# Data processing

> How Neural Inverse processes personal data as a processor for customers of the service we host, and how to get our data processing addendum.

Source: https://neuralinverse.com/legal/data-processing/

---

Legal

# Data processing

When we host Neural Inverse for your organisation, we process personal data in it on your instructions. This page summarises the data processing addendum we sign with you.

Last updated 18 October 2026. Addendum version \[version: to be confirmed\]

Contents

1.  [When it applies](https://neuralinverse.com/#when)
2.  [Roles](https://neuralinverse.com/#roles)
3.  [What we commit to](https://neuralinverse.com/#terms)
4.  [Sub-processors](https://neuralinverse.com/#subprocessors)
5.  [International transfers](https://neuralinverse.com/#transfers)
6.  [Security measures](https://neuralinverse.com/#security)
7.  [Getting the addendum](https://neuralinverse.com/#request)

\[Draft: to be approved by legal counsel before publication\]

This summary is for information. The signed addendum and your agreement with us govern; where they differ from this page, they prevail.

## When it applies

The addendum applies when we host the service for you. When you run Neural Inverse yourself (self-hosted, in your own cloud account or air-gapped), the personal data in it stays on your infrastructure and we do not process it; we supply software, and no addendum is needed for that data.

## Roles

Your organisation is the controller of the personal data in its deployment: the names and work email addresses of its people, their sign-in and activity records, audit logs, and any personal data in the code, prompts and documents they use. We are its processor. For the account and billing details we keep to run our business, we are a controller, as the [privacy notice](https://neuralinverse.com/legal/privacy/) explains.

## What we commit to

-   process personal data only on your documented instructions, and tell you if we think an instruction breaks the law;
-   bind everyone who processes it to confidentiality;
-   keep the security measures described in the addendum;
-   help you answer requests from the people the data is about, and with security, impact assessments and consultation with authorities;
-   tell you without undue delay, and within 72 hours, of a confirmed security incident affecting your personal data, with what we know at the time;
-   at the end of the service, return your data to you and delete it from production within 30 days, and from backups within 90 days as they expire;
-   give you the information you need to show compliance, and allow audits as the addendum sets out.

Where the service runs: AWS US East (N. Virginia) and AWS Europe (Frankfurt) for the shared service; for a dedicated deployment, the AWS, Microsoft Azure or Google Cloud region you prefer. Your organisation's content stays in its region. On the shared service, sign-in details (email, name, credentials and sessions) and billing records are held in the United States; a dedicated deployment keeps them in its region.

## Sub-processors

We list the sub-processors of the service we host on the [sub-processors page](https://neuralinverse.com/legal/subprocessors/). We give at least 30 days' notice before adding or replacing one, and you may object within 15 days. We impose the same data protection obligations on them and remain responsible for them.

## International transfers

Where personal data leaves the UK or the European Economic Area for a country without an adequacy decision, the addendum incorporates the European Commission's standard contractual clauses and the UK International Data Transfer Addendum.

## Security measures

Tenant isolation enforced by the database, encryption in transit and at rest with keys in a key management service, a tamper-evident audit log, single sign-on and multi-factor authentication, and least-privilege access for our staff. [Security and trust](https://neuralinverse.com/trust/) describes them, and the addendum lists them in full.

## Getting the addendum

Customers of the service we host receive the addendum with their agreement. To review it before you sign, email [legal@neuralinverse.com](mailto:legal@neuralinverse.com) or use the [contact form](https://neuralinverse.com/contact/?topic=sales).