Data Processing Addendum

For data you submit to Yantra as part of using an agent (prompts, tool inputs, and anything your end users send through a deployed agent), you are the data controller and Yantra is the data processor, processing that data solely to provide the service you've configured.

Yantra processes personal data only as necessary to run your agents, enforce your plan, and maintain the run trace / audit record your agent's compliance profile calls for. We don't use it for any other purpose, including model training.

We use a small number of vendors to run the service — model inference providers, hosting, and billing. The full list, with what each one sees, is available on request. We'll notify Team/Enterprise customers directly before adding a new one that would process their data.

Where personal data is transferred outside the EU/UK (for example, to a US-based model provider), we rely on Standard Contractual Clauses or the sub-processor's own equivalent safeguard. The specific mechanism per sub-processor is available on request.

Row-level tenant isolation enforced at the database layer, field-level encryption for stored credentials, and plan-based retention enforcement on a schedule. Ask us for the full technical and organizational measures document if your review needs it in writing.

We will notify affected customers of a confirmed personal-data breach without undue delay, and in any case within 72 hours of becoming aware of it, with what we know at the time and how we're responding.

On account closure, your data is deleted per the retention terms in our Privacy Policy, subject to any legal-hold obligation you've set on specific agents.

This page is a plain-language summary, not a substitute for a countersigned agreement. If your organization requires a formally executed DPA, contact us and we'll get one in place.