Data processing agreement

This DPA forms part of the terms for customers who are controllers. Authpermit processes personal data only on documented instructions, applies the technical and organisational measures described at /security, assists with subject requests, notifies breaches without undue delay, deletes or returns data at termination, and only engages sub-processors listed in the customer's Data & residency settings.

Sub-processors

Infrastructure providers selected by region; AI providers only when the customer supplies keys or enables Managed AI; background-check providers only when the customer orders checks.