Data Processing Agreement

1. Definitions

“Controller” means the tenant organisation that determines the purposes and means of processing personal data. “Processor” means FactoryOS, acting on the Controller's behalf. “Personal Data” has the meaning given under applicable data protection law (including GDPR and CCPA where applicable).

2. Scope and Purpose

This DPA governs FactoryOS's processing of Personal Data on behalf of each tenant in connection with the FactoryOS platform. Processing is limited to what is necessary to perform the services described in the Terms of Service.

3. Processor Obligations

FactoryOS, as Processor, will:

• Process Personal Data only on documented instructions from the Controller.
• Ensure personnel are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures.
• Assist the Controller in responding to data subject rights requests.
• Delete or return Personal Data on termination, per the Controller's instructions.
• Make available information necessary to demonstrate compliance with this DPA.

4. Sub-Processors

FactoryOS engages sub-processors to operate the platform. Current sub-processors include:

• Oracle Cloud Infrastructure (hosting: application, database and secrets store; Sydney, Australia)
• Anthropic (model inference for the platform default, through our LLM gateway; United States)
• Voyage AI (text embeddings for search over your decisions and documents; United States)
• Stytch (identity and authentication; United States)
• Resend (transactional email, such as sign-in codes and notifications; United States)

We will notify Controllers at least 30 days before adding or removing sub-processors. Controllers may object to new sub-processors by contacting privacy@agentfactoryos.com.au.

5. International Transfers

During the beta, platform data is hosted on Oracle Cloud Infrastructure in Sydney, Australia. Some of the sub-processors listed above process data in the United States. For transfers from the EEA or UK, FactoryOS relies on Standard Contractual Clauses (SCCs) as the transfer mechanism. EU data residency is planned for v2.

6. Security Measures

FactoryOS implements the following technical and organisational measures:

• Encryption in transit and at rest.
• Secrets management via HashiCorp Vault.
• Append-only, hash-chained audit log for all state-changing actions.
• Per-tenant data isolation enforced at the database level (tenant_id on all tables).
• SOC 2 Type I in progress (Vanta-monitored from platform launch).
• Role-based access control enforced via OPA policy engine.

7. Incident Notification

FactoryOS will notify the Controller without undue delay (and within 72 hours where required by law) after becoming aware of a Personal Data breach affecting Controller data.