Data Processing Agreement

1 · Subject matter & duration

The Processor processes personal data on the Controller's behalf to provide the MajesticMesh services (accounts and API keys, the node list and team, organisations and their members, certificates for shared nodes, the relay for shared nodes, the public node directory). This agreement runs for as long as the Controller uses the services and supersedes prior versions upon update. It supplements the Terms of Service; in case of conflict regarding personal data, this DPA prevails.

2 · Nature, purpose, categories

• Nature of processing: storage of account, session, key and node records; storage of organisation membership records and invitations, sending invitation mails to addresses the Controller enters (on the Controller's behalf and instruction), and issuing signed, node-bound member passes; relaying certificate requests for shared nodes; forwarding shared chats between a browser and the Controller's node through the relay, transiently in memory, including the visitor's IP address, which the node uses for rate limiting; publishing the directory entry (name, description, chat address) of a node the Controller opened to the public. Prompt content is not stored or logged by the Processor.
• Data categories: content the Controller submits in chats forwarded through the relay (which may contain personal data); account data (e-mail address, password hash, role, timestamps); session data (token hash, expiry, IP address, user agent); API-key hashes and labels; node records (peer id, node name, software version, shared chat address, timestamps, binding key); organisation data (the organisation's mail domain; invited e-mail addresses, invitation token hashes and dates; members' account ids, how they joined, and dates of joining and removal); member passes (user id, e-mail address, name, the Controller's account id, the node's peer id — transient, not stored).
• Data subjects: the Controller's users, employees, customers, persons the Controller invites to its organisation, visitors of the Controller's public nodes, and any persons referenced in submitted content.

3 · Processor obligations

• Process personal data only on documented instructions of the Controller (submission of a request is the instruction), unless required by law — in which case the Processor informs the Controller unless prohibited.
• Ensure persons authorised to process data are bound to confidentiality.
• Implement the technical and organisational measures in Annex 1 and adapt them to the state of the art.
• Support the Controller in responding to data-subject requests (Art. 12–23 GDPR) and in obligations under Art. 32–36 GDPR, taking the nature of processing into account.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
• Delete or return personal data after the end of the provision of services, unless retention is required by law. As the Processor stores no prompt content, this concerns account, key and node records.
• Make available information necessary to demonstrate compliance and allow audits — by default through documentation and written answers; on-site audits with reasonable notice where documentation is insufficient.

4 · Sub-processors

The Controller grants general authorisation for the sub-processors in Annex 2. The Processor will announce intended changes on this page with reasonable advance notice; the Controller may object on justified grounds, in which case the remedy is termination of the affected service. Sub-processors are bound by data-protection obligations equivalent to this DPA.

5 · International transfers

Where processing involves transfers outside the EU/EEA (see Annex 2: the United States), such transfers rely on adequacy decisions or standard contractual clauses concluded with the respective sub-processor, supplemented by the measures in Annex 1. Prompts to language models do not pass through the Processor: the Controller's nodes send them to the model provider the Controller configures, under the Controller's own arrangement with that provider.

Annex 1 · Technical & organisational measures (TOMs)

• TLS encryption for all transport (browser and node → gateway, browser → relay → node).
• No storage or logging of prompt/response content by the Processor; application logs contain metadata only.
• Passwords stored as bcrypt hashes; API keys, session tokens and e-mail tokens as SHA-256 hashes; plaintext keys are shown once at creation and never persisted. Sessions expire after 30 days, verification links after 24 hours, reset links after one hour.
• Organisation member passes are signed with the Processor's Ed25519 key, bound to a single node and valid for one hour; they are not stored. Invitation links are stored as SHA-256 hashes and expire after 14 days. A removed member is refused at issuance at once and reported to the Controller's nodes with their next report (within minutes). An organisation domain can only be the domain of the owner's own confirmed address, never a public mail provider.
• Requests that bind a machine to an account carry both the account's key and an Ed25519 signature with the machine's own identity, so nobody can register another party's node.
• Secrets on the servers (such as mail credentials) live in files readable by the service user only, never in the repository or in logs.
• Production access restricted to the operating principal via SSH key authentication; services run under systemd with dedicated system users.
• Public chats: anonymous visitors are rate-limited per IP address and per visitor on the Controller's node, in memory only; nothing about a visitor is written to disk. A node is listed in the public directory only while the Controller keeps its chat public.
• Registry writes are cryptographically self-certified (Ed25519 signatures against the publisher's peer identity), preventing listing tampering by third parties.

Annex 2 · Approved sub-processors

Independent node operators whose agents the Controller calls via the registry act as separate controllers or processors of the Controller — they are not sub-processors of ZeroPerson LLC (see Terms, section 5).