Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between DURU LLC d/b/a DuruVault ("Processor", "we") and the customer acting as controller ("Controller", "you") for the processing of personal data in connection with the Services. It applies where DuruVault processes personal data on the Controller's behalf.

1. Roles & Scope

For customer-uploaded documents and account content, the Controller determines the purposes and means of processing and DuruVault acts as Processor (or subprocessor). For limited data DuruVault processes for its own security, billing, and service-operation purposes, DuruVault acts as an independent controller as described in the Privacy Policy.

2. Subject Matter & Duration

Subject matter: the Services. Duration: for the term of the account plus any legally required or backup-rotation retention period. Nature/purpose: storage, organization, sharing, verification, e-signature, and AI-assisted processing of documents. Data subjects: the Controller's users and individuals referenced in uploaded documents. Categories: as described in the Privacy Policy (including sensitive categories the Controller chooses to upload).

3. Processing Instructions

DuruVault processes personal data only on the Controller's documented instructions (including via use of the Services) and as required by applicable law. DuruVault will inform the Controller if, in its opinion, an instruction infringes applicable data-protection law.

4. Confidentiality

Personnel authorized to process personal data are bound by confidentiality obligations and operate under the principle of least privilege.

5. Security Measures

DuruVault maintains technical and organizational measures appropriate to the risk, which currently include:

• Encryption of data in transit (TLS; HSTS enforced) and encryption of off-site disaster-recovery backups.
• Authentication controls including password hashing (bcrypt), multi-factor authentication, passkeys/WebAuthn, session expiry, and brute-force lockout.
• Role-based access control, per-tenant data isolation, audit logging, and hardened security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy).
• Least-privilege human access limited to support, troubleshooting, security investigation, and legal compliance.

6. Subprocessors

The Controller authorizes DuruVault to engage the subprocessors listed in the Subprocessor List (/legal/subprocessors). DuruVault imposes data-protection obligations on subprocessors and remains responsible for their performance. DuruVault will provide a mechanism to notify Controllers of intended changes and an opportunity to object where required by law.

7. Data Subject Rights

Taking into account the nature of the processing, DuruVault assists the Controller by appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests (access, correction, deletion, portability, objection). Self-service export and account deletion are available in-product.

8. Personal Data Breach

DuruVault will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, and will cooperate as described in the Incident Response Policy (/legal/incident-response).

9. International Transfers

Where personal data is transferred across borders, the parties will rely on a lawful transfer mechanism required or recognized by applicable law (e.g., Standard Contractual Clauses for EEA/UK transfers, and the transfer provisions of the Nigeria Data Protection Act where applicable). See the NDPA & Cross-Border Transfer Review (/legal/ndpa).

10. Return & Deletion

Upon termination, and subject to legal retention requirements, DuruVault will delete the Controller's personal data. In-product account deletion purges documents and associated stored objects, folders, shares, verifications, sessions, subscriptions, payment transaction records, identity-verification records, notifications, passkeys, and the account record. Residual copies may persist in encrypted backups until rotated out per the Retention & Deletion Policy (/legal/retention).

11. Audits

DuruVault will make available information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits as required by applicable law, subject to appropriate confidentiality and security safeguards.

12. Precedence

In case of conflict between this DPA and the Terms of Use or Master Services Agreement regarding the processing of personal data, this DPA controls to the extent of the conflict. Governing law: State of New York, United States, except where mandatory data-protection law provides otherwise.