Rapto
Try Free
Back to HomeGDPR Art. 28 • SOC 2 Type II Certified

Data Processing Agreement

Our binding contractual commitment governing the processing, encryption, and protection of Customer Personal Data, incorporating the EU 2021/914 Standard Contractual Clauses (SCCs), UK Addendum, and zero AI foundation model training guarantees.

Effective: August 25, 2026Version 3.2SCCs Modules 2 & 3San Francisco • Dublin • London
Enterprise Compliance Pillars
Pre-Signed & Binding

GDPR Art. 28 & SCC Ready

Includes EU 2021/914 Standard Contractual Clauses (SCCs), UK Addendum, and Swiss cross-border data transfer safeguards.

Contractual Commitment

Zero AI Model Training Guarantee

Customer meeting audio, transcripts, action items, and embeddings are strictly never used to train public or foundational LLMs.

30-Day Prior Notice

Sub-processor Governance

Rigorous SOC 2 / ISO 27001 vendor auditing, documented pass-through obligations, and an explicit customer objection mechanism.

Rapid Response

48-Hour Incident SLA

Contractual commitment to notify Controller without undue delay and within 48 hours of any confirmed Personal Data Breach.

Binding Addendum Preamble

Data Processing Agreement & Standard Contractual Clauses

This Agreement sets out the framework for processing personal data on behalf of Customer in accordance with the requirements of European Data Protection Laws, UK GDPR, and the California Consumer Privacy Act. By utilizing Rapto's AI meeting intelligence platform, the parties agree to be bound by the terms below.

Processor (Rapto):

Rapto Technologies, Inc.

548 Market St, Suite 39201, San Francisco, CA 94104, United States

Controller (Customer):

Customer Workspace / Entity

As identified in the Master Services Agreement

1

Definitions & Interpretation

Foundational legal definitions under GDPR, UK GDPR, CCPA/CPRA, and applicable data protection legislation.

This Data Processing Agreement ("DPA") supplements and forms an integral part of the Rapto Master Services Agreement, Terms of Service, or Enterprise Order Form (the "Agreement") entered into between Rapto Technologies, Inc. ("Rapto", "Processor", "we", or "us") and the customer entity executing the Agreement ("Customer", "Controller", or "you").

Terms used but not defined herein shall have the meanings assigned to them in the Agreement or in Applicable Data Protection Law. In the event of any conflict between this DPA and the Agreement regarding personal data processing, this DPA shall govern and control.

  • "Applicable Data Protection Law" means all worldwide privacy and data protection laws applicable to the Personal Data, including Regulation (EU) 2016/679 (GDPR), the UK Data Protection Act 2018 (UK GDPR), the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act of 2018 as amended by the CPRA (CCPA), and related state privacy statutes.
  • "Customer Personal Data" means any Personal Data contained within meeting audio recordings, live transcription streams, calendar events, meeting summaries, task allocations, participant metadata, or integration payloads processed by Rapto on behalf of Customer.
  • "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", and "Supervisory Authority" shall have the meanings given in the GDPR or equivalent terms in Applicable Data Protection Law.
  • "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Rapto's custody or control.
  • "Sub-processor" means any third-party infrastructure provider, API vendor, hosting facility, or subcontractor engaged by Rapto who processes Customer Personal Data in connection with the Services.
  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 for the transfer of personal data to third countries.
2

Scope, Roles & Documented Instructions

Clarifies that Customer is the Controller and Rapto acts strictly as the Processor upon documented instructions.

Strict Processing Boundaries & Zero AI Foundation Model Training

Rapto contractually covenants that Customer Personal Data (including audio streams, diarized transcripts, meeting notes, action items, and vector embeddings) shall NEVER be used to train, retrain, fine-tune, or calibrate public or foundational Artificial Intelligence models, nor disclosed to third-party model providers for their independent training purposes.

The parties acknowledge and agree that with respect to Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of a third-party Controller) and Rapto is the Processor acting solely on Customer's documented instructions.

Rapto shall process Customer Personal Data exclusively for the purpose of providing, maintaining, securing, and supporting the AI meeting intelligence platform in accordance with the Agreement, this DPA, and Customer's platform configurations.

2.1 Customer Instructions

Customer instructs Rapto to process Customer Personal Data in accordance with:

  • The provision of real-time transcription, speaker diarization, executive summaries, meeting memory graphs, and task automation requested by Customer's authorized users.
  • Processing initiated through Rapto's API, desktop applications, calendar synchronizations (Google Workspace, Microsoft 365), and video conference integrations (Zoom, Google Meet, Microsoft Teams).
  • Written instructions submitted by Customer's designated workspace administrator or security officer.

2.2 Compliance with Laws

Rapto shall immediately inform Customer if, in its reasonable opinion, any instruction received from Customer infringes Applicable Data Protection Law.

3

Confidentiality & Personnel Obligations

Strict non-disclosure agreements, background verifications, and least-privilege access controls for Rapto personnel.

Rapto ensures that any employee, contractor, or representative authorized to access or process Customer Personal Data is subject to rigorous organizational safeguards.

  • Binding Confidentiality: All personnel sign comprehensive non-disclosure agreements that survive the termination of employment.
  • Background Checks: Verification of identity, criminal history checks (where legally permissible), and reference verifications prior to granting production access.
  • Mandatory Security & Privacy Training: Annual mandatory training on GDPR, CCPA, OWASP Top 10, data minimization, and incident escalation procedures.
  • Least Privilege & Zero Standing Access: Production systems operate under strict Role-Based Access Control (RBAC), multi-factor hardware keys (FIDO2/WebAuthn), and ephemeral time-bounded access approvals requiring dual authorization.
4

Technical & Organizational Security Measures (TOMs)

Multi-layered enterprise encryption, hardware security modules, network isolation, and continuous vulnerability scanning.

Cryptographic Architecture & Key Management

All Customer Personal Data is encrypted in transit using TLS 1.3 with Perfect Forward Secrecy (PFS) and at rest using AES-256 with envelope encryption managed via AWS Key Management Service (KMS) with automatic annual key rotation. Dedicated Customer-Managed Encryption Keys (CMEK) / BYOK are available for Enterprise accounts.

Rapto implements and maintains state-of-the-art technical, physical, and organizational measures designed to protect Customer Personal Data against accidental destruction, unauthorized disclosure, or illicit access. These measures are detailed comprehensively in Annex II.

  • Data at Rest: Encrypted with FIPS 140-3 validated AES-256 encryption across all primary databases, object storage buckets, vector indexes, and backups.
  • Data in Transit: Mandatory TLS 1.3 across all external endpoints and internal service-to-service microsegmentation via mTLS (mutual TLS).
  • Network Segmentation: Isolated Virtual Private Clouds (VPCs) with zero direct public ingress to database clusters, strictly firewalled via Next-Gen WAF.
  • Continuous Vulnerability Management: Daily automated static (SAST) and dynamic (DAST) code scanning, third-party dependency auditing (Snyk/Dependabot), and annual external black-box penetration testing.
5

Sub-processors & Vendor Governance

Rules governing the appointment, auditing, notification, and objection process for third-party sub-processors.

Customer provides general written authorization for Rapto to engage the third-party Sub-processors listed in Annex III of this DPA to support the delivery of the Services.

5.1 Flow-Down Contractual Obligations

Before engaging any Sub-processor, Rapto executes a written agreement imposing data protection obligations no less restrictive than those imposed on Rapto under this DPA, specifically including GDPR Article 28(3) requirements and strict confidentiality covenants.

5.2 Notice of Sub-processor Changes & Right to Object

Rapto maintains an active sub-processor registry and provides at least thirty (30) calendar days' prior written notice to Customer's designated administrative contact before onboarding any new Sub-processor or replacing an existing one.

Customer may object to the appointment of a new Sub-processor on legitimate data protection grounds by notifying Rapto in writing within fourteen (14) days of receiving notice. In such case, Rapto and Customer shall work in good faith to resolve the concern or provide alternative platform configurations.

5.3 Sub-processor Liability

Rapto remains fully liable to Customer for the performance of each Sub-processor's obligations to the same extent as if performed directly by Rapto.

6

Data Subject Rights & Assistance

Procedures and automated tools for responding to Data Subject Requests (DSRs) for access, erasure, correction, and portability.

Taking into account the nature of the processing, Rapto provides Customer with self-service tools and technical capabilities to assist Customer in fulfilling its statutory obligations to respond to Data Subject Requests under GDPR, UK GDPR, and CCPA/CPRA.

  • Right of Access & Portability: Workspace administrators can export complete meeting transcripts, diarized speaker segments, summary payloads, and action items in structured, machine-readable formats (JSON, CSV, PDF) via the Rapto Admin Console or REST API.
  • Right to Rectification & Erasure: Administrators can edit speaker attribution, redact sensitive audio segments, or trigger permanent cryptographic deletion of individual transcripts or entire workspace histories.
  • Data Subject Direct Inquiries: If Rapto receives a request directly from a Data Subject, Rapto shall promptly redirect the Data Subject to submit their request directly to Customer as the Controller, and notify Customer within forty-eight (48) hours.
7

Personal Data Breach Notification & Response

Unconditional commitment to notify Controller within 48 hours of any confirmed security breach, with full forensic disclosure.

Incident Notification & Transparency Protocol

Breach notifications will be sent directly to Customer's primary security contact and administrator email address, accompanied by preliminary technical impact assessments and dedicated incident response coordination.

In the event of a confirmed Security Incident or Personal Data Breach affecting Customer Personal Data, Rapto shall notify Customer without undue delay and, in any event, within forty-eight (48) hours of becoming aware of the incident.

  • Nature and Scope: A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and records affected.
  • Remediation & Mitigation: Immediate containment measures implemented by Rapto and recommended steps for Customer to mitigate potential adverse effects.
  • Point of Contact: Name and contact details of Rapto's Data Protection Officer and Lead Security Incident Commander.
  • Forensic Log Retention: Preservation of all relevant access logs, network telemetry, and forensic artifacts for regulatory submission.
8

DPIAs & Supervisory Consultation

Assistance with customer Data Protection Impact Assessments (DPIA), Transfer Impact Assessments (TIA), and regulatory audits.

Taking into account the nature of processing and the information available to Rapto, Rapto shall provide reasonable assistance to Customer in conducting:

  • Data Protection Impact Assessments (DPIAs) concerning the deployment and algorithmic operation of Rapto's meeting intelligence features.
  • Transfer Impact Assessments (TIAs) evaluating the legal protections and surveillance risks associated with international data flows.
  • Prior consultations with competent Supervisory Authorities (such as European DPAs or the UK Information Commissioner's Office (ICO)).
9

Data Deletion, Return & Retention Schedules

Protocols for customer-initiated deletion, post-termination hard delete within 30 days, and cryptographic shredding.

Upon termination or expiration of the Agreement, or upon written request from Customer, Rapto shall, at Customer's choice, securely return or permanently delete all Customer Personal Data in its possession or control.

9.1 Post-Termination Erasure Schedule

Customer may export all workspace data within thirty (30) days following contract termination.

Following the 30-day grace period, Rapto permanently initiates automated cryptographic deletion of all Customer Personal Data across primary databases, vector clusters, and cache nodes.

Encrypted secondary disaster recovery backups are overwritten and expunged in the ordinary course of business within a maximum cycle of thirty (30) calendar days.

9.2 Deletion Certification

Upon written request from Customer, Rapto shall provide a formal Certificate of Destruction signed by an executive officer confirming that all Customer Personal Data has been permanently deleted in compliance with NIST SP 800-88 Rev. 1 media sanitization standards.

10

Audits, Certifications & Compliance Verification

Third-party SOC 2 Type II reports, ISO 27001 certifications, penetration testing summaries, and customer audit rights.

Rapto regularly undergoes independent third-party audits to demonstrate ongoing compliance with industry-leading security and privacy frameworks.

  • SOC 2 Type II Audit: Rapto provides Customer with its latest annual SOC 2 Type II report (covering Security, Confidentiality, and Availability trust principles) upon request under NDA.
  • Penetration Testing: Rapto conducts at least annual penetration tests performed by reputable, CREST-certified independent cybersecurity firms, with executive summaries available to enterprise customers.
  • Customer Audit Rights: Where required by Applicable Data Protection Law or in the event of a confirmed Security Incident, Customer (or an independent third-party auditor under NDA) may conduct an audit of Rapto's data processing facilities upon thirty (30) days' prior written notice during normal business hours.
11

International Cross-Border Data Transfers

Legal transfer mechanisms including EU Standard Contractual Clauses (2021/914), UK IDTA, and Swiss Addendum.

If the processing of Customer Personal Data involves a transfer of personal data outside the European Economic Area (EEA), United Kingdom, or Switzerland to a country not recognized as offering an adequate level of data protection, the parties agree that such transfer shall be governed by the applicable Standard Contractual Clauses incorporated into this DPA.

11.1 European Union Transfers (EU SCCs)

The European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated by reference as follows:

  • Module Two (Controller-to-Processor) applies where Customer is a Controller and Rapto is a Processor.
  • Module Three (Processor-to-Processor) applies where Customer is a Processor on behalf of a third party and Rapto is a Sub-processor.
  • Clause 7 (Docking Clause) shall apply.
  • Clause 9 (Use of Sub-processors): Option 2 (General written authorization) applies with a 30-day notice period.
  • Clause 11 (Redress): The optional requirement that Data Subjects may lodge a complaint with an independent dispute resolution body does not apply.
  • Clause 17 & 18 (Governing Law & Jurisdiction): The laws and courts of the Republic of Ireland shall govern.

11.2 United Kingdom Transfers (UK Addendum)

Transfers subject to UK GDPR shall be governed by the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (v B1.0), with the UK Information Commissioner's Office (ICO) designated as the supervisory authority.

11.3 Swiss Transfers (FADP)

Transfers subject to the Swiss Federal Act on Data Protection (FADP) shall be governed by the EU SCCs, with references to the GDPR construed as references to the FADP and the Federal Data Protection and Information Commissioner (FDPIC) as the competent authority.

12

Liability, Precedence & Governing Law

Liability allocation, relationship with the Master Services Agreement, and governing jurisdiction.

Each party's liability arising out of or related to this DPA (whether in contract, tort, or under any other theory of liability) shall be subject to the limitations and exclusions of liability set forth in the Agreement, except where prohibited by Applicable Data Protection Law.

In the event of any inconsistency or conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection obligations. With respect to transfers governed by the Standard Contractual Clauses, the SCCs shall take precedence over all other agreements between the parties.

Annex I

Annex I: Details of Processing & Data Subjects

Standard Contractual Clauses Appendix 1 information regarding data subjects, data categories, and nature of processing.

A. List of Parties

Data Exporter (Controller): Customer entity utilizing the Rapto meeting intelligence platform.

Data Importer (Processor): Rapto Technologies, Inc., 548 Market St, Suite 39201, San Francisco, CA 94104. Contact: privacy@rapto.cloud.

B. Categories of Data Subjects

Customer's authorized users, employees, contractors, advisors, meeting attendees, conference call participants, interview candidates, and third parties participating in recorded and analyzed meetings.

C. Categories of Personal Data

  • Profile & Identity: Names, email addresses, job titles, profile pictures, calendar metadata, meeting invitations.
  • Meeting Content: Audio streams, video feeds (if screen sharing is captured), diarized voice transcripts, spoken text, conversational notes, executive summaries.
  • Actionable Intelligence: Assigned tasks, commitments made, milestone deadlines, follow-up items, semantic memory graphs.

D. Sensitive Data (Special Categories)

Rapto does not intentionally collect or require special categories of personal data (GDPR Article 9). However, if spoken during a recorded meeting, such data may be processed incidental to speech-to-text transcription.

E. Frequency and Duration of Processing

Continuous processing during the active term of the Master Services Agreement. Data is stored until deleted by Customer or purged thirty (30) days post contract termination.

Annex II

Annex II: Technical & Organizational Security Measures

Technical and organizational measures implemented by Rapto in accordance with GDPR Article 32 and SOC 2 Type II controls.

Access Control & Identity

Least privilege access models with biometric hardware MFA and zero standing administrative privileges.

Role-Based Access Control (RBAC)SOC 2 CC6.1, CC6.2

Granular access permissions assigned strictly on a need-to-know basis. Quarterly administrative access recertification.

Hardware Multi-Factor AuthenticationNIST SP 800-63B AAL3

Mandatory FIDO2/WebAuthn hardware security keys required for all engineering personnel accessing production networks.

Single Sign-On (SSO) & SCIMISO 27001 A.9

SAML 2.0 and OIDC enterprise SSO integrations with automated just-in-time user provisioning and immediate deprovisioning.

Data Encryption & Key Management

End-to-end cryptographic safeguards across all states of data lifecycle.

Encryption at Rest (AES-256)SOC 2 CC6.6, CC6.7

All primary databases, file stores, backups, and vector embeddings are encrypted using FIPS 140-3 validated AES-256.

Encryption in Transit (TLS 1.3)NIST SP 800-52 Rev. 2

Enforced TLS 1.3 with Perfect Forward Secrecy (PFS) and HSTS. Microservice-to-microservice traffic secured via mTLS.

Customer-Managed Encryption Keys (CMEK/BYOK)FIPS 140-3 Level 3

Enterprise capability to manage and revoke root encryption keys hosted within Customer's own AWS KMS or Azure Key Vault.

Infrastructure & Network Defense

Hardened cloud perimeter with proactive defense-in-depth architecture.

Zero Ingress Database IsolationCIS AWS Benchmarks

Databases reside in private isolated subnets with no public IP routes, accessible only through hardened internal bastions.

Web Application Firewall (WAF) & DDoS DefenseSOC 2 CC6.6

Continuous edge inspection mitigating OWASP Top 10 exploits, rate limiting, and terabit-scale DDoS attacks.

Automated Vulnerability Scanning (SAST/DAST)ISO 27001 A.12.6

Continuous CI/CD pipeline code analysis, software bill of materials (SBOM) tracking, and zero-day dependency alerting.

Incident Response & Business Continuity

Tested disaster recovery with redundant failover and automated backups.

24/7 Security Operations & SIEMSOC 2 CC7.2, CC7.3

Automated telemetry ingestion with real-time anomaly detection and dedicated on-call Incident Commanders.

Continuous Replication & Point-in-Time RecoveryISO 22301 / SOC 2 CC9.1

RPO < 15 minutes, RTO < 2 hours with automated cross-region database replication and monthly recovery drill simulations.

Cryptographic Sanitization & DeletionNIST SP 800-88 Rev. 1

Adherence to NIST SP 800-88 Rev. 1 media sanitization standards for verified data erasure and customer workspace shredding.

Annex III

Annex III: Authorized Sub-processors Registry

Current third-party infrastructure and sub-processors authorized to process Customer Personal Data under GDPR Article 28(2).

Filter:

Amazon Web Services (AWS)

Cloud Infrastructure
Compliance Portal
Processing Purpose:

Primary cloud hosting, encrypted database clusters, object storage (S3), and KMS key management.

Primary Location / Cloud Region:

United States (us-east-1, us-west-2) & EU (eu-central-1 Frankfurt) option

Safeguards & Safeguards:

SOC 1/2/3, ISO 27001/27017/27018, HIPAA, FedRAMP, EU SCCs

Data Scope: All Customer Personal Data, encrypted transcripts, backups, and system logs.

Cloudflare, Inc.

Edge & Security
Compliance Portal
Processing Purpose:

Edge CDN, DDoS protection, Web Application Firewall (WAF), and global DNS routing.

Primary Location / Cloud Region:

Global Edge Network (285+ cities worldwide)

Safeguards & Safeguards:

SOC 2 Type II, ISO 27001, PCI-DSS Level 1, EU SCCs

Data Scope: IP addresses, request headers, transit metadata, encrypted network payloads.

OpenAI, LLC (Enterprise Zero Data Retention)

AI Inference & Models
Compliance Portal
Processing Purpose:

Zero-retention real-time text processing, semantic summarization, and action item extraction via dedicated enterprise API.

Primary Location / Cloud Region:

United States (Dedicated Enterprise Endpoints)

Safeguards & Safeguards:

SOC 2 Type II, Strict Business Associate Agreement (BAA), Enterprise DPA with Zero Data Retention (ZDR)

Data Scope: Meeting text chunks for summarization during active API requests. ZERO data retention; zero model training.

Anthropic, PBC (Enterprise Tier)

AI Inference & Models
Compliance Portal
Processing Purpose:

Long-context meeting intelligence synthesis, commitment tracking, and multi-meeting graph correlation.

Primary Location / Cloud Region:

United States (Dedicated Enterprise Tenant)

Safeguards & Safeguards:

SOC 2 Type II, HIPAA-ready, Zero Retention Commercial Terms, EU SCCs

Data Scope: Anonymized transcript text segments during synthesis. Zero data retention; zero model training.

Pinecone Systems, Inc.

Cloud Infrastructure
Compliance Portal
Processing Purpose:

Isolated dedicated vector database for indexing and querying semantic meeting embeddings.

Primary Location / Cloud Region:

United States / EU Dedicated Cloud

Safeguards & Safeguards:

SOC 2 Type II, HIPAA Compliant, ISO 27001, AWS PrivateLink isolation

Data Scope: Mathematical vector embeddings and anonymized document identifiers (no raw audio stored).

Stripe, Inc.

Billing & Operations
Compliance Portal
Processing Purpose:

Secure payment gateway, subscription management, and corporate invoicing.

Primary Location / Cloud Region:

United States & Ireland

Safeguards & Safeguards:

PCI-DSS Level 1 Service Provider, SOC 1/2, EU SCCs

Data Scope: Billing contact details, VAT IDs, invoice records (credit card data handled directly by Stripe).

PostHog, Inc. (EU Cloud)

Billing & Operations
Compliance Portal
Processing Purpose:

Product telemetry, error diagnostics, and feature performance monitoring.

Primary Location / Cloud Region:

European Union (Frankfurt, Germany)

Safeguards & Safeguards:

GDPR Compliant EU Hosting, SOC 2 Type II, DPA with SCCs

Data Scope: Aggregated platform interaction telemetry, anonymized session metrics (no meeting transcript content).
Annex IV

Annex IV: US State Privacy Law Addendum (CCPA/CPRA)

Service Provider Certification under the California Consumer Privacy Act (CCPA), as amended by CPRA, and state privacy acts (VCDPA, CPA, CTDPA).

This Addendum applies solely to Customer Personal Data subject to the CCPA/CPRA and comprehensive US state privacy statutes.

Service Provider Certification

  • Rapto certifies that it acts strictly as a “Service Provider” as defined under Cal. Civ. Code § 1798.140(ag).
  • Rapto shall not “Sell” or “Share” Customer Personal Information for cross-context behavioral advertising.
  • Rapto shall not retain, use, or disclose Customer Personal Information outside of the direct business relationship established with Customer.
  • Rapto shall not combine Customer Personal Information with personal data received from other entities, except as permitted under CCPA regulations.
Enterprise Legal Operations

Need a Counter-Signed Copy or Custom Enterprise Redline?

Our compliance team provides instantaneous pre-signed execution packages, custom Business Associate Agreements (BAAs), and dedicated security vendor questionnaires.

Contact Legal Team

Ready to keep every meeting promise?

Onboard your entire team in under 5 minutes. Flat team rates, zero per-seat anxiety.

Start your free team trialSee a live 15-min demo
No credit card required · 5 free meetings/mo · Works with Zoom, Meet & Teams