Data Processing Addendum

This Data Processing Addendum (including its annexes, this “DPA”) is entered into between Inco AI, Inc., a Delaware corporation with offices at 1881 Page Mill Road, Palo Alto, California 94304 (“Inco”, “we” or “us”), and the customer that accepts it (“Customer” or “you”). It forms part of, and is governed by, the Inco AI Platform Terms of Service at inco.ai/legal/terms, together with any order form or enterprise agreement that references those terms (the “Agreement”). Capitalized terms not defined here have the meanings given in the Agreement.

This DPA applies to the extent Inco Processes Personal Data contained in Customer Content on your behalf and Applicable Data Protection Laws require a contract between us. It governs Inco’s Processing as your processor. Passthrough Models are not available to European Accounts, as defined in the Agreement, and transmission of Customer Content to a Provider when you use a Passthrough Model is not Processing under this DPA; it is governed by Section 4.12 of the Agreement and Section 9.4 below. Inco’s use of Customer Content for the Improvement Purposes and, while the Training Setting is on, for the uses described in Section 5.3 of the Agreement is not Processing on your behalf: Inco carries it out as an independent controller under Section 4A, and the other provisions of this DPA apply to it only to the extent Section 4A says so. Inco will countersign a copy on written request to legal@inco.ai.

1. Definitions

1. “Applicable Data Protection Laws” means the data protection and privacy laws applicable to Inco’s Processing of Personal Data under the Agreement, including, as and to the extent applicable, the GDPR, the FADP, and the State Privacy Laws.

2. “Customer Content” has the meaning given in the Agreement, and means your Inputs and the Outputs generated from them.

3. “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances.

4. “GDPR” means, as applicable to the Processing concerned, Regulation (EU) 2016/679 (the “EU GDPR”) and that regulation as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”), together with any national implementing legislation.

5. “Personal Data” means personal data, personal information, or personally identifiable information, as defined in Applicable Data Protection Laws, that is contained in Customer Content and Processed by Inco on your behalf under the Agreement. It does not include Usage Data, or information Inco collects or generates independently of the Services and not on your behalf, which is described in the Inco Privacy Policy.

6. “Personal Data Breach” means a breach of Inco’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data Processed by Inco. It does not include unsuccessful attempts that do not compromise the security of Personal Data, such as failed log-in attempts, pings, port scans, or denial-of-service attempts.

7. “Process” or “Processing” has the meaning given in the GDPR, and includes holding Personal Data in memory for the duration of a request.

8. “Restricted Transfer” means a transfer of Personal Data to a country that does not benefit from an adequacy decision of, as applicable, the European Commission, the UK Government, or the Swiss Federal Council, and which would otherwise be prohibited under Chapter V of the GDPR or the equivalent provisions of the FADP.

9. “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

10. “State Privacy Laws” means the comprehensive US state data privacy laws in force and applicable to Inco’s Processing under the Agreement, including the California Consumer Privacy Act as amended (the “CCPA”).

11. “Subprocessor” means a third party engaged by Inco to Process Personal Data in connection with the Services.

12. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022.

13. “Services” means the Service as defined in the Agreement.

14. “Usage Data” has the meaning given in the Agreement.

15. “Content Logs”, “Data Settings”, “Improvement Purposes”, “Inco-Served Model”, “Passthrough Model”, “Passthrough Setting”, “Provider”, “Store & Improve Setting”, and “Training Setting” have the meanings given in the Agreement.

2. Roles, Scope, and Duration

2.1 Roles. You are the controller of Personal Data contained in Customer Content, or a processor acting on behalf of another controller. Inco is your processor, or your sub-processor where you are yourself a processor. For Usage Data, account data, billing data, and data collected through the Inco websites, Inco is a controller and its practices are described in the Inco Privacy Policy at inco.ai/legal/privacy rather than in this DPA. For the Improvement Purposes and, while the Training Setting is on, the uses described in Section 5.3 of the Agreement, Inco is an independent controller, and that processing is governed by Section 4A and not by the processor terms of this DPA.

2.2 Scope. This DPA applies only to Inco’s Processing of Personal Data contained in Customer Content and, as provided in Section 4A, to Inco’s independent processing described there. It does not apply to Usage Data, which consists of request metadata and part fingerprints as defined in the Agreement and does not include the text or media content of any request or response.

2.3 Duration. This DPA takes effect when you accept it or begin using the Services, whichever is earlier, and continues for as long as Inco Processes Personal Data, notwithstanding expiry or termination of the Agreement. Where the Store & Improve Setting is off, and except as described in Section 4.1, Processing of any given item of Personal Data ends when the request that carried it is completed and the processing window described in Section 4.3 ends. Where the Store & Improve Setting is on, it ends when the Content Log containing it is deleted under Section 11.1.

2.4 Annexes. Processing subject to the GDPR is also subject to Annex 2 (European Annex). Processing subject to the State Privacy Laws is also subject to Annex 3 (State Privacy Laws Annex). Annex 1 sets out the processing details, Annex 4 the security measures, and Annex 5 the Subprocessors.

3. Customer Instructions

3.1 Documented instructions. Inco will Process Personal Data only on your documented instructions, which consist of this DPA, the Agreement, and any further written instructions you give that are consistent with them. By entering into this DPA you instruct Inco to Process Personal Data to provide the Services — that is, to process each request and return the response — and to comply with applicable law.

3.2 Instructions outside the Services. If you ask for an instruction that falls outside the Services or would require Inco to change the Services, the parties will agree it in writing before it takes effect, and Inco may charge for the work at its then-current rates.

3.3 Unlawful instructions. Inco will inform you if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws, and may suspend performance of that instruction until it is withdrawn or amended.

4. How the Services Process Personal Data

This Section 4 describes the architecture on which the rest of this DPA rests. It reflects the same commitments Inco makes in Section 5 of the Agreement. It applies to Customer Content submitted to the Services for inference.

4.1 Retention. Where the Store & Improve Setting is on, Inco stores Customer Content, including Personal Data contained in it and including inline image, file, and video bytes and any media retrieved from a URL you provide, and including requests to Passthrough Models, as Content Logs for the period provided in Section 11.1, and may use Content Logs for the Improvement Purposes under Section 4A. Where the Store & Improve Setting is off, Personal Data contained in Customer Content is retained only for as long as is necessary to process the request and return the response, except as necessary to comply with applicable law, to provide the Services, to provide support you request, or to perform safety screening, and, except for those purposes, Inco does not write request or response bodies to application logs, error traces, crash dumps, queues, analytics events, or metrics. Error records contain a request identifier, a status code, and an error class. Usage Data as defined in the Agreement is retained for every request whatever the Store & Improve Setting.

4.2 Access. Inco personnel may access Personal Data contained in Customer Content, including Content Logs, only (a) for the Improvement Purposes, while the Store & Improve Setting is on; (b) for the uses described in Section 5.3 of the Agreement, while the Training Setting is on; (c) for abuse detection and safety screening; (d) to provide support you request, including where you include Customer Content in a support request; and (e) to comply with applicable law; and in each case only under access controls and confidentiality obligations.

4.3 Caching. Inference caches are not persisted beyond the processing window. Inco maintains controls designed to prevent cached computation derived from one customer’s Customer Content from being used in, influencing, or being disclosed in the Outputs generated for any other customer.

4.4 No training of released models. Inco does not use Personal Data to train, retrain, fine-tune, or otherwise improve any machine-learning model that is made available to customers or third parties unless the Training Setting is on. Inco’s use of Content Logs to train internal performance models is an Improvement Purpose governed by Section 4A. Inco requires each Subprocessor engaged for Inco-Served Models not to use Personal Data to train, retrain, fine-tune, evaluate, or otherwise improve any machine-learning model. Inco may create and use aggregated, de-identified statistics derived from Usage Data, provided that those statistics are not derived from the content of Customer Content, except as permitted for Content Logs by Section 5.9 of the Agreement, and do not identify you or any data subject.

4.5 Data Settings control. Your Data Settings form part of your documented instructions under Section 3.1. Using a Passthrough Model while the Passthrough Setting is on instructs Inco to transmit Customer Content to the relevant Provider and to receive the response from it. Turning the Store & Improve Setting off is an instruction to Inco to stop creating Content Logs and to cease using Content Logs for the Improvement Purposes from the time of the change; it also turns the Training Setting off. It does not affect the Passthrough Setting. Content Logs created before the change are deleted under Section 11.1.

4A. Inco’s Independent Processing

4A.1 Role. Where the Store & Improve Setting is on, Inco uses Content Logs for the Improvement Purposes and, where the Training Setting is on, Inco uses Customer Content as described in Section 5.3 of the Agreement. For that processing Inco determines the purposes and means and acts as an independent controller, not as your processor. This Section 4A governs that processing, and the other provisions of this DPA apply to it only where this Section 4A says so.

4A.2 Purposes. The Improvement Purposes are: (a) routing and cache tuning; (b) abuse detection; (c) benchmarking; and (d) training Inco’s internal performance models that are not made available to customers or third parties, such as draft models and other serving add-ons. Inco will not use Content Logs for any other purpose, except as described in Section 5.3 of the Agreement while the Training Setting is on, or as required by applicable law.

4A.3 Legal basis. Inco relies on its legitimate interests in improving the speed, reliability, and safety of the Services. The legal basis for the uses described in Section 5.3 of the Agreement is described in the Inco Privacy Policy.

4A.4 Retention. Content Logs of a European Account, as defined in the Agreement, are deleted no later than 30 days after creation. Content Logs of any other account are retained for as long as necessary for the Improvement Purposes, reviewed at least every 12 months, and deleted when no longer necessary for those purposes. For every account, Content Logs are deleted within 30 days after the Store & Improve Setting is turned off and within 30 days after account deletion.

4A.5 Security. Inco protects Content Logs with the measures set out in Annex 4 and will notify you of a Personal Data Breach affecting Content Logs as provided in Section 6.

4A.6 No sale; limited disclosure. Inco does not sell Content Logs or share them for cross-context behavioral advertising, and does not disclose them to any third party except as described in Section 5.6 of the Agreement.

4A.7 Data subject rights. Inco handles requests from data subjects relating to its processing under this Section 4A directly, as described in the Inco Privacy Policy. Each party will promptly pass to the other any request it receives that relates to the other’s processing.

4A.8 Transfers. Where you are established in the European Economic Area, the United Kingdom, or Switzerland and Content Logs are transferred to Inco in a Restricted Transfer, Module One (controller to controller) of the SCCs applies to that transfer, as set out in Annex 2.

4A.9 Objection. You may object to Inco’s processing under this Section 4A at any time by turning the Store & Improve Setting off and, where it is on, the Training Setting off, with the effect described in Section 4.5. Data subjects may object as described in the Inco Privacy Policy.

4A.10 Your responsibilities. Where the Store & Improve Setting or the Training Setting is on, you are responsible for having a lawful basis to disclose Personal Data to Inco for the processing described in this Section 4A, and for informing the data subjects concerned, in your own privacy notice, that Inco receives and uses their personal data as described in this Section 4A.

5. Security

5.1 Security measures. Inco will implement and maintain the technical and organizational measures set out in Annex 4, taking into account the state of the art, the costs of implementation, the nature and purposes of the Processing, and the risks to data subjects. Inco may update those measures, provided that the updated measures do not materially reduce the overall level of protection.

5.2 Personnel. Inco will ensure that personnel authorized to Process Personal Data are bound by appropriate obligations of confidentiality.

5.3 Your responsibilities. You are responsible for your own use of the Services, including securing your account credentials and API keys, configuring your integration appropriately, and not submitting categories of content that the Agreement prohibits.

6. Personal Data Breach

6.1 Notification. Inco will notify you of a confirmed or reasonably suspected Personal Data Breach without undue delay after becoming aware of it. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate volume of Personal Data affected, the likely consequences, and the measures taken or proposed.

6.2 Cooperation. Inco will take reasonable steps within its control to mitigate the breach and will cooperate reasonably with your investigation. Notification is not an acknowledgement of fault or liability.

6.3 Your notifications. You are responsible for any notification you are required to make to a supervisory authority, to data subjects, or to others. Where such a notification identifies Inco, you will, where lawful, notify Inco in advance and consider in good faith any correction Inco reasonably requests as to its involvement.

7. Data Subject Requests

7.1 Assistance. Taking into account the nature of the Processing, Inco will provide reasonable assistance, by appropriate technical and organizational measures and insofar as technically feasible, to help you respond to requests from data subjects exercising their rights under Applicable Data Protection Laws.

7.2 Requests received by Inco. If Inco receives a request from a data subject relating to Personal Data, Inco will promptly inform you, unless prohibited by law, and will direct the data subject to you. You are responsible for responding.

7.3 Content Logs. Where the Store & Improve Setting is on, Inco holds Customer Content in Content Logs for the period provided in Section 11.1 and will assist you under Section 7.1 with requests from data subjects that relate to Personal Data in Content Logs, including by locating and deleting that Personal Data on your instruction. Where the Store & Improve Setting is off, Inco ordinarily holds no Personal Data to access, correct, port, or erase in response to such a request, and its assistance is limited accordingly.

8. Your Responsibilities

You represent, warrant, and undertake that:

1. you have provided all notices and obtained all consents, and have a valid legal basis under Applicable Data Protection Laws, for Inco to Process Personal Data as contemplated by the Agreement and this DPA;

2. your instructions comply with Applicable Data Protection Laws;

3. Customer Content will not contain government-issued identification numbers, images or other reproductions of identification documents or payment cards, payment card data subject to the Payment Card Industry Data Security Standard, account credentials (including credentials to a financial account), protected health information subject to the Health Insurance Portability and Accountability Act, biometric identifiers used for the purpose of uniquely identifying an individual, or personal data of children under 16, in each case except with Inco’s prior written agreement; and

4. where you are a processor acting for another controller, you have that controller’s authority to enter into this DPA and to give the instructions you give.

9. Subprocessors

9.1 Authorization. You authorize Inco to engage the Subprocessors listed in Annex 5, and generally authorize Inco to engage further Subprocessors in accordance with this Section 9.

9.2 Obligations. Inco will engage each Subprocessor under a written contract, which may consist of the Subprocessor’s standard terms of service, data processing terms, and privacy policy where those together impose data protection obligations that provide a level of protection equivalent to this DPA. Inco will not engage a Subprocessor whose terms do not meet that standard. Inco remains responsible for the performance of each Subprocessor’s obligations and is liable for its acts and omissions as if they were Inco’s own.

9.3 Changes and objection. Inco will give at least 30 days’ notice before a new Subprocessor begins Processing Personal Data, by email to the contact on your account or by updating a Subprocessor list made available to you. If, within 30 days of that notice, you object on reasonable grounds relating to data protection, the parties will work in good faith toward a resolution. If none is reached, you may terminate the affected Services on written notice and Inco will refund any prepaid, unused Credits attributable to them.

9.4 Providers of Passthrough Models. Providers are not Subprocessors under this DPA. When you use a Passthrough Model, you direct Inco to transmit Customer Content to the Provider named on the Models Page, and the Provider processes it under its own terms, including any use for training the Provider discloses, as stated on the Models Page. That transmission is a disclosure made by you at your direction, not by Inco for its own purposes. Inco’s responsibility for Providers is as stated in Sections 4.12(e) and 11.4 of the Agreement.

10. Audits and Information

10.1 Information. Inco will make available to you the information reasonably necessary to demonstrate compliance with this DPA, including its then-current security documentation and, where available, any third-party audit report or certification.

10.2 Audits. Where Applicable Data Protection Laws entitle you to audit, you may audit Inco’s compliance with this DPA once in any twelve-month period, and additionally where a supervisory authority with jurisdiction over you requires it. You must give at least 30 days’ written notice and a proposed scope. Inco may object to an auditor that is a competitor or is not suitably independent. If the controls in scope are covered by a third-party audit report issued within the preceding twelve months and Inco confirms no material change, you will accept that report instead. Audits are at your expense, must be conducted in business hours, must not unreasonably interfere with Inco’s operations, and are subject to confidentiality.

11. Return and Deletion

11.1 During the term. Content Logs of a European Account are deleted no later than 30 days after creation. Content Logs of any other account are retained for as long as necessary for the Improvement Purposes, reviewed at least every 12 months, and deleted when no longer necessary for those purposes. For every account, Content Logs are deleted within 30 days after the Store & Improve Setting is turned off and within 30 days after account deletion. Where the Store & Improve Setting is off, Personal Data is not retained beyond processing, except as described in Section 4.1. Deletion of Content Logs does not require Inco to retrain or discard a model trained on them before deletion.

11.2 On termination. On expiry or termination of the Agreement, Inco will delete the account data associated with your account from production systems within 30 days and purge it from backups within 90 days, and will delete Content Logs associated with your account within 30 days, except for Usage Data retained as described in Section 5.8 of the Agreement and records Inco is required to retain for billing, tax, legal, or security purposes, in which case Inco will continue to protect it under this DPA and will delete it when the requirement ends.

11.3 Certification. Inco will certify deletion in writing on request.

12. Artificial Intelligence and Automated Processing

12.1 Models. The Services provide access to third-party machine-learning models. Inco runs Inco-Served Models on infrastructure it operates; the developers and licensors of those models receive no requests and no Personal Data from Inco when you use an Inco-Served Model and are not Subprocessors for that use. Passthrough Models are operated by Providers, which are not Subprocessors under this DPA, as provided in Section 9.4. Inco does not use Personal Data to train models made available to customers or third parties except where the Training Setting is on, as provided in Section 4.4.

12.2 Automated decision-making. Inco does not make decisions about data subjects. Where you use the Services as part of a process that produces legal or similarly significant effects on a data subject, you are the controller of that process and are responsible for the obligations that attach to it, including any obligation to provide meaningful information about the logic involved, to implement human review, and to carry out a data protection impact assessment. The Agreement restricts the use of Outputs as the sole or determinative basis for such decisions.

12.3 Assistance. Inco will provide reasonable assistance with a data protection impact assessment or prior consultation relating to the Services, taking into account the nature of the Processing and the information available to Inco.

13. International Transfers

13.1 Processing locations. Inco-Served Models run on infrastructure Inco operates, located in several regions, which may include North America, Europe, and the Asia-Pacific region, and which may change over time. Inco will not operate inference infrastructure in the People’s Republic of China, Taiwan, or Hong Kong. Content Logs are stored on infrastructure Inco operates. When you use a Passthrough Model, Customer Content is processed in the Provider’s locations, as stated on the Models Page, which may include the People’s Republic of China.

13.2 Transfer mechanism. To the extent Processing under this DPA involves a Restricted Transfer, the parties comply with Annex 2, under which the SCCs (as varied by the UK Addendum or for Switzerland, as applicable) are incorporated into and form part of this DPA.

13.3 Government access. If Inco receives a legally binding request from a public authority for Personal Data, Inco will, where lawful, notify you, challenge requests that appear unlawful or overbroad, and disclose only the minimum required. Where the Store & Improve Setting is on, Inco may hold Customer Content in Content Logs for the period provided in Section 11.1, and Inco will follow the process in this Section 13.3 for any request that reaches it. Where the Store & Improve Setting is off, Inco ordinarily holds no request or response content capable of being produced.

14. General

14.1 Precedence. In the event of a conflict, this DPA prevails over the Agreement in respect of the Processing of Personal Data, and the SCCs prevail over this DPA in respect of the Restricted Transfer to which they apply. Section 17.2 of the Agreement sets out the wider order of precedence.

14.2 Liability. Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, except that nothing limits any liability to a data subject under the third-party beneficiary provisions of the SCCs.

14.3 Changes. Inco may vary this DPA on written notice to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided the variation does not materially reduce the protections given to Personal Data or materially increase your obligations.

14.4 Governing law. This DPA is governed by the law that governs the Agreement, except that the SCCs are governed as provided in the SCCs.

14.5 Notices. Notices under this DPA may be given to legal@inco.ai and, to you, to the contact on your account or the data protection contact in Annex 1.

Signature

Acceptance of the Agreement constitutes acceptance of this DPA where it applies. Where a countersigned copy is requested, the parties sign below.

Annex 1 — Processing Details

Annex 2 — European Annex

1. Restricted Transfers. Where Processing under this DPA involves a Restricted Transfer, the following apply.

1. EU transfers. The SCCs are incorporated into this DPA and are deemed entered into by the parties, populated as set out in paragraph 2 below.

2. UK transfers. The SCCs as varied by the UK Addendum are incorporated and deemed entered into, with Tables 1 to 3 of the UK Addendum populated from Annex 1 and paragraph 2 below, and Table 4 completed so that neither party may end the UK Addendum as set out in section 19.

3. Swiss transfers. The SCCs are incorporated and deemed entered into, varied so that references to the GDPR are read as references to the FADP, the competent authority is the Federal Data Protection and Information Commissioner, the term “member state” does not prevent data subjects in Switzerland from bringing proceedings in their place of habitual residence, and the clauses also protect the data of legal entities until the FADP no longer does so.

2. Population of the SCCs.

1. Module Two (controller to processor) applies where the Customer is a controller. Module Three (processor to processor) applies where the Customer is itself a processor.

2. Clause 7 (docking clause) does not apply.

3. In Clause 9, Option 2 (general written authorization) applies, with the notice period set at 30 days as provided in Section 9.3.

4. In Clause 11, the optional independent dispute resolution language does not apply.

5. In Clause 17, the SCCs are governed by the law of Ireland. In Clause 18(b), disputes are resolved before the courts of Ireland.

6. Annex I to the SCCs is populated from Annex 1 to this DPA; Annex II is populated from Annex 4; Annex III is populated from Annex 5.

7. Module One (controller to controller) applies to transfers of Personal Data for the processing described in Section 4A, where the Customer is established in the European Economic Area, the United Kingdom, or Switzerland, with the Customer as data exporter and Inco as data importer, each acting as a controller. Paragraphs 2(d), 2(e), and 2(f) apply to Module One.

3. Assistance and Information. Inco will provide the information described in Clause 8.9 through Section 10.1 of this DPA. Certification of deletion under Clauses 8.5 and 16(d) is provided on written request under Section 11.3.

Annex 3 — US State Privacy Laws Annex

This Annex applies where Inco Processes personal information subject to the State Privacy Laws. Terms such as “business,” “service provider,” “contractor,” “sell,” “share,” and “commercial purpose” have the meanings given in those laws.

1. The parties intend that Inco is a service provider, contractor, or processor, as applicable. Personal information is disclosed to Inco only for the limited and specified purpose of providing the Services.

2. Inco will not: (a) sell or share personal information; (b) retain, use, or disclose personal information for any purpose other than providing the Services, or outside the direct business relationship between the parties, except as permitted by the State Privacy Laws; or (c) combine personal information received under the Agreement with personal information received from or on behalf of any other person, or collected from Inco’s own interaction with the data subject, except as permitted by the State Privacy Laws. Inco certifies that it understands and will comply with these restrictions.

3. Inco will provide the same level of privacy protection as the State Privacy Laws require, will notify you if it determines it can no longer meet its obligations, and will cooperate with reasonable and appropriate steps you take to stop and remediate any unauthorized use of personal information.

4. Notice of Subprocessor engagements under Section 9.3 satisfies any obligation to give notice of, and an opportunity to object to, those engagements. Audits under Section 10 satisfy any right to take reasonable steps to verify Inco’s use of personal information.

5. For the Improvement Purposes described in Section 4A, Inco relies on the permission for a service provider or contractor to use personal information internally to build or improve the quality of the services it provides (Cal. Code Regs. tit. 11, § 7050(a)(3)) and on equivalent provisions of the other State Privacy Laws. To the extent a use described in Section 4A falls outside that permission, Inco acts as a business or third party for that use, and your disclosure of personal information to Inco for it is governed by Section 4A and the Agreement rather than by this Annex.

6. Transmission of personal information to a Provider when you use a Passthrough Model is a disclosure made by you at your direction and is not a sale or sharing of personal information by Inco.

Annex 4 — Security Measures

Where the Store & Improve Setting is off, the most important measure protecting Customer Content is that Inco does not retain it beyond processing, except as described in Section 4.1. In addition, and whatever the Data Settings, Inco maintains:

1. removal of API keys and other credentials from request headers before any log entry is written;

2. controls on inference caches designed to prevent cached computation derived from one customer’s content from being used in, influencing, or being disclosed in the outputs generated for any other customer;

3. access to Customer Content, including Content Logs, limited to the purposes described in Section 4.2 and to personnel who need it for those purposes;

4. confidentiality obligations on personnel authorized to access systems Processing Personal Data;

5. encryption in transit;

6. encryption of stored account data at rest;

7. role-based access controls;

8. API-key hashing; and

9. network segmentation of inference infrastructure;

10. encryption of Content Logs at rest; and

11. logging of personnel access to Content Logs.

Annex 5 — Subprocessors

The named list of Subprocessors is Inco’s confidential information, is made available to you on request, and is provided subject to Section 10 of the Agreement. Providers of Passthrough Models are not Subprocessors; they are named on the Models Page and in the Inco Privacy Policy. As at the effective date of this DPA: