Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement (“DPA”) is entered into between Innovera Limited (“Processor” or “we”) and the client entity that uses our services (“Controller” or “you”). This DPA supplements our Terms of Service and Privacy Policy and applies to the processing of personal data on your behalf.

When you submit data through our assessment tools, Microsoft 365 Graph API integration, or file uploads (RVTools, SSM inventory, CSV exports), we act as a processor on your behalf. You remain the controller of your personal data.

2. Categories of Data Processed

We process the following categories of data on your behalf:

• Microsoft 365 tenant data: User lists (names, email addresses, license assignments), subscribed SKUs, secure scores, MFA registration status, organization details
• On-premises infrastructure data: Server names, operating systems, SQL editions, host configurations, VM power states, snapshot data, patch compliance status
• Contact information: Names, email addresses, phone numbers, company names submitted through our forms
• Assessment metadata: EA renewal dates, contract information, infrastructure scope details
• Generated reports: AI-generated diagnostic reports, financial estimates, and recommendations

3. Purpose of Processing

We process your data for the following purposes:

• Generating license optimization diagnostic reports
• Analyzing infrastructure data for cost savings and risk identification
• Providing consulting and advisory services
• Communicating with you about your assessment and results
• Improving our services and platform functionality

We do not process your personal data for our own marketing purposes without your separate consent, nor do we sell your personal data to third parties.

4. Data Storage and Infrastructure

Your data is stored using the following infrastructure:

• Amazon Web Services (AWS): DynamoDB for structured data storage, S3 for file storage, Lambda for processing, API Gateway for API access. All infrastructure is in the US East (N. Virginia) region.
• AI Processing: Data is sent to Anthropic and AWS Bedrock for AI analysis. These providers process data in their respective infrastructure and do not retain your data beyond the processing session.
• Email: Transactional emails (assessment notifications, confirmations) are sent via Resend, a third-party email delivery service.

All data at rest is encrypted using AWS-managed encryption (AES-256). Data in transit is encrypted using TLS 1.2 or higher.

5. Sub-Processors

We engage the following sub-processors to deliver our services:

We require all sub-processors to maintain appropriate security measures and enter into data protection agreements that meet applicable legal requirements. We will notify you in advance of any changes to our sub-processor list.

6. Data Retention

We retain your data for the following periods:

• Active assessment data: Retained for the duration of your engagement plus 90 days
• Generated reports: Retained for 2 years from generation date
• Contact form submissions: Retained for 3 years
• Microsoft 365 Graph API tokens: Deleted upon request or when engagement ends
• Uploaded files (RVTools, CSV, SSM): Deleted 90 days after engagement concludes

You may request earlier deletion of your data at any time by contacting us at privacy@innovera.ai.

7. Security Measures

We implement the following technical and organizational security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• AWS IAM with least-privilege access controls
• API key authentication for all API endpoints
• OAuth 2.0 for Microsoft Graph API access (application permissions only)
• Regular security reviews of infrastructure configuration
• Access logging and monitoring via AWS CloudTrail
• Segregation of client data using partition keys in DynamoDB

8. Data Subject Rights

If we receive a request from a data subject (e.g., one of your employees whose data was included in an assessment), we will forward the request to you. You are responsible for responding to data subject requests as the controller.

We will assist you in fulfilling data subject requests to the extent reasonably possible, including providing access to, correcting, or deleting personal data we process on your behalf.

9. Data Breach Notification

In the event of a personal data breach affecting your data, we will:

• Notify you without undue delay, and in any case within 72 hours of becoming aware of the breach
• Provide details of the nature of the breach, categories and approximate number of data subjects affected, and likely consequences
• Describe the measures taken or proposed to address the breach and mitigate its effects
• Cooperate with you in any required notifications to supervisory authorities or data subjects

10. Cross-Border Data Transfers

Your data is processed and stored in the United States (AWS US East region). If you are located outside the United States, your data will be transferred to the US for processing. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission, supplemented by our security measures described in this DPA.

For more information about international transfers, see our Privacy Policy.

11. Your Obligations

As the controller, you are responsible for:

• Ensuring you have lawful basis to share personal data with us for processing
• Informing your employees or data subjects that their data will be processed by InnCloud.ai
• Ensuring the data you submit is accurate and relevant
• Obtaining any necessary consents before submitting Microsoft 365 tenant data or infrastructure data

12. Audit Rights

You may audit our compliance with this DPA upon reasonable notice (not more than once per year, unless required by a supervisory authority). Alternatively, we will provide you with relevant documentation, including AWS compliance reports (SOC 2, ISO 27001 certificates from AWS) and our security policies, to demonstrate our compliance.

13. Deletion on Termination

Upon termination of our services, we will delete all personal data processed on your behalf within 90 days, unless applicable law requires retention. We will provide written confirmation of deletion upon request.