# Data processing addendum: the processor terms, and where they stop applying

Tileward's data processing addendum governs what Tileward, as a processor, may do with personal data it holds. It matters on the hosted API, where Tileward holds that data; in a VPC or air-gapped deployment Tileward never receives it, so most of the addendum has nothing to attach to.

Page: https://tileward.com/dpa/

## Roles

| Deployment | Customer content | Account, billing and licensing data |
|---|---|---|
| Hosted API | Tileward is the processor. You are the controller, or a processor for your own customer. | Tileward is the controller. |
| Your VPC | No Tileward processing: content, context store and audit records stay in your account. On committed-use billing, an aggregate usage count only. | Tileward is the controller. |
| On-prem, air-gapped | No Tileward processing, and no network path by which there could be. | Tileward is the controller. |

- A committed-use usage report is an aggregate count for the billing period, not a log. Its entire body is `period_start`, `period_end`, `seats_active`, `tokens_sent`, `tokens_received` and `tiles_active`.

## Annex I: what is processed, and why

- Subject matter: providing governed inference: running a model, storing and retrieving conversation context, classifying requests against a Governance policy, and recording the decision.
- Duration: as long as the account is open, plus the retention windows in the [privacy policy](https://tileward.com/privacy/).
- Data subjects: the customer's staff who hold seats and keys, and any individual whose personal data the customer puts into a prompt, a stored document or a conversation.
- Personal data: account identifiers for seat holders; beyond that, whatever the customer sends. Special category content a customer sends is processed the same as any other content.

## Processor obligations

- Tileward processes customer content only to provide the service and only as the customer instructs, unless the law requires otherwise. Using the service is the instruction.
- Anyone at Tileward with access is bound to confidentiality.
- Security measures are described on the [security page](https://tileward.com/security/), which stands as Annex II. SOC 2 Type II and ISO 27001: in progress ([certifications](https://tileward.com/security/#certifications)).
- Sub-processors are listed on the [sub-processor page](https://tileward.com/subprocessors/), which stands as Annex III.
- Tileward does not use customer content (prompts, stored context, documents or audit records) to train, fine-tune or evaluate any model, in aggregate or de-identified form or otherwise.

## Data subject requests and breaches

- Tileward assists the customer with access, correction, deletion and portability requests. Audit records exist to prove what was refused and when, so they are not part of the deletion that follows closing an account: they run out the same retention window as any live account.
- A breach affecting customer content is notified without undue delay, by email to the account or security contact on file, with what is known at the time, and the notice is updated as the picture gets clearer.

## Return, deletion and precedence

- Before terminating, the customer can export audit records as CSV or JSON, or through webhook or SIEM export on Enterprise. On termination the account is locked out and its keys revoked at once; the [Return and deletion](https://tileward.com/dpa/#rest) clause sets out what happens to stored content. A conversation last used before the audit retention window has no usage record left to find it by; the customer emails [hello@tileward.com](mailto:hello@tileward.com) and Tileward removes it by hand.
- Where this addendum and the [terms of service](https://tileward.com/terms/) conflict on the processing of personal data, this addendum governs.

The full text is at https://tileward.com/dpa/.

## Related

- [Privacy policy](https://tileward.com/privacy/): what Tileward holds, retention windows and account deletion
- [Annex II: security](https://tileward.com/security/): technical and organisational measures
- [Annex III: sub-processors](https://tileward.com/subprocessors/): each vendor, its purpose and the data it sees
- [Terms of service](https://tileward.com/terms/): the agreement this addendum sits beside