Data Processing Addendum with all GDPR Article 28 clauses. Ready to sign.
Technical architecture showing every hop your data takes — and where PII stops.
SOC 2 Type II, ISO 27001, HIPAA-eligible — inherited from Cloudflare.
The key DPA terms,
plain and clear.
Your organization is the Controller. Privedge is the Processor. We act only on your documented instructions.
PII anonymization in-transit only. We process prompts to detect and tokenize PII before they reach LLM providers.
Audit metadata only — timestamp, pii_types, latency_ms, routed_to. Prompt content is never written to storage.
Cloudflare Workers (compute), Cloudflare R2 (audit logs, Enterprise only). No other sub-processors.
Prompts: 0 days. Audit metadata: 30 days (Pro), custom (Enterprise). Everything beyond TTL is permanently deleted.
TLS 1.3 in transit, V8 isolate per request, AES-256 for Edge KV (Enterprise), zero inter-request state.
We notify you within 24 hours of becoming aware of a personal data breach affecting your account.
All audit data deleted within 30 days of contract termination. Self-host mode: we hold zero data.
Full legal text with signature fields. Enterprise: we sign a customized version.
Anonymize + Cloud
vs Edge Inference.
Both modes prevent PII from reaching the LLM provider in cleartext. Edge mode goes further: the data never leaves the Cloudflare node at all.
| Anonymize + Cloud | Edge Inference | |
|---|---|---|
| Model | GPT-4 / Claude | LLaMA 70B |
| PII leaves edge | Tokenized (reversible) | Never |
| Guarantee type | Contractual | Architectural |
| Extra latency | +50–100ms | ~200ms local |
| Best for | GDPR, CCPA, HIPAA basic | HIPAA strict, public sector, legal privilege |
Three arguments.
Citable in any audit.
Data Minimization
"By masking PII at the infrastructure boundary before transmission to AI providers, the customer complies with the data minimization principle. Only anonymized tokens — containing no identifiable information — are transferred to sub-processors. The personal data never leaves the customer's processing region."
Third-Party Risk Elimination
"The customer's exposure to AI provider data breaches is structurally eliminated. Even a complete compromise of the AI provider's systems would yield only synthetic tokens (e.g., [PERSON_1], [CONDITION_1]), which carry zero identifying information and cannot be reverse-engineered without the per-request token map — which is destroyed at request completion."
Right to Erasure — Native
"Because personal data was never transferred to any AI provider's storage, inference logs, or training pipeline, the customer's obligation under Art. 17 with respect to AI-processed data is satisfied by architecture. There is no data to erase from third-party AI systems because no data was ever present."
Ready to close your security review?
We'll send the signed DPA, infrastructure certifications, and walk your security team through the architecture.