legal --dpa

Data Processing Agreement

This page summarizes how Kutrion processes data on your behalf. It reflects our current practice; a formal, countersigned DPA is available for teams and enterprise customers on request.

Roles: When you use Kutrion to store and broker access to your own systems, you are the data controller for the credentials and content you put in. Kutrion acts as a data processor, handling that data on your instructions to provide the service.
Scope of processing: We process the data you store (credentials, connection details, secure notes), the access and session metadata needed to broker and audit connections, and the account/billing data needed to run your subscription. We do not sell your data or use your credentials to train models. AI assistance defaults to a self-hosted model rather than a cloud one. Which network that model runs on depends on your deployment: on a self-hosted Kutrion install it is an endpoint you operate, so prompts and terminal output are answered on your own network; on the hosted service the default model runs on Kutrion’s own infrastructure, not yours, until an organization admin points Kutrion at an endpoint you operate — and on the hosted service an endpoint reached over the public internet is treated as a cloud destination, filtered and audited on the same path as one. If an organization admin opts a cloud model in, the text sent to it passes a secret-and-PII filter first: it removes credentials, API keys, private keys, JWTs, email addresses, IP addresses and payment card numbers. It is not a transcript filter — command text, terminal output, SQL, hostnames, file paths and the names of people and customers are retained and reach the model, measured at about 90 percent of a 40,000-character operations transcript. Every cloud send is recorded on the audit trail with a SHA-256 hash and the character count of what was sent; the filtered text itself (its first 2,000 characters) is kept on that record only if an organization admin turns that setting on, and it is off by default.
Security measures: Credentials are protected with envelope encryption and are never stored as plaintext. Access is brokered and decrypted in memory only for authorized, audited sessions. Every credential read and session is written to a tamper-evident audit trail. See the security page for the full model.
Subprocessors: We use a short list of subprocessors for payments, transactional email and hosting, and — only where an organization has opted a cloud model in — for AI inference. The current list, with purpose and location, is published on the subprocessors page. Material changes are communicated to account contacts before they take effect.
Data location & residency: Hosting region is configured per deployment. Enterprise customers can arrange data-residency requirements as part of their agreement — talk to us about your environment, including self-hosted options.
Sub-breach notification: If we become aware of a personal-data breach affecting your data, we will notify the account's designated contact without undue delay and share the information needed for you to meet your own notification obligations.
Data subject requests & deletion: Export is per surface rather than one archive: vaults, members, connections and the audit trail each export from the app. Session recordings are the exception — they download one session at a time, and a bulk take is an assisted request. Deleting individual items (a credential, a connection, a recording, a member) is self-service. Erasing your own account is self-service too: delete it from the app or the web client, or see the account deletion page. Erasing an entire organization, with every member in it, is not, and we carry it out on a verified request from an owner: we treat a request as verified only when an owner of that organization confirms it to us from the email address registered to their Kutrion account, and a request from any other address is answered but nothing is erased on it. Either is a hard delete of those records rather than a flag. Audit records and entitlement and subscription history (7 years) are retained as compliance records, carrying the historical identifiers of what was erased. Make a request through the data request form at /contact?intent=privacy; we respond within one month of receiving it, and the form tells you the date. On termination, your data is deleted or returned according to the agreed retention terms.

For the countersigned DPA or any data-protection questions, contact us. For a data-subject request, use the data request form. See also the subprocessors list and the security model.