Loading
Loading
Last Updated: June 29, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between Atlaso Labs Inc. and a business customer for the provision of the Atlaso Service. In plain English: when you (a business or other organisation) use Atlaso to process personal data about your own users, employees, or other individuals, this document sets out the data-protection terms — what Atlaso does with that data, how we keep it secure, the sub-processors we rely on, how we help you respond to your obligations under laws like the GDPR, and what happens to the data when our relationship ends. It is the contract that lets a privacy-conscious organisation use Atlaso in compliance with applicable data-protection law.
This DPA is available to business and enterprise customers of Atlaso on request. It is not automatically in force for every user, and it is not incorporated by default into the Terms of Service. It becomes binding, and governs the processor relationship, only once it has been executed by both parties — whether by signature, by a click-through acceptance during onboarding, or by reference into a separate written agreement with Atlaso — and only where:
Individual (non-business) consumers using Atlaso for their own personal Memories do not need this DPA. For them, Atlaso is the controller that determines the purposes and means of processing their Memory, and the Privacy Policy governs — including the international-transfer safeguards for their data. This DPA governs only the business-customer processor relationship described above.
To request execution of this DPA, contact support@atlaso.ai. The version in force is the one accepted by both parties. Once executed, this DPA sits within the order of precedence set out in the Terms of Service and summarised in Section 16: the Terms of Service are the master agreement; where documents conflict, the more specific document controls for its subject matter; this DPA controls only for the processing of a business customer's personal data where Atlaso acts as processor; and the Standard Contractual Clauses control for restricted international transfers.
In this document, "Atlaso", "we", "us", and "our" mean Atlaso Labs Inc., a Delaware C-Corporation. "Service" means the Atlaso memory layer (dashboard, brain/API, Connectors, and CLI). "You", "Customer", and "your" mean the business customer that has entered into this DPA. Capitalised terms not defined here have the meaning given in the Terms of Service and Privacy Policy.
For the purposes of this DPA:
Other capitalised terms (Service, Memory/Memories, Content, Connectors, Free, Pro, Device, Account, User) have the meanings given in the Terms of Service.
Where you use the Service to Process Customer Personal Data, you are the Controller (or, where you act on behalf of a third party, the processor) and Atlaso acts as your Processor (or sub-processor). In that capacity, Atlaso Processes Customer Personal Data only on your documented instructions, as set out in Section 4. Under CCPA/CPRA, Atlaso acts as a Service Provider with respect to such data.
Atlaso acts as an independent Controller for certain data it Processes in connection with the Service, including: Account and authentication data (email, user id, name, passkeys); Device registry data; subscription and billing data; content-free usage analytics (DAU/MAU counters); and infrastructure logs. This data is governed by the Atlaso Privacy Policy, not by this DPA. Where the two overlap, this DPA governs the processor relationship for Customer Personal Data and the Privacy Policy governs Atlaso's own controller processing.
You warrant that: (a) you have established and will maintain a valid legal basis under Applicable Data Protection Law for the Processing you instruct Atlaso to perform; (b) your instructions comply with Applicable Data Protection Law; and (c) you have provided all required notices and obtained all required consents from Data Subjects. You are responsible for the accuracy, quality, and legality of the Customer Personal Data and the means by which you acquired it.
The required particulars of Processing (per GDPR Article 28(3)) are set out in Annex 1 and summarised here:
Atlaso shall Process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law (in which case Atlaso will inform you of that legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest).
Your documented instructions are constituted by: (a) this DPA; (b) the Terms of Service and Privacy Policy; (c) your configuration and use of the Service (for example, which Connectors you enable, whether you are on the Free or Pro tier, and the Memories you deposit or capture); and (d) any further written instructions agreed by the parties. Processing necessary to provide the Pro AI features (Ambient Memory, L2 enrichment, and "Ask your memory") — which submit Content to the LLM sub-processor — is part of your instructions when you enable those features on a Pro plan.
Atlaso shall inform you if, in its opinion, an instruction infringes Applicable Data Protection Law. Atlaso is not obliged to perform a legal review of your instructions but will notify you if it becomes aware of an apparent infringement.
Atlaso shall ensure that any person authorised to Process Customer Personal Data (whether an employee, contractor, or Sub-processor's personnel) is subject to an appropriate obligation of confidentiality (whether a contractual or statutory duty) and Processes Customer Personal Data only as necessary to provide the Service or as otherwise instructed. Atlaso limits access to Customer Personal Data to those personnel who require access to perform their duties.
Atlaso shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to Data Subjects. The measures in force as at the Last Updated date are described in Annex 2 (Technical and Organisational Measures).
For the avoidance of doubt and consistent with the Privacy Policy:
sslmode=require).Atlaso operates an automated secret-scrubbing process that attempts to redact credentials (such as private keys, API tokens, JWTs, bearer tokens, and high-entropy secrets) from Content on ingress and on enriched output, on a fail-closed basis. This is a best-effort defence-in-depth measure, not a guarantee. Secret material may be transiently present in transit before redaction. You must not rely on this feature and must not instruct the Processing of regulated or secret data except as permitted under Section 9 and the Acceptable Use Policy.
Atlaso may update its security measures from time to time provided that such updates do not materially reduce the overall level of security of the Service.
You grant Atlaso a general authorisation to engage Sub-processors to Process Customer Personal Data, subject to this Section 7. The current list of Sub-processors is maintained at Sub-processors List and reproduced for reference in Annex 3.
Where Atlaso engages a Sub-processor, it shall do so by way of a written contract imposing data-protection obligations substantially equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Atlaso remains fully liable to you for the performance of each Sub-processor's data-protection obligations.
Atlaso shall notify you of any intended addition or replacement of a Sub-processor, giving you a reasonable opportunity to object on reasonable, data-protection-related grounds. Notice will be given by updating the Sub-processors List and, where you have subscribed to change notifications, by the notification mechanism described there. Unless you object in writing within 30 days of notice, the change is deemed accepted. If you object on reasonable grounds and the parties cannot agree a resolution, you may terminate the affected portion of the Service in accordance with the Terms of Service as your sole remedy.
Taking into account the nature of the Processing, Atlaso shall assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests by Data Subjects exercising their rights (including access, rectification, erasure, restriction, portability, and objection) under Applicable Data Protection Law.
If Atlaso receives a request from a Data Subject relating to Customer Personal Data, Atlaso shall, unless legally prohibited, promptly forward the request to you and shall not respond directly except on your documented instructions or as required by law.
You acknowledge that, as at the Last Updated date, certain erasure operations across Atlaso's systems are performed manually rather than by a self-service or fully automated mechanism. Atlaso will use commercially reasonable efforts to give effect to verified erasure and other rights requests without undue delay and within the statutory timeframes required by Applicable Data Protection Law, as described in the Privacy Policy.
The Service is not designed for, and you must not use it to Process, special categories of Personal Data (GDPR Article 9), data relating to criminal convictions, protected health information (PHI), payment-card data subject to PCI-DSS, or other data subject to heightened regulatory regimes, unless separately agreed in writing with Atlaso. This restriction is reflected in the Acceptable Use Policy. You are responsible for ensuring your Content complies with this Section.
Atlaso shall notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and in any event in a manner that allows you to meet your own notification obligations under Applicable Data Protection Law.
To the extent known and available, Atlaso's notice shall describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and a contact point for further information. Atlaso may provide information in phases as it becomes available.
Atlaso's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.
Upon termination or expiry of your agreement, and at your choice, Atlaso shall delete or return all Customer Personal Data and delete existing copies, unless retention is required by applicable law. Specifically:
Atlaso shall make available to you all information reasonably necessary to demonstrate compliance with this DPA and the obligations in GDPR Article 28, and shall allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you.
To balance audit rights against security and confidentiality:
Atlaso and its Sub-processors are located in the United States, and Atlaso's operations also involve personnel and activity in India. Customer Personal Data may therefore be transferred to, stored in, and Processed in the United States, India, and other jurisdictions in which Atlaso or its Sub-processors operate.
Where Customer Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not received an adequacy decision, the parties agree that the Standard Contractual Clauses apply and are incorporated into this DPA by reference:
For the purposes of the SCCs: the data exporter is the Customer; the data importer is Atlaso; the optional docking clause applies; the description of transfer is set out in Annex 1; the technical and organisational measures are set out in Annex 2; and the list of Sub-processors is set out in Annex 3 / the Sub-processors List.
The SCC Module Two / Module Three elections, the governing-law and forum elections (SCC Clauses 17 and 18), and the competent Supervisory Authority are to be completed by the parties on execution of the applicable SCCs and recorded in Annex 1; they are not pre-completed, and nothing in this DPA should be read as an assertion that the SCCs have already been executed for any given transfer. The parties further acknowledge that, because the same entity (Atlaso Labs Inc.) processes Customer Personal Data both in the United States and through its own personnel in India (an intra-organizational transfer rather than a transfer between two distinct parties), the off-the-shelf SCC Modules do not map cleanly, and appropriate Article 46 safeguards for that same-entity US↔India transfer will be put in place on execution. In the event of any conflict between the SCCs, once executed, and this DPA, the SCCs prevail with respect to the transfer.
The parties will cooperate in good faith on any transfer impact assessment ("TIA") reasonably required for a restricted transfer. Atlaso's Processing involving India is subject to the DPDP Act; the parties acknowledge that India-related transfer disclosures, hosting-region confirmations, and any additional safeguards remain subject to confirmation with Indian counsel before Atlaso relies on this Section for a given transfer.
Where Atlaso Processes Personal Information subject to the CCPA/CPRA on your behalf:
The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, and any reference in those Terms to the liability of a party means the aggregate liability of that party under the Terms and this DPA together. Nothing in this DPA or the Terms limits or excludes either party's liability where it may not lawfully be limited or excluded under Applicable Data Protection Law, including liability to Data Subjects under the SCCs.
All enquiries — including data-protection matters, DPA execution, privacy requests, legal notices, and support — should be sent to support@atlaso.ai.
Atlaso Labs Inc. Registered-agent address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States (a registered-agent address, not an operating office; Atlaso's operations and personnel are located in India, and personal data is processed in the United States and in India).
Our EU/UK Representative (GDPR Article 27) can be reached at support@atlaso.ai. Our India Data Protection / Grievance Officer (DPDP Act) can be reached at support@atlaso.ai.
Data exporter: The Customer (the business entity that has accepted this DPA). Data importer: Atlaso Labs Inc., a Delaware C-Corporation, provider of the Atlaso Service.
Subject matter of the Processing: Provision of the Atlaso memory layer (dashboard, brain/API, Connectors, and CLI), enabling storage, synchronisation, retrieval, and (for Pro features) AI enrichment of Memories and related Content.
Duration of the Processing: For the term of the Customer's agreement, plus the return/deletion period in Section 11.
Nature and purpose of the Processing: Collection, storage, organisation, retrieval, transmission, cross-Device synchronisation, secret redaction, and — for Pro features only — submission of Content to a large language model sub-processor for nightly L2 enrichment, "Ask your memory" queries, and Ambient distillation. Purpose: to provide, secure, support, and maintain the Service.
Types of Personal Data:
Categories of Data Subjects: The Customer's authorised users of the Service, and any individuals whose Personal Data appears within the Customer's Content.
Frequency of transfer: Continuous, for the duration of the agreement.
Competent Supervisory Authority (SCCs): determined by the data exporter's place of establishment (or, where the exporter has no EEA establishment, its EEA representative) and to be recorded here on execution of the applicable SCCs.
SCC governing law and forum (Clause 17 / 18): the EU Member State law and courts to be elected by the parties on execution of the applicable SCCs, consistent with Section 13.3.
Atlaso maintains, at minimum, the following measures (as at the Last Updated date):
Access control and authentication
user_id; per-project visibility is fail-closed; cross-user access attempts return HTTP 404 rather than disclosing existence.sha256 hashes; OAuth authorization codes and refresh tokens stored hashed; plaintext device tokens held only briefly during the approve-to-consume window.secrets.compare_digest).Encryption
sslmode=require).Data minimisation and protective processing
sk-/GitHub/AWS/Google/Slack tokens, JWTs, bearer tokens, URI credentials, high-entropy blobs).Resilience and abuse prevention
chmod 0700 file permissions.Organisational measures
Atlaso may update these measures provided the overall level of security is not materially reduced.
The authoritative, current list is maintained at the Sub-processors List (last updated June 29, 2026). As at the Last Updated date, the Sub-processors are:
| Name | Purpose | Data shared | Location |
|---|---|---|---|
| Clerk | Authentication, session, profile | Email, user id, name, passkeys, plan + Stripe-customer-id metadata | USA |
| Stripe | Payment processing & subscription billing | Email, card/payment data, billing address, subscription state | USA |
| Neon | Brain metadata database + transient enrichment queue | Token hashes, device registry, plan, usage counters, OAuth state, transient raw capture text | USA |
| Fireworks AI | LLM for L2 enrichment, "Ask your memory", and Ambient distill (Pro features) | User Memory content (raw captures + recalled Memories) | USA |
| Render | Hosting the brain (all server-side Memory and metadata) | All server-side data at rest | USA |
| Vercel | Hosting the dashboard | Request data, served content | USA |
No-training commitment. We do not operate a training endpoint and we do not train Atlaso models on your Memory. Raw Memory content is sent to our large-language-model sub-processor only for paid (Pro) features; Free-tier Memory is never sent to any language model. We send that content to the provider solely to generate your results, and we do not use your Memory to train any AI models.
This DPA cross-references the Terms of Service, Privacy Policy, Sub-processors List, Acceptable Use Policy, Refund & Cancellation Policy, and Cookie Policy.