Data Processing Terms

These Data Processing Terms describe how RiskShield AI processes personal data on behalf of our customers. They supplement our Terms of Service and reflect the requirements of applicable data-protection laws, including the GDPR and CCPA/CPRA. A countersigned Data Processing Addendum (DPA) is available to customers upon request.

For personal data submitted to the platform, the customer is the data controller and RiskShield AI acts as the data processor. We process that data only on the customer's documented instructions — principally, to provide and support the service.

We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, Row-Level Security tenant isolation, multi-factor authentication, and an immutable audit trail. These measures are described in more detail on our Security page.

We use a limited set of vetted subprocessors (such as cloud hosting, database, AI processing, and email delivery providers) bound by data-protection obligations no less protective than those in our standard DPA. You can view our full active vendor list on our Subprocessors page.

Where personal data is transferred across borders, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.

We retain personal data for as long as needed to provide the service or as required by law. On termination, customer data is deleted or returned in accordance with the agreement, subject to limited retention required for legal or regulatory obligations.

To execute our Data Processing Addendum, contact support@riskshieldai.com.