This DPA applies whenever Customer utilizes the YossGate API aggregation platform to process Personal Data on behalf of an organisation, enterprise, or commercial application.

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) as defined by Applicable Data Protection Law.
• “Processing” means any operation or set of operations performed upon Personal Data, including collection, transmission, routing, storage, adaptation, retrieval, erasure, or destruction.
• “Controller” means the entity that determines the purposes and means of the Processing of Personal Data (the Customer).
• “Processor” means the entity that processes Personal Data on behalf of the Controller (YossGate).
• “Sub-processor” means any third-party infrastructure vendor or upstream foundation model provider engaged by YossGate to perform processing activities.
• “Applicable Data Protection Law” means all binding laws and regulations applicable to the processing of personal data, including the EU General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 (PDPA), and the California Consumer Privacy Act (CCPA).

2. Roles of the Parties

• Customer as Controller: Customer maintains complete control over the prompts, data, and payloads transmitted to the YossGate API. Customer is responsible for ensuring a valid legal basis for processing and obtaining all necessary consents from end users.
• YossGate as Processor: YossGate acts strictly on Customer’s documented instructions to provide high-concurrency API proxy routing, protocol conversion, authentication, and token billing services. YossGate does not process Personal Data for its own independent training or commercial profiling purposes.

3. Scope, Categories, and Zero Data Retention

4. Obligations of the Processor (YossGate)

YossGate agrees to:

1. Documented Instructions: Process Personal Data solely in accordance with Customer’s documented instructions, including the transmission of requests to chosen model endpoints;
2. Confidentiality: Ensure that all staff, contractors, and systems with access to data are bound by stringent statutory or contractual confidentiality agreements;
3. Security Standards: Implement and maintain robust Technical and Organisational Measures (TOMs) appropriate to the risk;
4. Data Subject Rights Support: Reasonably assist Customer in fulfilling its obligations to respond to Data Subject requests (e.g., access, deletion, rectification) under applicable regulations;
5. Data Return and Erasure: Upon termination of services, purge or return all residual customer data within thirty (30) days, subject to legal compliance obligations.

5. Technical and Organisational Measures (TOMs)

YossGate maintains high industry security benchmarks, including:

• Encryption in Transit: Mandatory TLS 1.3 / TLS 1.2 encryption for all incoming client API calls and outbound upstream provider connections.
• Ephemeral Memory Processing: Payloads are streamed through memory buffers; persistent prompt caching is disabled by default.
• Container and Multi-Tenant Isolation: Architectural separation prevents cross-tenant data leakage.
• Access Control: Principle of least privilege, multi-factor authentication (MFA), and audit logging for all production infrastructure.
• Continuous Monitoring: Real-time intrusion detection, DDoS mitigation via Cloudflare edge infrastructure, and regular automated vulnerability assessments.

6. Upstream Sub-processors

Customer acknowledges and expressly authorizes YossGate to engage upstream AI model providers and cloud infrastructure vendors as Sub-processors (including, among others, OpenAI, Anthropic, Google Cloud, Meta, Cloudflare, and AWS).

YossGate enforces rigorous vendor due diligence, selecting partners that comply with SOC 2 Type II, ISO 27001, or comparable data protection certifications.

7. Security Incident and Breach Notification

In the event of a confirmed Personal Data Breach affecting Customer’s unencrypted data within YossGate’s infrastructure, YossGate will notify Customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the incident, providing available details and remediation measures.

8. Cross-Border Data Transfers

To deliver global, low-latency AI routing, data may be processed across secure edge nodes and upstream data centers globally. Where cross-border data transfers occur from the European Economic Area (EEA), the UK, or Switzerland to countries without an adequacy decision, the parties agree that standard contractual safeguards (such as the European Commission’s Standard Contractual Clauses - SCCs) shall apply.

9. Governing Law and Arbitration

This Agreement shall be governed by and construed in accordance with the laws of the Republic of Singapore. Any dispute arising under or in connection with this DPA shall be submitted to the exclusive jurisdiction of the Singapore courts or resolved through arbitration administered by the Singapore International Arbitration Centre (SIAC).

10. Contact Information

For DPA inquiries or Data Protection Officer correspondence:

• Email: support@yossgate.com