Data processing

• License check-in data and health telemetry from your deployment, once those services are live (counts and numeric metrics only, without names or content).
• Sign-in and directory data, through WorkOS.
• Datahub queries and datasets, if you use the Datahub.
• Email that Innovus sends on your behalf through SendGrid, and connector data through Unipile, only if you enable them.
• Support communications, and data you show us during support sessions you grant.

This Data Processing Addendum ("DPA") forms part of the Celara Customer Agreement. It reflects the Parties' agreement with regard to the Processing of Personal Data. Under the BYOA Deployment, most Personal Data stays in Customer's own cloud account, which Innovus cannot access unless Customer grants support access; this DPA covers the Personal Data that Innovus does process, as described in Annex I.

1. Definitions

1.1 “Data Protection Laws” means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of Processing Personal Data in question under the Agreement, including without limitation European Data Protection Laws and the California Consumer Privacy Act (CCPA).

1.2 “European Data Protection Laws” means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii).

1.3 “Personal Data” means any information relating to an identified or identifiable natural person that is processed by Innovus on behalf of Customer in the course of providing the Celara Platform.

1.4 “Controller”, “Processor”, “Data Subject”, “Processing”, and “Personal Data Breach” shall have the meanings given to them under applicable Data Protection Laws.

1.5 "Security Incident" means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Data or Service Data that Innovus or its Subprocessors hold, or a confirmed compromise of the Celara Platform software, signed releases, or services Innovus runs that affects Customer's data or deployment. A Personal Data Breach involving such data is a Security Incident.

1.6 "Subprocessor" means a third party that Innovus engages to process Personal Data on Customer's behalf. Capitalized terms not defined in this DPA (including BYOA Deployment, Service Data, Health Telemetry, Subprocessors Page, and Security Overview) have the meanings given in the Agreement.

2. Role and scope

2.1 Roles. The Parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller and Innovus is the Processor. Innovus will process Personal Data only in accordance with Customer’s documented instructions.

2.2 Scope. This DPA applies to the Processing of Personal Data by Innovus on behalf of Customer to provide the Celara Platform services, including Personal Data in Service Data, sign-in and directory data, Datahub queries, email Innovus sends for Customer, support communications, and data Innovus sees during support sessions Customer grants. It does not cover Personal Data in Customer's cloud account that Innovus does not access.

3. Processor obligations

3.1 Compliance. Innovus shall comply with all applicable Data Protection Laws in the Processing of Personal Data.

3.2 Instructions. Innovus shall process Personal Data only on documented instructions from Customer, unless required to do so by applicable law to which Innovus is subject.

3.3 Confidentiality. Innovus shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.4 Security. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Innovus shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures described in Annex II.

3.5 Purpose Limitation; No Model Training. Innovus shall process Personal Data only to provide, secure, and support the Celara Platform for Customer. Innovus shall not use Personal Data, or any other Customer Data, to train or improve artificial intelligence models or to improve the Celara Platform.

3.6 Unlawful Instructions. Innovus shall promptly inform Customer if, in its opinion, an instruction from Customer infringes Data Protection Laws, and may suspend the affected Processing until Customer confirms or changes the instruction.

3.7 Impact Assessments. Taking into account the nature of the Processing and the information available to it, Innovus shall provide reasonable assistance with Customer's data protection impact assessments and prior consultations with supervisory authorities where Data Protection Laws require them.

3.8 Requests from Authorities. If a public authority requests access to Personal Data, Innovus shall, unless the law forbids it, promptly notify Customer and refer the authority to Customer; shall challenge a request that it reasonably considers unlawful or overbroad; and shall disclose only the minimum Personal Data that the law requires.

4. Subprocessing

4.1 Authorization. Customer provides a general authorization for Innovus to engage Subprocessors to process Personal Data on Customer's behalf. Innovus maintains the current list of its Subprocessors, with their purposes and locations, on the Subprocessors Page at celara.ai/subprocessors. Innovus shall give Customer at least thirty (30) days' notice before a new Subprocessor begins processing Personal Data, by email to Customer's notice contact and by updating the Subprocessors Page. Customer may object in writing within that thirty (30) day period on reasonable data protection grounds. If Customer objects, the Parties shall discuss Customer's concerns in good faith, and Innovus shall use commercially reasonable efforts to offer an alternative or to avoid using the new Subprocessor for Customer's Personal Data. If no such alternative is available within thirty (30) days after the objection, Customer may terminate the affected services on written notice and receive a pro-rata refund of prepaid fees for the terminated services covering the period after termination.

4.2 Subprocessor Obligations. Innovus shall impose data protection terms on any Subprocessor it appoints that require it to protect the Personal Data to the standard required by Data Protection Laws and this DPA. Innovus shall remain responsible for the performance of its Subprocessors’ obligations under this DPA, subject to the limitations of liability set forth in the Agreement.

5. International data transfers

5.1 EU, UK and Swiss Transfers. To the extent Innovus processes Personal Data subject to European Data Protection Laws in a country that does not provide an adequate level of protection under such laws, the Parties agree that the applicable Standard Contractual Clauses, UK Addendum, and Swiss transfer terms, as applicable, are incorporated into this DPA by reference and shall apply to such transfer. For purposes of the Standard Contractual Clauses, Customer is the “data exporter” and Innovus is the “data importer,” Module Two applies, and the details of Processing are set forth in Annex I. To the extent there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail solely with respect to the applicable restricted transfer.

5.2 Brazil. To the extent Innovus processes Personal Data subject to Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018, "LGPD") and the Processing involves an international transfer under the LGPD, the standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD) are incorporated into this DPA and apply to that transfer, with Customer as exporter and Innovus as importer, and with Annex I giving the details of the transfer. If the ANPD clauses conflict with this DPA, the ANPD clauses prevail for that transfer.

5.3 Other Local Law. If the law that applies to Customer requires specific terms for a transfer of Personal Data to Innovus, such as standard clauses issued by a government or data protection authority, Innovus will sign those terms on Customer's request, in the form that law requires. Those terms prevail over this DPA for the transfer concerned to the extent of any conflict.

6. Data subject rights

Taking into account the nature of the Processing, Innovus shall assist Customer by appropriate technical and organizational measures for the fulfillment of Customer's obligation to respond to requests to exercise Data Subjects' rights under Data Protection Laws. For Personal Data Innovus holds, Innovus shall provide that assistance within fifteen (15) days of Customer's request. If Innovus receives a request directly from a Data Subject, it shall forward it to Customer without undue delay and shall not respond itself except on Customer's instructions. Under the BYOA Deployment, Customer answers requests for Personal Data in its own account with the Celara Platform's tools; the erasure function removes memory data from the vector, analytics, graph, and cache stores but does not cover run history, tool-call logs, workflow journals, or traces, which Customer manages under its own retention settings. To the extent permitted by Data Protection Laws, Customer shall reimburse Innovus for reasonable costs incurred in providing such assistance.

7. Security incidents

7.1 Notice. Innovus shall notify Customer without undue delay, and in any event within seventy-two (72) hours after Innovus confirms a Security Incident. The notice will go to Customer's notice contact and will describe, as far as then known, what happened, the data and deployments affected, the steps Innovus has taken, the steps Customer should take, and a contact for further information. Innovus will update Customer as it learns more. Notice is not an admission of fault or liability.

7.2 Customer Reports. Customer shall report suspected security incidents involving the Celara Platform to security@celara.ai.

7.3 Assistance and Costs. Innovus shall provide reasonable assistance to Customer in the investigation, mitigation, and remediation of a Security Incident and of any Personal Data Breach that Customer must report. Where Innovus or its Subprocessor caused the Security Incident, Innovus bears its own internal costs of investigating and assisting and will not charge Customer for them. Innovus is not required under this Section to pay Customer's own costs, including fees of Customer's lawyers, consultants, and forensic investigators and the costs of notifying individuals or regulators; any claim for those costs is governed solely by Section 9 of the Agreement.

7.4 Incidents in Customer's Account. Under the BYOA Deployment, Customer runs the response to an incident inside its own cloud account. Innovus will help on request through support access Customer grants. Assistance Customer requests beyond Section 7.3, including for incidents Innovus did not cause, counts against Customer's support hours or is charged at Innovus's then-current support rates.

8. Deletion or return of data

8.1 Deletion. Within thirty (30) days after termination or expiration of the Agreement, Innovus shall delete the Personal Data, other Customer Data, and Service Data that it or its Subprocessors hold for Customer. This obligation applies whether or not any amounts are owed.

8.2 Export. During that thirty (30) day period, Innovus shall, on Customer's request, export that data to Customer in a commonly used, machine-readable format.

8.3 Backups. Copies in backups expire within thirty-five (35) days after the end of that thirty (30) day period and stay protected under this DPA until they expire.

8.4 Records Required by Law. Innovus may keep records it must keep by law, only for as long as the law requires, and those records stay protected under this DPA.

8.5 Confirmation; BYOA. On request, Innovus shall confirm deletion in writing. Customer Data in Customer's own cloud account stays under Customer's control in standard formats, and Customer is responsible for keeping or deleting it.

9. CCPA specific provisions

To the extent the CCPA applies, Innovus acts as a “Service Provider” to Customer. Innovus shall not retain, use, or disclose Personal Data for any purpose other than for the specific purpose of performing the services specified in the Agreement, or as otherwise permitted by the CCPA. Innovus certifies that it understands and will comply with these restrictions. Innovus shall not “sell” or “share” (as defined in the CCPA) Personal Data.

Innovus shall provide the same level of privacy protection required by the CCPA, notify Customer if Innovus determines it can no longer meet its obligations under the CCPA, if applicable, and permit Customer to take reasonable and appropriate steps to verify and remediate Innovus’s use of Personal Data in a manner consistent with Customer’s obligations under the CCPA.

10. Audit rights

Innovus shall make available information reasonably necessary to demonstrate compliance with this DPA. Audits may be satisfied, where reasonable, through provision of current security reports, summaries, certifications, or responses to security questionnaires. No more than once annually, Customer may conduct an audit during normal business hours, upon reasonable notice, subject to confidentiality obligations, provided such audit does not unreasonably interfere with Innovus’s business operations or compromise security, confidentiality, or other customers’ information. To the extent permitted by Data Protection Laws, Customer shall bear its own costs and expenses related to any audit and shall reimburse Innovus for reasonable costs incurred in providing such assistance.

Innovus shall, on request and under a non-disclosure agreement, provide summaries of the results of its latest independent security assessment and annual external penetration test, once performed. Innovus plans to obtain an independent SOC 2 Type I report; once issued, Innovus will provide the current report on request under a non-disclosure agreement. Under the BYOA Deployment, audits cover Innovus's processing and the services Innovus runs; Customer's own cloud account is outside the audit scope.

11. Customer obligations

Customer is responsible for ensuring that its instructions comply with Data Protection Laws and that it has obtained all necessary rights, consents, and legal bases to permit Innovus to process Personal Data in accordance with this DPA. Customer shall not submit special categories of Personal Data, protected health information, payment card data, government identification numbers, children’s data, or other sensitive Personal Data unless expressly authorized in writing by Innovus. Under the BYOA Deployment, Customer is also responsible for the items assigned to Customer in Section 6 of Exhibit B.

12. Data location

The services Innovus runs for the Celara Platform (license check-in, release registry, Health Telemetry intake, and the Datahub) are hosted, or when live will be hosted, in AWS region us-east-2 (Ohio, United States). Subprocessors process Personal Data in the locations shown on the Subprocessors Page. Personal Data in a BYOA Deployment stays in the cloud region Customer chooses. Innovus will give notice under Section 6.10 of the Agreement before moving the services it runs to another location.

13. Liability and order of precedence

13.1 Liability. Each party's liability arising out of or related to this DPA, including the Standard Contractual Clauses, is subject to the limitations and exclusions of liability in the Agreement, to the extent Data Protection Laws allow. This does not limit the rights of Data Subjects under the Standard Contractual Clauses.

13.2 Order of Precedence. If this DPA conflicts with the Agreement about the Processing of Personal Data, this DPA prevails, except that the Standard Contractual Clauses and other transfer terms prevail as Section 5 provides.

Annex I: Details of processing

Subject Matter: Provisioning and usage of the Celara Platform.

Duration: For the term of the Agreement and until deletion under Section 8.

Nature and Purpose: Processing necessary to provide, maintain, secure, and support the Celara Platform for Customer. Innovus does not process Personal Data to train or improve artificial intelligence models or to improve the Celara Platform.

Categories of Data Subjects: Customer’s users, employees, contractors, and end users.

Categories of Personal Data: Sign-in and directory data (names, email addresses, roles, and identity provider attributes) through WorkOS; support communications and data Customer shares or shows in support sessions; Datahub queries and datasets; email addresses and message content of email Innovus sends through its SendGrid account; LinkedIn and WhatsApp connector data through Unipile, only if a user enables that connector; Service Data to the extent it is Personal Data; and any other Personal Data Customer submits to Innovus.

Location of Processing: Services Innovus runs: AWS us-east-2, now or when live (see Section 12). Subprocessors: the locations shown on the Subprocessors Page. Personal Data in a BYOA Deployment: the cloud region Customer chooses.

Subprocessors: As listed at celara.ai/subprocessors.

Security Measures: See Annex II.

Annex II: Technical and organizational measures

Measures marked "planned" are being put in place by the date shown; the rest are in place today.

• Encryption: TLS 1.2 or later for data in transit (confirmation on every public endpoint planned by 2026-11-15); databases and volumes encrypted at rest, with keys as the Security Overview states; secrets kept in HashiCorp Vault or AWS Secrets Manager, never in code.
• Isolation: Postgres row-level security in FORCE mode on every table with an organization id; each request checked for user-to-organization membership; mutual TLS between Celara services, with two documented exceptions (one workflow engine port and the LiteLLM gateway); all but one service refuse to start if their database role can bypass row-level security.
• Access Control: Innovus staff sign in through single sign-on with multi-factor authentication (GitHub single sign-on with multi-factor authentication planned by 2026-10-19); AWS access only through least-privilege roles, with no long-lived access keys for people or machines; access reviewed every quarter (first review planned by 2026-12-31) and removed within one business day after a person leaves.
• Logging and Monitoring: AWS CloudTrail and GuardDuty on every AWS account Innovus runs, with audit logs kept for one year in write-once storage (all planned by 2026-10-26); Celara log redaction on by default; governance evidence is append-only.
• Secure Development: every change reviewed in a pull request by a reviewer other than its author (enforcement in repository settings planned by 2026-10-19), which for a change written by an AI agent may be an independent AI reviewer; every high-risk change, such as one to sign-in, permissions or encryption, approved by a person; every promotion to production approved by a named person; releases built by CI, scanned for vulnerabilities (planned by 2026-10-31) and signed (planned before the first BYOA installation); vulnerabilities fixed within set deadlines.
• Testing and Assurance: an annual external penetration test (the first planned before the first enterprise BYOA agreement) and an annual internal self-assessment of security controls (the first planned by 2027-03-31).
• Incident Response: a written incident response plan, exercised once a year (plan and first exercise planned by 2027-03-31), with customer notice as set out in Section 7.
• Business Continuity: a target of restoring the services Innovus runs within 24 hours, losing at most 24 hours of data (recovery plan planned by 2027-03-31); backups run daily or more often; a restore is tested once a year (daily backups confirmed and the first restore test planned by 2026-12-31).
• Personnel: confidentiality agreements and annual security training for all staff (first training round planned by 2026-11-30); identity and reference checks, where local law allows, before access to customer data (process planned by 2026-11-30).
• BYOA Deployment: controls in Customer's own cloud account are allocated as set out in Section 6 of Exhibit B of the Customer Agreement.