Data Processor.

2. Scope of processing

• Subject matter: provision of the Breez practice assistant.
• Categories of data subjects:the firm’s employees and the clients whose matters they manage.
• Categories of data: contact details, mailbox and calendar content, documents, and voice notes the firm connects to Breez.

3. Security measures

• Encryption in transit and at rest.
• Role-based action policies (org policy engine) and an append-only audit log committed before each action.
• Outbound DLP on agent-generated messages — PAN, Aadhaar and account-number patterns redacted, blocked or flagged per firm policy.
• VAPT testing before go-live; SOC 2 in progress.

4. Sub-processors

Breez uses a limited set of sub-processors (cloud hosting, LLM inference). A current list is available on request, and the firm is notified of changes with a right to object. Firms on dedicated-VPC or bring-your-own-LLM deployments may restrict sub-processing to their own tenancy and agreements.

5. Data residency

Processing occurs in India (Google Cloud asia-south1), or within the firm’s own cloud tenancy for dedicated-VPC deployments.

6. Deletion and return

On termination or on request, Breez deletes or returns all personal data within 72 hours and provides a deletion receipt. Append-only audit records may be retained only as required by law.

7. Contact

DPA requests: hello@aifoundryventures.com.