Data Processing Addendum

RUDDERSTACK DATA PROCESSING ADDENDUM (EFFECTIVE SEPTEMBER 09, 2026)

This Data Processing Addendum (“DPA”) forms part of the agreement between RudderStack, Inc. (“Processor”) and the entity identified as Customer (“Customer”), whether that agreement is (a) the RudderStack Terms of Service available at https://www.rudderstack.com/terms-of-service (the “Terms of Service”), or (b) a master services agreement, subscription agreement, or other written agreement executed between Processor and Customer that incorporates one or more Order Forms (each, an “MSA”) (in each case, the “Agreement”). “Order Form” means an ordering document executed by both parties under an Agreement. This DPA applies where Processor processes Personal Data on behalf of Customer (including authorized affiliates of Customer) in connection with the Services.

1. DEFINITIONS

Capitalized terms not defined here have the meaning given in the Agreement.

1.1 “Applicable Data Protection Laws” means all laws applicable to the Processing of Personal Data under the Agreement, including:

  • Regulation (EU) 2016/679 (“GDPR”)
  • UK GDPR and Data Protection Act 2018
  • Swiss Federal Act on Data Protection (revFADP)
  • U.S. state privacy laws (including CCPA/CPRA)
  • Any successor or replacement legislation

1.2 “Controller”, “Processor”, “Subprocessor”, “Personal Data”, “Data Subject” and “Processing” each have the meanings given in Applicable Data Protection Laws.

1.3 “Security Incident” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by Processor. The definition specifically excludes unsuccessful attempts that do not compromise Personal Data.

2. ROLE OF THE PARTIES

2.1 Controller–Processor Relationship

With respect to Customer Personal Data:

  • Customer acts as Controller or Processor.
  • Processor acts solely as Processor (or Subprocessor, where Customer is a Processor and has documented authority from a Controller).

Processor shall process Personal Data:

  • Only on documented instructions from Customer;
  • For the purpose of providing the Services (including, where Customer has enabled them, the AI Features described in §2.4);
  • In compliance with Article 28(3) GDPR and equivalent UK and Swiss requirements.

Customer’s documented instructions to Processor under Article 28(3) GDPR consist of: (i) the Agreement and this DPA; (ii) for Customers under an MSA, the applicable Order Form and any written change orders or statements of work executed by both parties; (iii) the source, destination, tracking-plan, transformation, and AI Feature configurations (including enabling or disabling AI Features for a workspace) established by Customer through the Account; (iv) Personal Data and processing parameters submitted through the Services; and (v) where Customer has enabled AI Features, the instructions set forth in §2.4. Instructions outside the foregoing must be agreed in writing by both parties.

2.2 Processor Restrictions

Processor shall not sell Personal Data, process Personal Data for its own marketing or analytics purposes, or determine independent purposes of processing, except that (a) Processor may process Personal Data as instructed in §2.4 (AI Features), and (b) nothing in this DPA restricts Processor’s use of information that has been de-identified, anonymized, or aggregated such that it is no longer Personal Data under Applicable Data Protection Laws, provided that Processor maintains and complies with measures reasonably designed to prevent re-identification and does not attempt to re-identify such information.

2.3 CCPA and CPRA Compliance

For the purposes of the CCPA and CPRA, Processor acts as a ‘Service Provider’ and shall not: (i) ‘sell’ or ‘share’ Personal Data (as those terms are defined by the CCPA); (ii) retain, use, or disclose Personal Data for any purpose other than for the specific business purposes of providing the Services (including the AI Features and the processing described in §2.4); or (iii) combine Personal Data received from Customer with Personal Data received from other sources, except as expressly permitted by the CCPA. Processor may use Personal Data for internal use to build or improve the quality of the Services to the extent permitted by Cal. Code Regs. tit. 11, §7050, and may use de-identified information in accordance with Cal. Civ. Code §1798.140(m), including by publicly committing to maintain and use it only in de-identified form.

2.4 AI Features

Where Customer enables AI Features (as defined in the Agreement) for a workspace, Customer instructs Processor to process Personal Data contained in Prompts, Outputs, Workspace Context, and the Customer Data that the AI Features read, in order to: (a) provide, operate, secure, and support the AI Features and generate Outputs for Customer; (b) generate and maintain Workspace Context for Customer’s Account; and (c) evaluate the quality, safety, and performance of the AI Features using Prompts and Outputs from which Customer end-user Personal Data has been redacted, unless Customer opts out of such evaluation through the in-product settings. In performing this processing Processor shall: (i) transmit Prompts, Outputs, and Customer Data for model inference only to a Subprocessor listed in §5.3 and only within the geographic region (United States or European Union) of the AWS region selected for Customer’s Account under §5.3; (ii) ensure that inputs to and outputs from any large-language model are not retained by the model-hosting Subprocessor beyond processing of the request, are not used to train or improve any model, and are not disclosed to any model provider; (iii) retain Prompts and Outputs (including conversation transcripts and any redacted copies used for evaluation) for no longer than thirty (30) days after generation, except for Outputs that Customer elects to save within the Services; (iv) apply measures designed to redact Customer end-user Personal Data, including both field names and field values, from Prompts and Outputs before they are persisted beyond the User’s active session; and (v) delete Prompts, Outputs, and Workspace Context in accordance with §10 upon Customer’s request or upon Customer’s deletion of the applicable workspace. Processor will not use Personal Data to train or fine-tune any machine-learning or large-language model. Capitalized terms used in this §2.4 and not defined in this DPA have the meanings given in the Agreement.

3. SUBJECT MATTER AND DETAILS OF PROCESSING

Details of processing are described in Annex I (incorporated below), including:

  • Nature and purpose
  • Categories of Data Subjects
  • Categories of Personal Data
  • Duration
  • Sensitive data (if any)

4. PROCESSOR OBLIGATIONS

Processor shall:

  • Process Personal Data only on documented instructions.
  • Ensure personnel are bound by appropriate confidentiality provisions.
  • Implement appropriate technical and organizational measures (as set forth in Annex II).
  • Provide reasonable assistance to Customer in responding to Data Subject requests.
  • Provide reasonable assistance to Customer with DPIAs and regulator consultations.
  • Notify Customer without undue delay after becoming aware of a Security Incident.
  • Delete or return Personal Data upon termination (Section 10).
  • Maintain records of processing as required by law.

5. SUBPROCESSORS

5.1 General Authorization

Customer provides general authorization for Processor to engage Subprocessors.

5.2 Subprocessor Safeguards

Processor shall:

  • Enter into written agreements with Subprocessors imposing data protection obligations equivalent to those in this DPA as required under Article 28(4) GDPR.
  • Remain fully liable for Subprocessor performance, subject to any limitations set forth in the Agreement.

5.3 Subprocessor List

  • Amazon Web Services (“AWS”) EU - Cloud Service Provider (infrastructure hosting; and, where Customer enables AI Features, large-language-model inference via Amazon Bedrock in an EU region, with inputs and outputs not retained, not used for model training, and not disclosed to model providers)
  • Amazon Web Services (“AWS”) USA - Cloud Service Provider (infrastructure hosting; and, where Customer enables AI Features, large-language-model inference via Amazon Bedrock in a US region, with inputs and outputs not retained, not used for model training, and not disclosed to model providers)

Customer may select which AWS region serves as Processor’s Cloud Service Provider Subprocessor as follows: (a) for Customers under an MSA, by specifying the region on the applicable Order Form; and (b) for Customers under the Terms of Service, by selecting the region during Account creation on the Site, or thereafter through Account settings prior to the ingestion of Personal Data. AWS USA is the default Cloud Service Provider absent affirmative selection by Customer. Once Personal Data has been ingested into a selected region, a change of region constitutes a migration that may require Processor’s assistance and may be subject to operational and commercial terms communicated to Customer at the time of the request.

5.4 Notification of Changes

Processor shall:

  • Provide at least thirty (30) days’ prior notice of new Subprocessors;
  • Deliver such notice (a) for Customers under an MSA by email to the signatory or designated data privacy contact identified in the Agreement or applicable Order Form; and (b) for Customers under the Terms of Service, by email to the Account administrator and, in the alternative or in addition, by in-product or Website notice;
  • Permit Customer to object within twenty (20) days of notice on reasonable data protection grounds.

If Customer’s objection cannot be resolved, the parties will work in good faith to implement alternative safeguards. If no resolution is possible, Customer may suspend the affected Services. Termination applies only if no reasonable alternative exists.

6. INTERNATIONAL DATA TRANSFERS

6.1 Data Privacy Framework (DPF)

Processor maintains certification under the EU-U.S. Data Privacy Framework, such certification shall serve as a valid transfer mechanism for transfers from the EEA and UK (as applicable). SCCs apply regardless of DPF where required by law.

6.2 EU Transfers

Where required, the 2021 EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) are incorporated as follows:

  • Module Two (Controller to Processor)
  • Module Three (Processor to Processor)
  • Docking clause enabled
  • Governing law: Ireland (unless otherwise agreed)
  • Annex I = Annex I of this DPA
  • Annex II = Annex II of this DPA

By accepting this DPA — whether through acceptance of the Terms of Service in connection with creating an Account, by execution of an MSA that incorporates this DPA, or by signing this DPA as a standalone document — both parties are deemed to have executed the EU Standard Contractual Clauses (and, where §6.3 applies, the UK International Data Transfer Addendum) for purposes of Articles 28 and 46 GDPR. The Annexes to the SCCs and the UK Addendum are completed by reference to Annex I and Annex II of this DPA, and the parties’ contact details for purposes of the SCCs are those associated with the Account or the MSA, as applicable.

6.3 UK Transfers

The UK International Data Transfer Addendum to the EU SCCs is incorporated and deemed executed.

6.4 Switzerland

EU SCCs apply with modifications required under Swiss law.

7. SECURITY MEASURES

Processor shall implement technical and organizational measures appropriate to the risk assumed by Processor as further set forth in Annex II, including:

  • Encryption (TLS 1.2+ in transit; AES-256 at rest)
  • Role-based access control
  • Multi-tenant logical separation
  • Logging and monitoring
  • Regular vulnerability testing
  • Incident response procedures
  • Secure backup and disaster recovery
  • Personnel screening and training
  • Other details as set forth in Annex II.

Security measures will not materially decrease during the term.

8. SECURITY INCIDENTS

Processor shall notify, if Customer is impacted, without undue delay and within 72 hours of confirmation, where feasible, and provide the following details:

  • Nature of incident
  • Categories and approximate volume
  • Likely consequences
  • Remediation measures

Processor shall reasonably cooperate with Customer in fulfilling regulatory notification obligations, although notification does not constitute admission of liability by Processor.

9. AUDITS

9.1 Audit Reports

Subject to reasonable confidentiality provisions, Processor shall make available:

  • SOC 2 Type II (or equivalent)
  • Summary security and privacy documentation

9.2 Audit Rights

If required under Article 28 GDPR:

  • Customer may conduct an audit once per year.
  • Audit must be remote as RudderStack has no physical location, although audits shall include access to relevant personnel and system logs necessary to demonstrate compliance with GDPR Article 28.
  • Audit must not compromise other customers’ data.
  • Costs borne by Customer unless material non-compliance found.

10. DATA RETENTION AND DELETION

10.1 Export.

Upon termination of the Agreement, Customer may export Personal Data, where applicable, prior to the effective date of termination.

10.2 Deletion.

Upon Customer’s written request, Processor shall delete or return Personal Data within thirty (30) days, except for copies retained on backup systems, which shall be deleted within Processor’s standard backup cycle and in any event within ninety (90) days. Upon Customer’s written request following deletion, Processor shall certify completion. Prompts, Outputs, and Workspace Context are Personal Data for purposes of this §10 to the extent they contain Personal Data; Processor shall additionally delete them upon Customer’s deletion of the applicable workspace, and in any event on the schedule set forth in §2.4.

10.3 Lifecycle States Under the Terms of Service.

For Customers under the Terms of Service, transition of an Account into the Grace Period or Paused Subscription state set forth in §§1.5, 1.6, and 11 of the Terms of Service does not by itself trigger the deletion obligation in §10.2. During the Paused Subscription state, no new Personal Data is ingested through the Services, the AI Features are unavailable, and Personal Data ingested prior to pause continues to be purged on the schedule set forth in Annex II, and Prompts and Outputs continue to be deleted on the schedule set forth in §2.4. Account configurations (including source, destination, tracking-plan, and transformation configurations, which may reference Personal Data fields) are retained for the Preservation Period set forth in §1.6 of the Terms of Service and are then deleted, except where Customer requests earlier deletion under §10.2 or reactivates the Account prior to expiration of the Preservation Period.

11. DATA SUBJECT REQUESTS

Processor shall:

  • Notify Customer of requests received in a timely manner.
  • Provide reasonable assistance to Customer in responding to such requests.

12. LIABILITY

Liability under this DPA shall be subject to the liability limitations in the Agreement. Nothing in this DPA limits liability where such limitation is prohibited by Applicable Data Protection Laws. Each party remains responsible for administrative fines imposed due to its own violations.

13. CONFIDENTIALITY

All information exchanged under this DPA is confidential under the Agreement.

14. TERM

This DPA remains in effect for the duration of the Agreement and for as long as Processor processes Personal Data.

15. MODIFICATIONS

15.1 Customers Under the Terms of Service.

Processor may update this DPA from time to time by providing at least thirty (30) days’ prior notice via email to the Account administrator or by in-product or Website notice. Continued use of the Services after the effective date constitutes acceptance. No such update will materially diminish the protections afforded to Personal Data under this DPA.

15.2 Customers Under an MSA.

The version of this DPA in effect on the effective date of the applicable Order Form (or, in the absence of an Order Form, the MSA) applies for the duration of that Order Form or MSA and may be modified only by a written instrument signed by both parties, except that Processor may make updates required by changes in Applicable Data Protection Laws upon written notice to Customer.

ANNEX I – DETAILS OF PROCESSING

Nature and Purpose:

Provision of customer data pipeline, routing, transformation, and integration services. Where Customer enables AI Features: provision of an in-product AI assistant that reads Customer’s workspace configuration, event delivery logs, and sample event payloads to respond to User Prompts; generation of Workspace Context; and quality and safety evaluation of the AI Features on redacted Prompts and Outputs, in each case as instructed in §2.4.

Categories of Data Subjects:

End users, customers, employees, or other individuals whose data is submitted by Customer.

Categories of Personal Data:

Data transmitted by Customer via the Services, including identifiers, device information, event data, and other categories determined by Customer. Where Customer enables AI Features: Personal Data contained in Prompts submitted by Users and in Customer Data (including event payloads) read by the AI Features in response to Prompts, and User identifiers associated with AI Feature sessions.

Sensitive Data:

Processor does not intentionally collect special category data and will process such data only upon documented instruction.

Duration:

For the term of the Agreement and applicable retention period. Prompts and Outputs: no longer than thirty (30) days after generation (§2.4). Workspace Context: for the term of the Agreement or until deletion of the applicable workspace.

For Customers under the Terms of Service during the Trial Period and the Grace Period, Customer shall not transmit special category Personal Data, regulated health data, financial account credentials, government-issued identifiers, or children’s data through the Services. The data-type restrictions set forth in §3.2(f) of the Terms of Service apply in full during these periods, and any contrary documented instruction is overridden.

ANNEX II – TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

Technical and Organizational Security Measures:

MODULE TWO: Transfer controller to processor

RudderStack as data importer will implement the following types of security measures:

Data Security & Retention

  • Minimal Data Retention: The platform is engineered to minimize data persistence. Customer data processed by RudderStack is retained for no longer than three (3) hours unless Customer specifically chooses to use RudderStack event storage for up to a maximum of 30 days.
  • AI Feature Data: Where Customer enables AI Features, Prompts and Outputs are retained for no longer than thirty (30) days after generation and are redacted of Customer end-user data (field names and field values) before persistence beyond the active session. Model inference is performed via Amazon Bedrock in the AWS region selected for Customer’s Account with zero retention at the model layer; cross-region inference is disabled; and no Prompts, Outputs, or Customer Data are transmitted to any third-party observability or analytics service.
  • Purging Protocols: Events are stored temporarily in a transient Data Plane database and are either transmitted to their destination or purged within a maximum duration of 3 hours.
  • Encryption in Transit: All data traffic to and from RudderStack is transmitted over Secure HTTP (HTTPS) using TLS v1.2 or higher.
  • Encryption at Rest: All underlying storage is encrypted using industry-standard AES-256 encryption. Key management and cryptographic operations are handled via AWS KMS.

Infrastructure & Architectural Security

  • Logical Multi-Tenancy: RudderStack utilizes a multi-tenancy model to prevent data cross-contamination. Each customer is assigned a unique Workspace ID, and data is logically separated by this identifier.
  • Plane Separation: The architecture maintains a strict logical separation between the Control Plane (configuration management) and the Data Plane (core engine for receiving, buffering, and relaying events). This ensures customers maintain ownership over the data stream.
  • Database Access Controls: The Data Plane database can only connect to application nodes within the containers cluster. In rare instances where engineer access is required for support or troubleshooting purposes, such access is strictly logged, time-limited, and monitored.

Access Control & Monitoring

  • Authentication: The platform enforces Role-Based Access Control (RBAC) to ensure data access is restricted by user ID and privilege. The Enterprise version supports 2-Factor Authentication (MFA) via OTP.
  • Continuous Monitoring: RudderStack uses AWS-native tools for resource tracking and security monitoring, including AWS WAF for traffic filtering and AWS GuardDuty for threat detection.
  • Network Security: Security groups are configured to “implicitly deny” all traffic, with “explicit allow” rules for necessary incoming traffic only.

Resilience & Organizational Security

  • Backup and Recovery: Databases are backed up via AWS Backup on a schedule of daily incremental and weekly full backups, with a 30-day retention period. All backups are encrypted at rest.
  • Personnel Security: All staff undergo background screening and are bound by confidentiality obligations. Personnel must complete regular security and privacy training.

Compliance & Supplementary Safeguards

  • Third-Party Audits: RudderStack maintains a SOC 2 Type 2 certification, validated annually by a third-party auditor.
  • Vendor Risk Management: Key vendors such as AWS (our main subprocessor) are, at a minimum, subject to the same security and privacy measures applicable to RudderStack, with Customers, by signing the standard vendor agreement and DPA. Vendor risks are assessed annually.
  • FISA 702 Safeguards: In the event of a government demand for data (e.g., FISA 702), RudderStack will attempt to redirect the authority to the Customer, provide the Customer with notice and a copy of the demand, and inform the authority that RudderStack’s processing is transient and its product is designed to mitigate long-term data persistence.