GDPR Article 28 Compliance
Data Processing Agreement (DPA)
This Data Processing Addendum supplements the CodeXox Terms of Service and governs the processing of personal data on behalf of our business customers under GDPR, UK GDPR, and global data protection laws.
EU SCCs (2021/914) Module 2
·Zero Retention AI Model Guarantee·SOC 2 Type II AlignedKey Data Protection Principles
- Processing Instructions: CodeXox processes Customer Personal Data solely upon documented customer instructions.
- Confidentiality: All staff with access to customer systems are bound by strict non-disclosure obligations.
- Security of Processing: AES-256-GCM encryption at rest, TLS 1.3 in transit, and multi-factor authentication.
- Breach Notification: Customer notification within 48 hours of confirmed security incidents affecting personal data.
Authorized Sub-Processors (Annex III)
Customer grants general written authorization for CodeXox to engage the following infrastructure sub-processors:
| Sub-Processor | Processing Purpose | Location | Legal Transfer Mechanism |
|---|---|---|---|
| Hostinger International Ltd | Cloud VPS Infrastructure, Node.js 22 SSR Runtime & Automated SSL | Lithuania / European Union | EU Adequacy Decision / GDPR Article 28 DPA |
| Cloudflare, Inc. | Edge Anycast CDN, DDoS Protection, WAF & DNS Routing | United States / Global Anycast | EU Standard Contractual Clauses (SCCs) & Data Privacy Framework |
| Supabase, Inc. (hosted on AWS) | Managed PostgreSQL, Realtime WebSockets & Encrypted Storage | United States (US-East) / Frankfurt (EU) | SOC 2 Type II / ISO 27001 / EU SCCs |
| Stripe, Inc. | Payment Gateway & Billing Infrastructure | United States / Ireland | PCI-DSS Level 1 / EU SCCs |
| Anthropic, PBC | Frontier Foundation LLM Inference (Claude 3.5 Sonnet) | United States | Commercial Zero Data Retention (ZDR) Addendum |
| OpenAI, LLC | AI Code & Schema Generation (GPT-4o) | United States | Commercial Zero Data Retention (ZDR) Addendum |
Technical & Organizational Measures (Annex II)
Access Control & RBAC
Principle of least privilege, zero root access in production, and mandatory hardware-backed FIDO2 MFA.
Cryptographic Standards
Encrypted with AES-256 at rest, TLS 1.3 forward-secret ciphers in transit, and CMEK key support.
Continuous Monitoring
Automated vulnerability scans, real-time intrusion detection (IDS/IPS), and immutable audit logs.
Execute Data Processing Addendum
Generate an official, counter-signed PDF DPA for your enterprise compliance records.