Veilbrook · Trust · Guarantee · Subprocessors
Version 1.0 — 29 October 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between the parties for the Veilbrook service (the “Agreement”) and applies to the Processing of Personal Data by Nwbrains LLC (“Nwbrains”, “Processor”) on behalf of the customer (“Customer”, “Controller”).
Processor: Nwbrains LLC, a Wyoming limited liability company, registered address: as recorded with the Wyoming Secretary of State, USA. Trading as Veilbrook (Tony Tautai Cloud). Contact: privacy@veilbrook.com.
Customer: [legal name], [address], [contact], as identified in the Agreement.
Terms used but not defined here have the meaning given in the Agreement or in applicable Data Protection Law. “Data Protection Law” means the GDPR (EU) 2016/679, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and any other data protection law applicable to the Processing. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Supervisory Authority”, “Personal Data Breach” have the meanings given in the GDPR. “Services” means the Veilbrook document redaction service, including detection, review, redaction, export, support and related features. “Customer Data” means documents, text and other content submitted by or for Customer. “Subprocessor” means a processor engaged by Nwbrains.
2.1 Customer is the Controller (or a Processor acting on behalf of a Controller) of the Personal Data contained in Customer Data. Nwbrains is a Processor (or sub-processor, where Customer is a Processor).
2.2 Nwbrains Processes Customer Data only to provide the Services, on documented instructions from Customer, and as described in Annex I. Instructions are the Agreement, this DPA, the configuration chosen by Customer, and written instructions from Customer’s authorised users. Nwbrains will inform Customer if an instruction infringes Data Protection Law (without being required to perform a legal assessment).
2.3 Nwbrains will not: (a) sell or share Customer Data; (b) use Customer Data to train, fine-tune or improve any model offered to other customers; (c) use Customer Data for advertising; or (d) retain Customer Data except as described in Section 11 and Annex I.
2.4 Customer is responsible for the lawfulness of Customer Data and its instructions, including any special category data (Art. 9 GDPR) or criminal-offence data (Art. 10) contained in documents. Customer must have a lawful basis and any required condition for such data. Veilbrook is a redaction tool; Customer remains responsible for the final document and for deciding what to redact and disclose.
Nwbrains will:
(a) Process Customer Data only on documented instructions, including with regard to transfers, unless required by law (in which case Nwbrains will inform Customer unless legally prohibited); (b) ensure that personnel authorised to Process Customer Data are bound by confidentiality and receive appropriate training; (c) implement and maintain the technical and organisational measures in Annex II; (d) assist Customer, by appropriate technical and organisational measures, in responding to Data Subject requests (Section 7); (e) assist Customer in ensuring compliance with Articles 32–36 GDPR/UK GDPR, taking into account the nature of the Processing and the information available to Nwbrains; (f) notify Customer of a Personal Data Breach in accordance with Section 8; (g) make available information necessary to demonstrate compliance and allow audits in accordance with Section 9; (h) delete or return Customer Data at the end of the Services in accordance with Section 10; (i) maintain a record of Processing carried out on behalf of Customer, as required by Article 30(2).
4.1 Customer authorises Nwbrains to engage the Subprocessors listed in Annex III. Nwbrains will impose data protection obligations on each Subprocessor that are no less protective than this DPA, in particular regarding confidentiality, security, breach notification, deletion and international transfers.
4.2 Nwbrains will give Customer at least 30 days’ prior notice of any new Subprocessor or replacement that Processes Customer Data, by email and by updating the public subprocessor list. Customer may object on reasonable data protection grounds within 15 days. If the parties cannot resolve the objection, Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees. Nwbrains remains liable for its Subprocessors’ acts and omissions as for its own.
5.1 Where Customer Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Decision 2021/914, Module 2: Controller to Processor) and, for the UK, the UK Addendum to the EU SCCs (IDTA) issued by the ICO, and, for Switzerland, the Swiss addendum/FADP adaptations. The SCCs are incorporated by reference and completed as follows: Clause 7 (docking clause) applies; Clause 9 uses the general written authorisation in Section 4; Clause 11 (redress) applies; the competent supervisory authority is the one of Customer’s establishment; governing law is Ireland; the courts are Ireland (for the SCCs).
5.2 Nwbrains has performed a transfer impact assessment and applies the supplementary measures in Annex II, including minimisation, encryption in transit, no persistent storage of documents, access controls and contractual protections with Subprocessors. Nwbrains will inform Customer of any legally binding request for disclosure by a public authority that concerns Customer Data, unless prohibited by law.
Nwbrains will implement and maintain the measures in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing, and the risks to Data Subjects. Nwbrains may update the measures provided that the overall level of protection is not reduced. Customer is responsible for securing its account credentials, devices and authorised users.
Taking into account the nature of the Processing, Nwbrains will assist Customer by appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise Data Subject rights. Nwbrains will not respond to a Data Subject request directly unless authorised by Customer or required by law; it will forward the request to Customer without undue delay. Nwbrains will provide the functionality described in Annex I to export or delete Customer Data.
Nwbrains will notify Customer without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Data, by email to Customer’s security contact. The notification will describe, to the extent known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Nwbrains will cooperate with Customer and take reasonable steps to mitigate the breach. Notification is not an admission of fault.
9.1 Nwbrains will make available all information reasonably necessary to demonstrate compliance with this DPA, including current security documentation, a completed security questionnaire on request, and the reports or certifications of its Subprocessors that are publicly available.
9.2 Customer (or an independent auditor bound by confidentiality, not a competitor of Nwbrains) may audit Nwbrains’ relevant records and facilities once per 12 months, on at least 30 days’ written notice, during business hours, at Customer’s cost, and subject to confidentiality and to not accessing other customers’ data. Audits may be conducted remotely. Immediate audits are permitted after a Personal Data Breach or a Supervisory Authority request.
10.1 At Customer’s choice, on termination or expiry of the Agreement, Nwbrains will return Customer Data in a commonly used format (where technically feasible) or delete it, and delete existing copies, unless retention is required by law. Nwbrains will confirm deletion in writing on request.
10.2 Customer Data submitted for redaction is processed in memory and temporary files are deleted after processing and in any event within 24 hours. Veilbrook does not retain the contents of documents after the session. Account metadata, document metadata (counts, sizes, pages) and review feedback (offsets and decisions, no text) are retained for the term of the account and deleted within 30 days after account deletion. Metadata backups are kept for 14 days and then deleted.
10.3 This Section does not apply to data that Nwbrains is required by law to retain, or to aggregated, anonymised statistics that cannot identify Customer or any Data Subject.
Nwbrains will keep Customer Data confidential and will not disclose it except to Subprocessors under Section 4, to personnel under Section 3(b), or as required by law. Nwbrains does not grant its personnel default access to document contents; support access, if any, is limited, logged and subject to Customer authorisation. Nwbrains will not use Customer Data for any purpose other than the Services.
12.1 Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits liability that cannot be limited by law, or a Data Subject’s rights under Data Protection Law.
12.2 Nwbrains will indemnify Customer against fines and reasonable costs imposed on Customer by a Supervisory Authority to the extent caused by Nwbrains’ breach of this DPA, subject to the Agreement’s liability cap and to Customer promptly notifying Nwbrains and allowing it to participate in the defence. Customer will indemnify Nwbrains for claims arising from Customer’s unlawful instructions or Customer Data.
This DPA applies for the term of the Agreement and until deletion of Customer Data under Section 10. Termination of the Agreement terminates this DPA, without affecting accrued rights or obligations. Sections 5, 8, 9, 10, 11, 12 and 14 survive termination.
This DPA is governed by the law of the State of Wyoming, USA, without regard to conflict-of-laws rules, except that the SCCs are governed by the law stated in the SCCs and mandatory Data Protection Law rights are unaffected. The courts of [●] have exclusive jurisdiction, subject to the SCCs. The parties will attempt in good faith to resolve disputes before litigation.
In case of conflict: (1) the SCCs/UK Addendum prevail; (2) this DPA prevails over the Agreement; (3) the Agreement prevails over other documents. This DPA does not replace a HIPAA Business Associate Agreement; Veilbrook is not offered as a HIPAA-compliant service unless a separate BAA is signed. Veilbrook does not claim SOC 2 certification.
For Nwbrains LLC: Name: [●], Title: [●], Date: [●], Signature: ______________________
For Customer: Name: [●], Title: [●], Date: [●], Signature: ______________________
A. Parties. Controller: Customer. Processor: Nwbrains LLC (Veilbrook). Customer contact: [●]. Nwbrains contact: privacy@veilbrook.io (or privacy@veilbrook.com).
B. Processing. - Subject matter: detection and redaction of personal data in documents, human review, export, account and support services. - Duration: term of the Agreement, plus the retention in Section 10. - Nature and purpose: ingestion of documents; extraction of text; model-based and rule-based detection; creation of a review queue; application of redactions; generation of a redacted PDF; audit and receipt; account management. - Categories of Data Subjects: persons whose data appears in Customer documents (e.g., customers, employees, claimants, contacts), as determined by Customer. - Categories of Personal Data: names, contact details, addresses, identifiers, dates of birth, financial and government identifiers, and any other personal data contained in documents uploaded by Customer, which may include special category data if Customer uploads it. - Special categories: only if Customer includes them; Customer is responsible for the Art. 9 condition. - Frequency: as initiated by Customer. - Retention: see Section 10.
C. Competent supervisory authority: the supervisory authority of Customer’s establishment in the EEA/UK, or the Swiss FDPIC for Switzerland.
| Subprocessor | Location | Processing | Safeguards |
|---|---|---|---|
| Modal Labs, Inc. | United States (us-east) | Model inference on document text (no document files) | DPA; SCCs/UK Addendum; TLS; no persistent document storage by Veilbrook |
| Hetzner Online GmbH | Germany (EU) | Application hosting, PostgreSQL metadata, temporary PDF processing | DPA; EU hosting; access controls; TLS |
| Cloudflare, Inc. | United States / global | Website delivery, DNS, email routing | DPA; SCCs; TLS |
| Resend, Inc. (Plus Five Five, Inc.) | European Union (eu-west-1) | Transactional email delivery (account email address, verification/reset links, notices; no document content) | DPA; SCCs/UK Addendum; TLS |
| Stripe, Inc. (when payment is enabled) | United States | Payment and subscription billing (account/billing data, not document content) | DPA; SCCs; PCI DSS (Stripe) |
No customer documents are stored on Vast.ai, on the tt-ingest station, or in any environment not listed above.
Where Customer Data includes personal information subject to US state privacy laws, Nwbrains acts as a service provider. Nwbrains will: process personal information only to provide the Services; not sell or share it; not retain, use or disclose it for any other purpose; not combine it with personal information from other sources except as permitted; assist Customer with consumer requests; and notify Customer of a breach. Nwbrains certifies that it understands and will comply with these restrictions.