This Data Processing Addendum forms part of the Master Services Agreement between Trimio, Inc. and its customers (MSA §9.1). Questions: compliance@trimio.ai.
This Data Processing Addendum ("DPA") forms part of the agreement between Trimio, Inc. ("Trimio", "we", "us", "our") and the customer ("Customer", "you", "your") for the provision of the Trimio AI Proxy service (the "Services"). It governs the processing of Personal Data by Trimio on Customer's behalf.
This DPA reflects the parties' agreement on the processing of Customer Personal Data in accordance with applicable Data Protection Laws, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA").
| Role | Party | Notes |
|---|---|---|
| Controller | Customer | Determines the purposes and means of processing |
| Processor | Trimio | Processes Personal Data on Customer's instructions |
| Sub-processor | See the subprocessor list on the Trust Center | Process Personal Data on Trimio's instructions, on behalf of Customer |
| Property | Description |
|---|---|
| Subject matter | Trimio proxies inference traffic between Customer's applications and upstream LLM providers. The processing is incidental to that proxy function. |
| Duration | For the duration of the Services Agreement, plus any retention period required by applicable law or as agreed in this DPA. |
| Nature of processing | Receipt, routing, optimization, forwarding, logging, and storage of API requests and (optionally) request and response bodies. |
| Purpose | Provision of the Services (cost optimization, observability, governance) to Customer. |
| Categories of Personal Data | Determined by Customer. Personal Data may be present in API request and response bodies (e.g., user prompts containing names, email addresses, or other identifiers). Customer determines what content to send through the Services. |
| Categories of Data Subjects | Customer's end users, employees, or any other natural persons whose data Customer includes in requests sent through the Services. |
Trimio shall:
5.1. Customer provides Trimio with a general written authorization to engage Sub-processors. Trimio maintains a current list of Sub-processors on the Trust Center subprocessor section.
5.2. Trimio shall inform Customer of any intended additions or replacements of Sub-processors at least 30 days in advance, via email to Customer's registered admin address and via the Trimio status page.
5.3. Customer may object to a new Sub-processor within the 30-day notice period. If Customer reasonably objects, Customer may terminate the affected portion of the Services as Customer's exclusive remedy.
5.4. Where Trimio engages a Sub-processor, Trimio shall impose contractual obligations on the Sub-processor that are no less protective than those imposed on Trimio under this DPA.
5.5. Trimio shall remain fully liable to Customer for the performance of Sub-processors' obligations.
6.1. Trimio is established in the United States. The Services are hosted in the United States (GCP us-central1).
6.2. Where Customer's Personal Data is transferred from the EEA, UK, or Switzerland to the United States, the parties agree that the Standard Contractual Clauses (2021/914) Module Two (Controller to Processor) are incorporated into this DPA by reference, with the following selections:
| SCC element | Selection |
|---|---|
| Clause 7 (Docking clause) | Included |
| Clause 9(a) (Sub-processor approval) | Option 2 (general authorization, 30-day notice — see Section 5) |
| Clause 11(a) (Independent dispute resolution) | Optional — not included |
| Clause 17 (Governing law) | Law of the Republic of Ireland |
| Clause 18 (Forum and jurisdiction) | Courts of Ireland |
| Annex I.A (Parties) | Customer (Data Exporter), Trimio (Data Importer) |
| Annex I.B (Description of transfer) | As described in Section 3 of this DPA |
| Annex I.C (Competent supervisory authority) | The supervisory authority of the EEA member state in which the Data Exporter is established |
| Annex II (Technical and organizational measures) | As described in the security controls on the Trust Center and in Section 7 below |
| Annex III (List of sub-processors) | See the subprocessor list on the Trust Center |
6.3. For transfers from the UK, the UK International Data Transfer Addendum (IDTA) supplements the SCCs as required.
6.4. For transfers from Switzerland, the parties incorporate the SCCs with the modifications required by the Swiss Federal Data Protection and Information Commissioner (FDPIC), including references to the Swiss Federal Act on Data Protection.
Trimio implements the technical and organizational measures described on the Trust Center controls section and the Trimio security page, and summarized below. Specific implementations are detailed in Trimio's Information Security Policy, available under NDA.
8.1. Trimio shall notify Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data breach affecting Customer Personal Data.
8.2. Such notification shall, to the extent then known, describe: - The nature of the breach - The categories and approximate number of Data Subjects and Personal Data records concerned - The likely consequences - The measures taken or proposed to address the breach and mitigate its possible adverse effects
8.3. Trimio shall assist Customer in fulfilling Customer's notification obligations to supervisory authorities and affected Data Subjects, to the extent reasonable and proportionate.
9.1. Trimio shall make available to Customer all information necessary to demonstrate compliance with this DPA and shall allow for audits, including inspections.
9.2. In practice, Trimio satisfies its audit obligations primarily through: - Annual third-party audit reports (SOC 2 — see Trust Center compliance section for current status), provided to Customer under NDA; - The publicly published security materials on the Trust Center and security page; - Responses to reasonable security questionnaires submitted by Customer.
9.3. Customer may request additional audits in the case of a Personal Data breach affecting Customer's Personal Data or upon a specific finding by a supervisory authority. Such audits shall be: - Scheduled with at least 30 days' written notice; - Conducted during business hours; - Conducted in a manner that does not unreasonably interfere with Trimio's operations; - At Customer's expense, unless the audit reveals material non-compliance by Trimio.
10.1. Upon termination of the Services Agreement, and at Customer's choice, Trimio shall delete or return all Customer Personal Data within 30 days, unless retention is required by applicable law.
10.2. Backup data containing Customer Personal Data will be retained for the duration of Trimio's backup retention cycles (up to 210 days for monthly backups) and then deleted automatically by Trimio's tiered retention policy. Customer acknowledges that backup data cannot be selectively deleted without affecting backup integrity for other customers.
10.3. Trimio shall certify deletion in writing upon Customer's request.
For Customer Personal Data subject to the CCPA/CPRA:
11.1. Trimio acts as a Service Provider (CCPA) or Contractor (CPRA) and not as a Third Party.
11.2. Trimio shall not: - Sell or Share Customer Personal Data (as those terms are defined in CCPA/CPRA); - Retain, use, or disclose Customer Personal Data for any purpose other than the specific purpose of performing the Services; - Retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer; - Combine Customer Personal Data with personal information received from other sources except as permitted under CCPA/CPRA.
11.3. Trimio shall assist Customer in responding to verifiable consumer requests for access, deletion, correction, and portability under CCPA/CPRA.
In the event of a conflict between this DPA and the Services Agreement, this DPA shall prevail with respect to the processing of Personal Data. In the event of a conflict between this DPA and the SCCs, the SCCs shall prevail.
This DPA is effective on the Effective Date and remains in effect for the duration of the Services Agreement plus any period during which Trimio retains Customer Personal Data.
Trimio may modify this DPA from time to time. Material modifications will be communicated to Customer via email to the registered admin address. Customer's continued use of the Services after the effective date of a modification constitutes acceptance. The current version is always available at trimio.ai/dpa.
| Item | Description |
|---|---|
| Categories of Data Subjects | Customer's end users, employees, contractors, and any other natural persons whose data Customer chooses to include in API requests through the Services. |
| Categories of Personal Data | As determined by Customer in the content of API requests. May include: names, email addresses, physical addresses, IP addresses, identifiers, and any other Personal Data Customer chooses to send through the Services. |
| Special categories | Customer should not transmit special categories of Personal Data (GDPR Article 9) through the Services without first ensuring an appropriate legal basis exists. |
| Frequency | Continuous, on a per-API-request basis. |
| Nature of processing | Receipt, validation, routing, optimization, forwarding, response handling, optional logging. |
| Purpose | Provision of the Services. |
| Duration of storage | Body logging off by default. When opted in, 90-day default retention (customer-configurable). Audit logs and metadata retained for the duration of the Services. Backups per retention schedule (10/70/210 days for daily/weekly/monthly). |
See the Trust Center controls section and the Trimio security page for the public summary. Detailed control descriptions are in Trimio's Information Security Policy, available under NDA.
See the subprocessor list on the Trust Center for the current list.
Customer:
Company: _________
Name: _________
Title: _________
Date: _________
Signature: _________
Trimio, Inc.:
Name: Brad Reynolds
Title: Co-CEO
Date: _________
Signature: _________
This DPA is reviewed annually and on any material change to Trimio's processing activities or applicable law. For questions, contact compliance@trimio.ai.