Data Processing Addendum (DPA)

Roles

The tenant is the data fiduciary/controller. SutraAI is the processor, acting only on the tenant\u2019s documented instructions.

Nature & purpose of processing

Hosting the tenant\u2019s knowledge base and providing AI-assisted question answering, retrieval, and (where enabled) live-system actions on the tenant\u2019s behalf.

Sub-processors

• AWS Bedrock (model inference) — region ap-south-1 (India).
• Amazon Titan embeddings — for retrieval indexing.
• Managed database, vector store, and cache infrastructure.

Tenants may bring their own model provider, in which case that provider becomes the sub-processor for inference.

Safeguards

Encryption of secrets, RBAC + MFA, per-tenant isolation, PII masking, prompt-injection defenses, audit logging, and response lineage. Primary data is hosted in India (AWS ap-south-1).

Data-subject requests & breach support

SutraAI provides tooling for tenants to fulfil access/export, correction, and erasure requests, and to record and flag suspected data-breach incidents for follow-up.