Draft for review. Company-specific fields and legal terms must be confirmed before launch. This is not a finalized legal agreement.

Scope

This Data Processing Agreement (DPA) applies when [ENTITY_NAME] processes personal data on behalf of a customer using the hosted Model Meter cloud service. It does not apply to deployments where data remains entirely in your own infrastructure.

Data processed

For hosted cloud customers, Model Meter processes: email addresses of workspace members, ingestion API keys, and usage event metadata (provider, model, tokens, latency, cost estimates, project labels, operation labels). Model Meter does not process prompts, completions, or other LLM request content.

Workspace member email addresses
Ingestion key identifiers (SHA-256 hashed)
Usage event metadata — no prompt or completion text
No data used to train machine learning models

Processor obligations

[ENTITY_NAME] acts as a data processor for the hosted cloud service. We will: process data only per customer instructions, implement appropriate technical and organizational security measures, notify customers of data breaches without undue delay, and assist with data subject requests.

Sub-processors

A list of sub-processors used in the hosted cloud service will be published at [LEGAL_ADDRESS]/sub-processors when the service launches. Customers will be notified of changes to the sub-processor list with at least 30 days' notice.