1. Scope
This Data Processing Agreement (DPA) applies whenever Edulexa processes personal data on behalf of a customer in connection with the Edulexa platform.
2. Roles
Customer is the data controller. Edulexa is the data processor. Each subprocessor listed at /legal/dpa is the sub-processor of Edulexa.
3. Subprocessors
Our hosting provider, Vapi (voice orchestration), OpenAI and Google (AI models), Clerk (authentication), Stripe and Razorpay (billing), and SendGrid (email). The current list with regions is available on request. 30 days notice for any addition or replacement.
4. Security measures
TLS encryption in transit, tenant-scoped data access, sandboxed code execution, and hash-chained audit logs for governance and integrity events. We do not currently hold SOC 2 or ISO 27001 certification.
5. International transfers
EU SCCs (2021 controller-to-processor module) and UK IDTA executed as part of this DPA. No transfers to jurisdictions without an adequacy decision unless customer explicitly opts in.
6. Breach notification
Edulexa will notify the customer within 48 hours of confirming a personal data breach, with full incident report within 7 days.
7. Audit rights
Customer may audit Edulexa's compliance once per year on 30 days notice, or more frequently if required by law, including via a written security questionnaire.
8. Term and termination
This DPA terminates with the underlying MSA. On termination, Edulexa returns or deletes all personal data within 90 days.