Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (or the enterprise agreement, if you signed one) (the "Agreement") between Wex Labs Limited ("Wex Labs", "Processor") and the customer that accepts it ("Customer", "Controller"). It applies automatically to Team and Enterprise plans, and to any other business customer that asks for it at legal@cusp.run.

1. DefinitionsCopy Anchor Link

1.1 "Data Protection Laws" means all laws relating to personal data that apply to the processing under the Agreement, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the Swiss Federal Act on Data Protection and, where applicable, US state privacy laws such as the California Consumer Privacy Act ("CCPA").

1.2 "Customer Personal Data" means personal data in Customer Content that Wex Labs processes on the Customer's behalf in providing the Cloud and the Managed Gateway.

1.3 "Customer Content" has the meaning given to "Your Content" in the Terms of Service.

1.4 "Sub-processor" means a third party Wex Labs engages to process Customer Personal Data.

1.5 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

1.6 "Restricted Transfer" means a transfer of Customer Personal Data to a country that doesn't have an adequacy decision or regulations under the applicable Data Protection Laws.

1.7 "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the UK GDPR or EU GDPR, as applicable.

2. Scope and rolesCopy Anchor Link

2.1 The Customer is the controller (or a processor acting for its own controllers) of Customer Personal Data, and Wex Labs is its processor (or sub-processor).

2.2 Wex Labs is an independent controller of account, billing, security and service-usage data it processes to run its business, as described in the Privacy Policy. This DPA doesn't apply to that data. This includes the workspace security log (Members' sign-ins with IP address and device type, and administrative changes). Wex Labs makes it available to the Customer's owners and admins for the security of the workspace, and the Customer is responsible for its own use of what it views or exports.

2.3 Local processing. Sessions run by the Cusp desktop app, CLI or a self-hosted runner are processed on the Customer's devices and infrastructure. Wex Labs doesn't process that data unless it's synced to the Cloud, sent through the Managed Gateway, or run on a Cusp cloud runner. Session sync is off on each computer until a Member chooses to turn it on there, and the Cloud accepts no session content from a computer until then. If the Customer turns on the "code stays on device" policy, Members' computers send only metadata (identifiers, status, timestamps, model and counts), the Cloud refuses session content from the Customer's workspace, cloud runners and teleport are unavailable, and the Managed Gateway and the remote-control relay are used only if the Customer's admin explicitly allows them, in which case content passes through without being stored. When the Customer uses its own model provider keys (BYOK) from its own devices, requests go directly to that provider, which isn't a Sub-processor of Wex Labs. Once the Customer's account has encryption set up, session content synced to the Cloud is encrypted on Members' devices before upload; Wex Labs stores it but holds no content keys, and processes only the metadata needed for sync and billing (identifiers, event types and times, approximate sizes, and model, tokens and cost).

2.4 Annex 1 describes the processing.

3. Wex Labs' obligationsCopy Anchor Link

Wex Labs will:

• process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's use and configuration of the Services, unless the law requires otherwise; in that case Wex Labs will tell the Customer first unless the law prohibits it. Wex Labs will tell the Customer if, in its opinion, an instruction breaches Data Protection Laws;
• ensure that its personnel authorised to process Customer Personal Data are bound by confidentiality obligations;
• implement the technical and organisational measures in Annex 2;
• assist the Customer, taking into account the nature of the processing, in responding to data subjects' requests to exercise their rights, mainly through the self-service export and deletion features in the Services. Wex Labs will pass on to the Customer any request it receives directly that relates to Customer Personal Data;
• assist the Customer with data protection impact assessments, prior consultations and security obligations, to the extent the information is available to Wex Labs;
• not sell or share Customer Personal Data (as those terms are defined in the CCPA), not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Services, and not combine it with personal data it receives from other sources except as the CCPA permits; and
• not use Customer Content or Customer Personal Data to train or fine-tune AI models.

4. The Customer's obligationsCopy Anchor Link

The Customer confirms that it has a lawful basis for the processing, has given data subjects any required notices, and that its instructions comply with Data Protection Laws. The Customer is responsible for deciding which personal data to include in Customer Content, and for configuring the Services (such as the model providers it allows, cloud sync and retention settings) appropriately.

5. Sub-processorsCopy Anchor Link

5.1 The Customer gives general authorisation for Wex Labs to engage Sub-processors. Current Sub-processors are listed at Sub-processors.

5.2 Wex Labs will give at least 30 days' notice before adding or replacing a Sub-processor, by updating that page and emailing Customers who have subscribed to updates (or the billing contact for Enterprise customers). The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they can't resolve it, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.

5.3 Wex Labs will impose data protection obligations on each Sub-processor that are no less protective than this DPA, and remains liable for its Sub-processors' performance.

5.4 Model providers. When the Customer uses the Managed Gateway, the model provider that serves a request receives the content of that request. Model providers are listed on the Sub-processors page and on AI and Model Providers. The Customer can restrict which providers its workspace may use. Every Managed Gateway request routed through OpenRouter instructs it to use only providers that don't collect or train on the data. The Customer's workspace admins can require zero-data-retention routing, in which case requests are served only by providers that don't retain Customer Content after serving the request, and the setting's changes are recorded in the workspace audit log. When Members use cloud dictation, the speech-recognition provider listed on the Sub-processors page receives their voice audio and a short list of hint words from the session, to transcribe it; Wex Labs doesn't store the audio or the text. When the agent uses managed web search, the search provider listed on the Sub-processors page receives the search query, which may include words from the session.

6. International transfersCopy Anchor Link

6.1 Wex Labs and its Sub-processors may process Customer Personal Data outside the UK and the EEA, including in the United States.

6.2 For Restricted Transfers, the parties rely on, in this order: an adequacy decision or adequacy regulations (including the EU-US Data Privacy Framework and the UK Extension to it, where the recipient is certified); or the appropriate safeguards below, which are incorporated into this DPA by reference:

• for transfers subject to the EU GDPR: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with Clause 7 (docking) included, Option 2 (general authorisation) in Clause 9 with the notice period in section 5.2, the optional wording in Clause 11 omitted, Irish law in Clause 17, the Irish courts in Clause 18, and the annexes completed by Annexes 1–3 of this DPA;
• for transfers subject to the UK GDPR: the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018 ("UK Addendum"), with Table 1 completed with the parties' details, Table 2 by reference to the EU SCCs above, Table 3 by Annexes 1–3, and in Table 4 neither party may end it; and
• for transfers subject to Swiss law: the EU SCCs, with references to the EU GDPR read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

6.3 Wex Labs has carried out transfer risk assessments for its Sub-processors and will make a summary available on request.

7. Security IncidentsCopy Anchor Link

7.1 Wex Labs will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

7.2 The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Wex Labs will provide further information as it becomes available, and take reasonable steps to contain and remedy the incident.

7.3 Notifying a Security Incident isn't an acknowledgement of fault or liability.

8. AuditsCopy Anchor Link

8.1 On request, Wex Labs will make available the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and any third-party certifications or audit reports it holds.

8.2 If that information isn't sufficient, or a supervisory authority requires it, the Customer may carry out an audit (by itself or an independent auditor bound by confidentiality) no more than once a year, with at least 30 days' notice, during business hours, in a way that doesn't disrupt Wex Labs' operations or compromise other customers' data. The Customer bears its own costs.

9. Deletion and returnCopy Anchor Link

9.1 During the subscription the Customer can export and delete Customer Content using the Services.

9.2 After the Agreement ends, Wex Labs will delete Customer Personal Data within 30 days after the export period in the Terms of Service, and from backups within a further 27 days, unless the law requires it to keep it. Wex Labs will confirm deletion in writing on request.

10. Liability and precedenceCopy Anchor Link

10.1 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws don't allow them.

10.2 If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the EU SCCs or the UK Addendum, those prevail.

Annex 1: Description of the processingCopy Anchor Link

Annex 2: Technical and organisational measuresCopy Anchor Link

Architecture

• Local-first: the agent runtime runs on the Customer's devices; Customer Content reaches the Cloud only through the cloud features the Customer uses (such as sync, cloud runners and artifacts).
• The local daemon binds to the loopback interface only, uses a new random port and bearer token on every launch, and accepts requests only from allowed origins.

Encryption

• TLS 1.2 or higher for all data in transit to and from the Cloud and between Cloud services where supported.
• End-to-end encryption of synced session content on Members' devices once the account has encryption set up; Wex Labs holds no content keys and keeps no key escrow.
• Encryption at rest of databases and storage at the hosting provider.
• Model provider keys stored in the Cloud are encrypted with envelope encryption under a master key held separately from the database; on desktop they're kept in the operating system's credential store.

Access control

• Production access is limited to named personnel who need it, using individual accounts, multi-factor authentication and least privilege.
• Role-based access control within Customer workspaces; scoped tokens for automation.
• Administrative actions are logged.

Isolation

• Cloud runners execute each session in an isolated environment with resource limits.
• Hosted artifacts are served from a separate domain from the app and API, so user content can't access app sessions.
• The agent's shell commands run in an OS sandbox by default, with network access restricted to approved hosts.

Software security

• Code review for every change, dependency and licence scanning, and automated tests.
• Desktop builds are code-signed and notarised; updates are signature-checked.
• Hub extensions are scanned, capability-labelled, countersigned and logged in a transparency log, and can be revoked.

Operations

• Monitoring and alerting for availability and security events.
• Daily and weekly database backups, stored in the EU (Amsterdam) and kept for up to 27 days.
• An incident response process, including the notification duties in section 7.
• A vulnerability disclosure policy.

People

• Confidentiality obligations for all staff and contractors, and security training at onboarding and annually.

Data minimisation

• The Managed Gateway records metadata needed for billing and abuse prevention (such as model, token counts, cost and timing). It doesn't store prompt or response content beyond what's needed to deliver the request, unless the Customer turns on a feature that stores it (such as cloud sync).

Annex 3: Sub-processorsCopy Anchor Link

See Sub-processors.