Data Processing Agreement

Last updated: July 07, 2026

1. Scope and Roles

This Data Processing Agreement (DPA) applies to all personal data processed by KernelFlow Infrastructure Labs on behalf of its customers. For the purposes of GDPR, KernelFlow acts as a Processor, and the customer acts as the Controller.

2. Data Processing Details

• Categories of Data Subjects: Employees, customers, and end-users of the Controller.
• Types of Personal Data: Names, email addresses, IP addresses, usage logs, and inference request data.
• Purpose of Processing: To provide, secure, and improve the KernelFlow platform.
• Duration: For as long as the customer has an active account, plus any retention period required by law.

3. Subprocessors

KernelFlow uses trusted subprocessors to deliver its services. A complete list is available in our Subprocessor List. We ensure all subprocessors are bound by data protection obligations at least as stringent as those in this DPA.

4. Security Measures

KernelFlow implements appropriate technical and organizational measures to ensure the security of personal data, including:

• Encryption at rest (AES-256-GCM) and in transit (TLS 1.3).
• Role-based access control (RBAC) and least-privilege principles.
• Regular security audits and penetration testing.
• 24/7 monitoring and incident response.

5. Data Breach Notification

In the event of a data breach, KernelFlow will notify the Controller without undue delay (within 72 hours) and provide all necessary information to assist with regulatory reporting.

6. Data Subject Rights

KernelFlow will assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability) in accordance with GDPR and CCPA requirements.

7. International Data Transfers

Data may be processed in the United States and Sri Lanka. KernelFlow relies on Standard Contractual Clauses (SCCs) and other legally-approved mechanisms for international transfers.

8. Contact

For DPA-related questions, contact us at privacy@kernelflow.one.