Auftragsverarbeitungsvertrag (AVV)

Parties and scope

This Data Processing Agreement ("DPA") is concluded between:

Customer (the "Controller"): the legal entity that has accepted the Redact PDF AI Terms of Service and whose details are set out in the signature block; and

Damien Buchs, operating Redact PDF AI as a sole proprietorship, Rue des Fossés 33, 1110 Morges, Switzerland (the "Processor"). The Processor is an individual entrepreneur under Swiss law; references to the Processor's "personnel" mean the Processor himself and any contractor he engages under clause 3.

The Processor provides a web application and API that detects and permanently removes personal data from PDF and image files (the "Service"). Using the Service, the Controller uploads documents that contain personal data of third parties. The Processor processes this data only on the Controller's behalf. This DPA sets out the obligations of both parties under Article 28 GDPR and, where the Controller is subject to it, Article 9 FADP.

This DPA forms part of the Terms of Service (redact-pdf.ai/terms). Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails. Annexes 1 to 3 are part of this DPA.

This DPA is the Processor's standard data processing agreement and applies in the same form to every customer of the Service. It is published at redact-pdf.ai/dpa. Deviations from this DPA are only effective if agreed in writing and signed by the Processor; the Processor is under no obligation to accept customer-specific terms.

Definitions. "Personal Data", "Controller", "Processor", "Processing", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meaning given in Article 4 GDPR. "Customer Data" means all Personal Data the Controller or its users upload to, or that the Service generates from, documents submitted for redaction, including the redacted output, redaction masks, detected entities, pseudonymisation correspondence tables and processing metadata. "Subprocessor" means any third party engaged by the Processor to process Customer Data.

1. Subject matter, duration, nature and purpose

1.1 The subject matter of the processing is the detection and permanent removal (redaction) or replacement by consistent placeholders (pseudonymisation) of personal data contained in documents the Controller submits to the Service.

1.2 The processing lasts for the term of the Controller's use of the Service and ends with the deletion of Customer Data under clause 8.

1.3 The nature of the processing is: upload and storage of source documents; optical character recognition; automated detection of personal data categories selected by the Controller; generation of a redacted or pseudonymised output; storage of masks, detected entities and processing metadata; display of previews in the Controller's account; download of the output. No decisions producing legal effects for Data Subjects are taken by the Service.

1.4 The purpose of the processing is to enable the Controller to remove or pseudonymise personal data in its documents before further use, disclosure or publication.

1.5 The categories of Data Subjects and of Personal Data are described in Annex 1. The Controller determines which documents it submits and remains responsible for the lawfulness of the processing, including the legal basis for submitting documents containing special categories of data.

2. Processing on documented instructions

2.1 The Processor processes Customer Data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union, Member State or Swiss law. In that case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

2.2 The Controller's instructions are given through this DPA, the Terms of Service, the configuration options of the Service (such as selected personal data categories, retention period, redaction or pseudonymisation mode) and the actions of the Controller's authorised users in the application and API. Further instructions must be given in writing, including by e-mail to info@redact-pdf.ai. Instructions that go beyond the functions of the Service require the Processor's written agreement and may be charged at the Processor's then-current rates.

2.3 The Processor does not use Customer Data for its own purposes. In particular, the Processor does not use Customer Data to train, fine-tune or evaluate machine-learning models, whether its own or those of third parties, and configures the AI services of its Subprocessors so that document content is not logged or retained by them for such purposes.

2.4 The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes the GDPR, the FADP or other applicable data protection law. The Processor may suspend the execution of that instruction until the Controller confirms or changes it.

3. Confidentiality

3.1 The Processor ensures that every person authorised to process Customer Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality. This obligation continues after the end of their engagement.

3.2 Access to Customer Data by the Processor's personnel is limited to what is strictly necessary to operate, maintain and support the Service, and to cases where the Controller requests support. Document content is not opened for any other purpose. Administrative access to the cloud consoles and the database is logged by the respective providers.

3.3 Personnel with access to Customer Data are informed about the requirements of applicable data protection law and the obligations under this DPA.

4. Security of processing

4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The measures in place at the date of this DPA are described in Annex 2.

4.2 The Processor may update the measures in Annex 2 as technology and threats evolve, provided that the overall level of security is not reduced. The current version is published at redact-pdf.ai/security.

4.3 The Processor ensures that Customer Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), is logically separated per Controller account, and is stored and processed only in the regions listed in Annex 3.

4.4 The Controller is responsible for the security of its own systems and accounts, including the confidentiality of user credentials and API keys, the appropriate configuration of retention settings, and the handling of downloaded output files.

5. Subprocessors

5.1 The Controller gives the Processor general authorisation to engage Subprocessors for the provision of the Service. The Subprocessors engaged at the date of this DPA, the purpose for which each is used, the location of processing and the applicable transfer mechanism are listed in Annex 3.

5.2 The Processor informs the Controller of any intended addition or replacement of a Subprocessor at least 30 days before the new Subprocessor processes Customer Data, by e-mail to the Controller's account address and by updating the list at redact-pdf.ai/privacy. The Controller may object on reasonable, documented data protection grounds within that period. If the parties cannot resolve the objection within 14 days, the Controller may terminate the affected Service by written notice before the new Subprocessor starts processing Customer Data and receives a pro-rata refund of prepaid fees for the unused period. This termination right is the Controller's sole remedy in respect of an objection.

5.3 The Processor imposes on each Subprocessor, by way of a written contract, data protection obligations that provide at least the same level of protection as this DPA, in particular with regard to security measures, confidentiality and the restriction to documented instructions.

5.4 Where a Subprocessor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that Subprocessor's obligations.

5.5 Only Microsoft Azure processes the content of the Controller's documents. The other Subprocessors in Annex 3 process account, billing, technical or metadata only, as described there.

6. Assistance to the Controller

6.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests for exercising Data Subjects' rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

6.2 The Service lets the Controller search, review, download and delete its own documents and the data derived from them at any time, which covers most Data Subject requests without the Processor's involvement. Where a request cannot be fulfilled through the Service, the Processor provides reasonable assistance within a reasonable time, normally 15 working days, of a written request that identifies the documents or records concerned. The Processor has no means of locating a Data Subject within document content other than by the document references the Controller supplies.

6.3 If the Processor receives a request from a Data Subject directly, it does not respond on the merits but refers the Data Subject to the Controller and informs the Controller without undue delay, insofar as the Controller can be identified.

6.4 Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation). Annex 2 and the Security page provide the information usually required for a data protection impact assessment.

6.5 The Processor may charge reasonable costs for assistance that goes beyond the functions of the Service and the information in this DPA, after informing the Controller in advance.

7. Personal Data Breach

7.1 The Processor notifies the Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, and aims to do so within 72 hours. The Controller remains responsible for its own notification deadlines under Articles 33 and 34 GDPR. Notification is sent to the e-mail address of the Controller's account owner.

7.2 The notification describes, to the extent known at that time: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Information not available at first notice is provided in phases without undue further delay.

7.3 The Processor documents every Personal Data Breach affecting Customer Data, including the facts, its effects and the remedial action taken, and makes this documentation available to the Controller on request.

7.4 The Processor does not notify Supervisory Authorities or Data Subjects on behalf of the Controller unless the Controller instructs it to do so in writing. The Processor does not inform third parties of a breach affecting Customer Data without the Controller's prior consent, unless required by law.

8. Deletion and return of Customer Data

8.1 The Controller can delete any document and the data derived from it at any time through the application or the API. Deletion removes the source file, the redacted output, previews, masks, detected entities, pseudonymisation correspondence tables and the related records.

8.2 Unless the Controller disables it, the Service deletes source and output files automatically after a period of inactivity chosen by the Controller (3, 7 or 14 days; default 14 days). Viewing, downloading or editing a document restarts the period. In the API's ephemeral retention mode, source files are deleted as soon as the output is generated.

8.3 At the end of the provision of the Service, the Processor deletes all remaining Customer Data within 30 days, unless Union, Member State or Swiss law requires continued storage. The Controller may download its output files before the end of the Service; the Processor does not offer a separate return in another format.

8.4 Deletion covers all copies, including backups, within the backup retention cycle of the respective storage service, which the Processor keeps as short as the provider allows and publishes at redact-pdf.ai/security (currently not exceeding 30 days). Billing records required by law (invoice data, page counts, timestamps) are retained for the statutory period and contain no document content.

8.5 On request, the Processor confirms deletion in writing.

9. Audits and information

9.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA.

9.2 The Controller exercises its audit right by reviewing the information the Processor makes available: this DPA and its Annexes, the Security page, the certifications and audit reports of the Subprocessors (in particular Microsoft Azure's SOC 2 Type II and ISO 27001, 27017 and 27018 reports, available through the Microsoft Service Trust Portal) and written answers to a reasonable security questionnaire, provided within 30 working days and at most once per calendar year. The parties agree that, given the size of the Processor and the nature of the processing, this information is in principle sufficient to demonstrate compliance.

9.3 An audit beyond clause 9.2 may be requested only where a Supervisory Authority or mandatory law requires it, or after a Personal Data Breach affecting the Controller's Customer Data. Such an audit is conducted remotely (document review and video call) by the Controller or an independent auditor bound by confidentiality and not a competitor of the Processor, at most once per calendar year, on 30 days' written notice, during business hours, limited to the Processor's processing of Customer Data and in a manner that does not unreasonably disrupt the Processor's operations. On-site inspection of the Processor's premises is not available; the Processor operates no infrastructure of its own. Audits of the Subprocessors' infrastructure are limited to the reports and certifications those Subprocessors make available.

9.4 The Controller bears the costs of an audit under clause 9.3, including the Processor's time spent at a reasonable hourly rate notified in advance. If an audit reveals a material breach of this DPA by the Processor, the Processor bears its own costs and remedies the breach without undue delay.

9.5 The Processor informs the Controller without undue delay of any inspection or measure by a Supervisory Authority that concerns Customer Data, insofar as it is permitted to do so.

10. International transfers

10.1 The Processor is established in Switzerland. The European Commission recognises Switzerland as providing an adequate level of protection (Decision 2000/518/EC, confirmed by the Commission's review of 15 January 2024), so the transfer of Customer Data from the Controller to the Processor requires no additional safeguard under Chapter V GDPR.

10.2 The content of the Controller's documents is stored and processed only in the European Union and Switzerland: files, OCR and personal data detection on Microsoft Azure in North Europe (Ireland), and the API and processing workers on Microsoft Azure in Switzerland North. The Processor does not transfer document content to any other country.

10.3 Some Subprocessors listed in Annex 3 are established in the United States and process account, billing or technical data there. For these transfers the Processor relies on the EU-U.S. Data Privacy Framework and its Swiss-U.S. extension where the Subprocessor is certified, and otherwise on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (module 3, processor to processor), supplemented where required for Switzerland, together with the transfer impact assessments of those Subprocessors.

10.4 Where the Processor intends to engage a Subprocessor in a country without an adequacy decision for the processing of document content, clause 5.2 applies and the Processor puts in place the safeguards required by Chapter V GDPR before any transfer takes place.

10.5 The Processor informs the Controller without undue delay if it becomes aware that a transfer mechanism relied on under this clause is no longer valid, and cooperates with the Controller to identify an alternative or to suspend the affected transfer.

11. Liability, term and governing law

11.1 Each party is liable to Data Subjects in accordance with Article 82 GDPR. Between the parties, the Processor's aggregate liability under this DPA and the Terms of Service, for all claims in a contract year, is limited to the fees the Controller paid for the Service in the 12 months preceding the event giving rise to the claim, except where liability cannot be limited by law (in particular for intent or gross negligence). The Processor is not liable for the lawfulness of the Controller's processing, for the content of the documents the Controller submits or for the Controller's use of the output.

11.2 This DPA enters into force when both parties have signed it, or when the Controller accepts it in the Service, and remains in force for as long as the Processor processes Customer Data. Clauses 3, 7.3, 8 and 9 survive its termination until all Customer Data has been deleted.

11.3 The Processor may amend this DPA to reflect changes in law, in the Service or in its Subprocessors. Amendments are published at redact-pdf.ai/dpa and notified by e-mail at least 30 days before they take effect. An amendment that materially reduces the Controller's protection entitles the Controller to terminate the Service before it takes effect, with a pro-rata refund of prepaid fees; continued use after that date constitutes acceptance.

11.4 If any provision of this DPA is invalid, the remaining provisions remain in force and the parties replace the invalid provision with a valid one that comes closest to its purpose.

11.5 This DPA is governed by Swiss law, excluding its conflict-of-law rules, without prejudice to the mandatory application of the GDPR and of the data protection law of the Member State where the Controller is established. The courts of the Canton of Vaud, Switzerland, have exclusive jurisdiction, subject to mandatory law.

11.6 This DPA is drawn up in English. Any translation is provided for convenience only; in case of discrepancy the English version prevails.

Signatures

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Measures in place as of the date of this DPA, structured along Article 32(1) GDPR and the usual German TOM headings.

Confidentiality

• Physical access control: all infrastructure runs in Microsoft Azure, Supabase (AWS) and Vercel data centres with their physical security controls (ISO 27001, SOC 2 Type II); the Processor operates no servers of its own.
• System access control: administrative access to cloud consoles and the database requires individual accounts with multi-factor authentication; secrets are held in the hosting providers' encrypted environment configuration, never in source code; API keys are stored as peppered SHA-256 hashes and shown once.
• Data access control: Customer Data is scoped to the Controller's account at the application and API layer; every request is authenticated (Clerk session or API key) and authorised against the owning account; no cross-account access paths exist.
• Separation: each Controller's data is logically separated by account identifier in storage and database; development and test environments use storage and AI resources separate from production.
• Pseudonymisation: in pseudonymisation mode, names and identifiers are replaced by consistent tags; the correspondence table is stored separately and is deleted with the document.

Integrity

• Transfer control: TLS 1.2 or higher on every connection (browser, API, worker to storage, worker to AI services); downloads only through time-limited signed URLs.
• Input control: changes to documents and masks are attributed to the authenticated user and timestamped; application and API logs record who did what, without document content.
• Redaction is irreversible: pages are rasterised and masks are burned into the pixels; the output contains no text layer or metadata from the source.

Availability and resilience

• Encryption at rest: AES-256 on Azure Blob Storage and on the managed PostgreSQL database.
• Backups: automated daily database backups by the managed provider, retained for a limited cycle and encrypted; file storage with locally redundant copies.
• Monitoring: uptime, error and queue monitoring (Better Stack, Slack alerts); automated job recovery if a processing worker fails.
• Retention and deletion: automatic deletion job runs continuously; manual deletion is immediate and removes all derived artefacts.

Procedures for regular testing, assessment and evaluation

• Automated test suite and continuous integration run on every change before deployment; dependencies are pinned and updated under review.
• Vulnerability reports are received at security@redact-pdf.ai and triaged within 5 working days.
• Subprocessor certifications and this Annex are reviewed at least annually.
• Incident management: breaches are handled under clause 7 and documented in an incident log.

Organisational measures

• The Processor is a sole operator; no third-party staff have access to Customer Data outside the Subprocessors in Annex 3.
• Data protection by design: only the data categories the Controller selects are detected; document content is never written to logs, analytics or alerts.
• No use of Customer Data for model training; AI services are configured with content logging disabled.

Annex 3: Subprocessors

As of 4 November 2026. The current list is maintained at redact-pdf.ai/privacy.

Only Microsoft Azure processes the content of documents. All other Subprocessors receive account, billing, technical or operational metadata only.