TrustAI Data Processing Addendum
Effective November 12, 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between Provar Limited, a company incorporated in England and Wales (company no. 08999736) (“Provar”), and the customer that has accepted the TrustAI Terms of Service (“Customer”), by signing an Order Form (the “Agreement”). It applies whenever Provar processes Customer Personal Data in providing TrustAI. No separate signature is needed.
Key terms
| Agreement | The TrustAI Terms of Service and each Order Form under them |
| DPA effective date | The date the Agreement starts |
| Customer’s role | Controller, or processor on behalf of its own clients |
| Provar’s role | Processor, or sub-processor where Customer is a processor |
| Security incident notice | Within 72 hours after Provar becomes aware of it (Section 6) |
| Security measures | Annex 2 |
| Sub-processor list | provar.com/subprocessors |
| Sub-processor notice method | Email to Customer’s notice addresses and an update to the sub-processor page |
| Retention and deletion | Section 8, including maximum periods by data type (8.5) |
| Privacy contact | privacy@provartesting.com |
| Governing law | As in the Agreement, except as Annex 4 says for the Standard Contractual Clauses |
1. Definitions
Capitalized terms not defined here have the meanings in the Agreement.
- “Customer Personal Data” means personal data within Customer Data that Provar processes on Customer’s behalf in providing TrustAI.
- “Data Protection Laws” means all laws on privacy and personal data that apply to a party’s processing of Customer Personal Data, including the UK GDPR and the Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act.
- “personal data,” “controller,” “processor,” “processing” and “data subject” have the meanings in the applicable Data Protection Laws, and include equivalent terms such as “personal information,” “business” and “service provider.”
- “Restricted Transfer” means a transfer of Customer Personal Data that, without the measures in Annex 4, would be prohibited by Data Protection Laws.
- “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data held by Provar or its sub-processors. It does not include unsuccessful attempts that do not compromise security, such as pings, port scans or failed log-in attempts.
- “Standard Contractual Clauses” means the EU standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, and “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner.
2. Roles and scope
2.1 Customer is a controller of Customer Personal Data, or a processor acting for its own clients. Provar is a processor, or a sub-processor where Customer is a processor.
2.2 Annex 1 describes the processing. TrustAI is built for test systems with synthetic or masked data, and Customer’s obligations on what data goes into TrustAI are in Terms Section 4. Customer Personal Data is therefore expected to be limited to Authorized Users’ account details, unless the parties agree otherwise in a signed amendment.
2.3 This DPA lasts as long as Provar processes Customer Personal Data.
2.4 If this DPA and the Agreement conflict on the processing of personal data, this DPA controls. If this DPA and the Standard Contractual Clauses or UK Addendum conflict, the clauses control. Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, to the extent Data Protection Laws allow.
2.5 Provar is an independent controller, not Customer’s processor, of: (a) business contact and account details it uses to manage its relationship with Customer, including billing and communications; (b) Usage Data under Terms Section 7.3; and (c) Program Data once scrubbed under Section 13.7. Provar’s privacy notice at https://provar.com/privacy-policy/ covers that processing.
3. Processing on instructions
3.1 Provar will process Customer Personal Data only on Customer’s documented instructions, including with regard to transfers, unless the law requires otherwise, in which case Provar will tell Customer first unless the law prohibits it. The Agreement, this DPA and Customer’s use and configuration of TrustAI are Customer’s complete instructions. Additional instructions need Provar’s written agreement.
3.2 Provar will tell Customer if it believes an instruction breaks Data Protection Laws, but it has no duty to monitor Customer’s compliance.
3.3 Customer is responsible for the lawfulness of its instructions and of the data it provides, including having any notices, consents or other legal basis needed for Provar to process Customer Personal Data, and, where Customer is a processor, its client’s authorization.
3.4 Provar will ensure that everyone it authorizes to process Customer Personal Data, including employees and individual contractors who work under Provar’s direction, is bound by confidentiality obligations, written or statutory, follows Provar’s security policies, and is trained appropriately. These people are Provar personnel, not sub-processors.
4. Sub-processors
4.1 Customer authorizes Provar to use the sub-processors listed on Provar’s sub-processor page (see Annex 3).
4.2 Before a sub-processor processes Customer Personal Data, Provar will put it under a written contract with data protection obligations no less protective than this DPA. Provar remains responsible for its sub-processors’ performance as for its own.
4.3 Provar will give at least 30 days’ notice before a new sub-processor processes Customer Personal Data, by email to Customer’s notice addresses and by updating the sub-processor page.
4.4 Customer may object on reasonable data protection grounds within 30 days after notice. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Order Form by notice, and Provar will refund prepaid fees for the remaining term. This is Customer’s only remedy for an objection.
4.5 Provar may replace a sub-processor on shorter notice where needed to protect the security of the Service or comply with law, and will tell Customer as soon as reasonably possible.
5. Security
5.1 Provar will maintain technical and organizational measures appropriate to the risk, including those in Annex 2. Provar may update them, but will not materially reduce the overall protection of Customer Personal Data.
5.2 Customer is responsible for its own security choices, including user access, single sign-on, the credentials it provides and the security of its Test Systems, as described in the Agreement.
6. Security incidents
6.1 Provar will notify Customer by email, to the security contact in the Order Form or, if none, to Customer’s notice addresses, without undue delay, and within the security incident notice period in the Key terms table above, after becoming aware of a Security Incident. This Section 6 also applies to security incidents affecting other Customer Data, not only Customer Personal Data.
6.2 The notice will describe, to the extent then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Provar will update Customer as more becomes known.
6.3 Provar will take reasonable steps to contain and investigate the incident and reduce its effects, and will reasonably help Customer meet its own obligations to notify regulators and data subjects.
6.4 Notice of a Security Incident is not an admission of fault or liability.
7. Assistance
7.1 Data subject requests. If Provar receives a request from a data subject about Customer Personal Data, it will pass it to Customer and will not respond itself unless the law requires it. Taking into account the nature of the processing, Provar will reasonably help Customer respond to requests it cannot handle through TrustAI’s own features.
7.2 Impact assessments. On request, Provar will give Customer information reasonably needed for a data protection impact assessment or prior consultation with a regulator about TrustAI, to the extent Customer cannot get it elsewhere.
7.3 Provar may charge reasonable fees for assistance beyond what TrustAI’s features and Provar’s standard documentation provide, unless the request results from Provar’s breach of this DPA.
7.4 Government requests. If a court, regulator or other public authority asks Provar for Customer Personal Data, Provar will try to redirect the request to Customer, will tell Customer promptly unless the law forbids it, will challenge requests it reasonably believes are unlawful, and will disclose only the minimum the law requires.
8. Retention, deletion and return
8.1 During the term, Customer can archive and restore projects in TrustAI. Provar will complete a written request to delete specific Customer Data within 30 days, where the law allows. Once deletion starts, the data cannot be recovered.
8.2 Provar will remove Credentials from its live systems within 30 days after Customer disconnects or deletes them, or after the Agreement ends, whichever comes first. Backup copies expire as set out in Section 8.5.
8.3 If Customer asks in writing within 30 days after the Agreement ends, Provar will give Customer a copy of its Customer Data in a commonly used format. Provar will delete Customer Data, including Customer Personal Data, within 30 days after that 30-day period ends. Copies in backups and older versions of stored files expire as set out in Section 8.5. On request, Provar will confirm deletion in writing.
8.4 Provar may keep Customer Data only where the law requires it, under a legal hold, or in backups until they expire under Section 8.5. Retained data stays protected by this DPA and is used only for the purpose it is kept for.
8.5 This Section applies to all Customer Data, not only personal data. Unless Section 8.4 applies, Provar keeps each type of data no longer than the period below. Provar may shorten a period without updating this DPA.
| Type of data | Kept no longer than |
|---|---|
| Customer Data in the Service, including requirements, tests, results, transcripts and screenshots | The term, until deleted on Customer’s request (Section 8.1) or after the Agreement ends (Section 8.3) |
| Older versions of stored files | 90 days after they are replaced |
| Database backups | 60 days |
| Operational logs, which may include Authorized Users’ IP addresses | 365 days |
| AI request metadata (no prompt or response content) | 30 days |
| Credentials | 30 days after disconnection or the end of the Agreement, whichever comes first |
9. Audits
9.1 Provar will keep records of its processing as Data Protection Laws require, and will make available the information reasonably needed to show compliance with this DPA.
9.2 On request, and under confidentiality terms, Provar will give Customer its most recent SOC 2 Type II report or an equivalent third-party audit report. Customer may share it with its regulators.
9.3 Customer may audit Provar’s relevant processing only if the report in Section 9.2 does not reasonably show compliance, a regulator requires it, or after a Security Incident affecting Customer Personal Data. Any audit will be carried out by Customer or an independent auditor bound by confidentiality, on at least 30 days’ notice, during business hours, no more than once a year unless a regulator requires more, at Customer’s cost, and in a way that does not disrupt Provar’s operations or other customers’ data.
9.4 Audits do not extend to the facilities of AWS or other sub-processors; Provar will instead provide their available audit reports.
10. International transfers
10.1 Provar is established in the UK and provides TrustAI from AWS data centers in the locations listed on the sub-processor page. Each customer’s Customer Data is stored in one region, which Provar confirms to Customer when it sets up Customer’s account. Provar will not move Customer’s stored data to another region without Customer’s agreement. Provar’s staff in the United Kingdom, and the staff of its sub-processors, may access Customer Personal Data to operate and support TrustAI. Customer authorizes Provar and its sub-processors to process Customer Personal Data in the United Kingdom and in the countries listed on the sub-processor page.
10.2 Annex 4 sets out the measures that apply to Restricted Transfers. Provar will ensure that its own onward transfers to sub-processors are covered by a valid transfer mechanism.
11. US state privacy laws
Where US state privacy laws apply, Provar is Customer’s service provider or contractor, and Provar will not:
- sell or share Customer Personal Data, as those terms are defined in those laws;
- retain, use or disclose it for any purpose other than providing TrustAI under the Agreement, or as those laws otherwise permit;
- retain, use or disclose it outside the direct business relationship with Customer; or
- combine it with personal data Provar receives from others, except as those laws permit.
Provar will tell Customer if it can no longer meet these obligations, and Customer may then take reasonable steps to stop and remedy unauthorized use. Provar will comply with its obligations under those laws and provide the level of privacy protection they require, and confirms it understands these restrictions.
12. Customers that are processors
12.1 Where Customer processes personal data on behalf of its own clients, including as a consultancy or systems integrator, Customer confirms that its instructions to Provar, including the appointment of Provar as a sub-processor, are authorized by each client.
12.2 Customer is Provar’s sole point of contact. Customer will pass on any notices from Provar to its clients and pass on its clients’ instructions and requests to Provar. Provar’s obligations under this DPA are owed to Customer.
13. AI processing
13.1 AI is part of the service. Customer instructs Provar to process Customer Data, including any Customer Personal Data in it, with AI models to generate, run, grade and repair tests, as described in Annex 1.
13.2 Where models run. TrustAI’s AI models run through Amazon Bedrock within Provar’s own AWS account and, unless otherwise agreed in writing, in the same geography as Customer’s hosting region (Section 10.1), at the locations listed on the sub-processor page. AWS states that model providers have no access to prompts or outputs, and Provar’s model gateway does not log prompt or response content, except temporarily in exigent circumstances, such as investigating a security incident or abuse, limited to the affected requests and deleted once the investigation ends. Changing models or model versions within Amazon Bedrock is not a change of sub-processor. Any AI provider that would receive Customer Personal Data outside Provar’s AWS account is a new sub-processor under Section 4. This does not apply to a model endpoint, AWS account or other service that Customer directs TrustAI to use with Customer’s own keys. That service acts for Customer, not Provar, and is not Provar’s sub-processor.
13.3 No training. Provar will not use Customer Personal Data to train, fine-tune or improve any AI model, and will not permit any model provider to do so.
13.4 No decisions about individuals. TrustAI evaluates the behavior of Customer’s AI agents and applications. It does not make decisions about individuals that have legal or similarly significant effects on them.
13.5 Synthetic data. Personas and simulated customer messages that TrustAI generates are fictional and are not intended to relate to real people. Customer will not instruct TrustAI to base personas on real individuals.
13.6 AI governance information. On request, Provar will give Customer information reasonably needed for its own AI risk assessments and governance, such as the model families TrustAI uses, how they are hosted, and how Customer Data flows through them.
13.7 Quality improvement program. Unless Customer has opted out under Terms Section 6.4, Customer instructs Provar to remove personal data from Program Data, and that removal is processing on Customer’s instructions under this DPA. Provar’s later use of the scrubbed Program Data is not processing on Customer’s behalf. Provar will keep Program Data in de-identified form, will not attempt to re-identify it, and will require anyone it shares it with to do the same.
14. General
14.1 Updates. This DPA is published at provar.com/dataprocessing with its effective date. Provar may update this DPA from time to time, and will email Customer’s notice addresses at least 30 days before any update that materially changes Customer’s rights or Provar’s obligations takes effect. During a subscription term, no update will materially reduce the overall protection of Customer Personal Data, except where required by Data Protection Laws or a regulator. New versions of the Standard Contractual Clauses or UK Addendum apply when issued by the relevant authorities, and changes to sub-processors follow Section 4.
14.2 Signed copy. Customers that need a signed copy for their records may request one at privacy@provartesting.com. The signed copy has the same content as the online version.
14.3 Governing law. This DPA is governed by the law that governs the Agreement, except as Annex 4 provides for the Standard Contractual Clauses.
14.4 Survival. This DPA continues to apply as long as Provar or its sub-processors hold Customer Personal Data.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing TrustAI, Provar’s hosted service for testing AI agents and web applications |
| Duration | The term of the Agreement, plus the periods in Section 8 |
| Nature and purpose | Hosting and storing Customer Data; connecting to Customer’s Test Systems and other services Customer directs; generating, running and grading tests with AI models; producing results; account administration, support and security |
| Data subjects | Customer’s Authorized Users, and any other individuals whose personal data is contained in Customer Data, as determined and controlled by Customer |
| Personal data | Authorized Users’ names, email addresses, roles and organization membership; logs of their activity, including IP addresses; and any other personal data contained in Customer Data, as determined and controlled by Customer |
| Sensitive data | None (see Terms Section 4.2) |
| Frequency | Continuous, while Customer uses TrustAI |
| Locations | As listed on the sub-processor page (Section 10.1) |
| Sub-processors | Annex 3 |
Annex 2: Security measures
These measures apply to TrustAI and may be updated under Section 5.1.
| Area | Measures |
|---|---|
| Governance and certification | Written information security policies, and an annual SOC 2 Type II audit (or equivalent) by an independent auditor |
| Hosting and physical security | Hosted with AWS in the region confirmed to Customer (Section 10.1); physical security provided by AWS under its audited controls |
| Customer isolation | Each customer’s data is logically separated by workspace and is not made available to other customers |
| Access control | Customer users sign in through a method the Service supports, with role-based permissions. Provar staff access to production is limited to those who need it, approved, protected by multi-factor authentication, and logged. Provar staff do not access a customer’s workspace content except to provide support Customer requests, to maintain or secure the Service, or as the law requires |
| Encryption and credentials | Customer Data encrypted at rest, and encrypted in transit over the internet and to the database and AWS services. Credentials kept in a dedicated secrets store, out of AI prompts and logs |
| Network security | Production systems run in private network segments with restricted access |
| AI processing | AI models run within Provar’s own cloud account, in the same geography as Customer’s hosting region, and prompt and response content is not logged except as Section 13.2 allows |
| Logging and monitoring | Staff access to production and permission decisions are logged. Operational logs are designed to exclude customer content and credentials. Systems are monitored with alerting |
| Backups and resilience | Regular backups, with periodic restore testing |
| Secure development | Changes are reviewed before release, and vulnerabilities are assessed and fixed based on risk |
| Personnel | Staff are bound by confidentiality, receive security training, and lose access promptly when they leave |
| Incident response | A written incident response plan, with notice to customers within the period in Section 6.1 |
| Data minimization and retention | Designed for test systems with synthetic or masked data; retention and deletion as in Section 8 |
| Sub-processors | Written contracts with data protection terms before use; listed on the sub-processor page |
Annex 3: Sub-processors
Provar’s sub-processors, and the locations where they process Customer Data, are listed on Provar’s sub-processor page at provar.com/subprocessors, which is the authoritative list.
Model providers such as Anthropic and OpenAI are not sub-processors. Their models run inside Provar’s AWS account through Amazon Bedrock, and AWS states that model providers have no access to the prompts or outputs. Services Customer directs TrustAI to use with its own keys are not Provar’s sub-processors (Section 13.2).
Annex 4: International transfer terms
Data from the UK. Provar is established in the UK and subject to the UK GDPR, so a UK customer’s transfer to Provar is not itself a Restricted Transfer. Provar is responsible for its onward transfers to sub-processors, including its subsidiaries. Those transfers rely on the UK Extension to the EU-US Data Privacy Framework where a US sub-processor is certified, or otherwise on the UK Addendum in Provar’s contract with the sub-processor, including Provar’s intra-group agreement with its subsidiaries.
Data from the EEA. To the extent a transfer from Customer to Provar is a Restricted Transfer not covered by an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA as follows: Module 2 where Customer is a controller, and Module 3 where Customer is a processor. Clause 7 (docking) does not apply. Under Clause 9, Option 2 (general authorization) applies, with the notice period in Section 4.3. Under Clause 11, the optional language does not apply. Clauses 17 and 18: Irish law and the courts of Ireland. Annexes I and II of the clauses are completed by Annexes 1 and 2 of this DPA, and the competent supervisory authority is the one determined under Clause 13.
Data from Switzerland. The Standard Contractual Clauses apply as above, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority for Swiss data.
Order of priority. If these clauses conflict with the rest of this DPA or the Agreement, the clauses control.
This DPA is adapted from the Bonterms Data Protection Addendum v1.0, published by Bonterms and licensed under CC BY 4.0 (creativecommons.org/licenses/by/4.0). Changes were made.