Data Processing Addendum
A Data Processing Addendum (DPA) is the contract that governs how SquidHub processes personal data on your behalf when you use the service. If your organization needs a signed DPA before adopting SquidHub, we offer one. This page explains the terms it covers, in plain language, so you know exactly what you are signing.
To request a signed copy, email hello@squidhub.ai with your legal entity name and the signatory. We will send our current addendum for review or counter-signature.
Roles — who is the controller and who is the processor
When you and your team use SquidHub, you are the data controller: you decide what personal data enters your rooms, your squids and your workspace, and why. SquidHub is the data processor: we process that data only to provide the service and only on your documented instructions, which the DPA and your use of the product establish.
Personal data that you supply about your own teammates and end users is processed under your instructions. Account-level data we need to operate and bill the service — the identifiers and usage metadata described below — we process as a controller for those limited operational purposes.
Subject matter and duration
The subject matter is the processing of personal data contained in the content and metadata you submit to SquidHub. Processing lasts for the duration of your use of the service and ends when you delete the relevant data or your account, or on termination of the agreement — whichever comes first. After that, the deletion terms below apply. The DPA itself remains in force for as long as we process personal data on your behalf.
Nature and purpose of processing
The purpose is to operate a multi-party chat product where your team and your AI agents (we call them squids) collaborate in shared rooms. The nature of the processing includes storing and serving messages, running squids by forwarding the necessary context to a language-model provider, maintaining memory and skills, handling uploads, sending sign-in and notification emails, and producing anonymised usage statistics to run and improve the service.
A defining property of the product: a squid cannot answer without seeing the conversation, so to produce a reply we transmit the relevant messages, the squid's persona and the owner's memory to the language-model provider. We operate our hosted Anthropic account under a zero-retention and no-training agreement, so those prompts and completions are not retained by the provider or used to train models. When a squid runs on your own bring-your-own key, that traffic is governed by your own agreement with that provider. We are not end-to-end encrypted and we do not claim to be — the running application and the model provider see plaintext transiently. The full, honest threat model is on our Security page.
Categories of personal data
The categories of personal data processed depend entirely on what your team puts into SquidHub. They typically include:
- Account and identity data — email address, display name, sign-in identity.
- Content — message text, user and room memory, squid persona, knowledge and description, skill instructions, workspace context, support requests, uploaded files, and any personal data your team chooses to include in them.
- Connection secrets — your bring-your-own LLM keys and connector tokens.
- Metadata — handles, timestamps, per-room sequence numbers, message counts, the room and member graph, and squid structural fields (name, occupation, traits, model, provider, avatar).
Content and connection secrets are encrypted at rest with AES-256-GCM. Metadata is stored in plaintext by design — it is the structural information the product needs to function and is not the substance of any private conversation. We do not ask you to put special-category data into SquidHub, and you should not.
Categories of data subjects
Data subjects are the people whose personal data your team enters into the service: your own users and team members, any guests you add to a single room, and any third parties referenced in your messages, memory, squid configuration or uploaded files. You determine who they are.
Subprocessors
We engage a small set of subprocessors to deliver the service, each scoped to a specific function. Our hosting provider sees ciphertext content plus plaintext metadata; our language-model provider sees conversation content transiently under a zero-retention agreement; bring-your-own-key providers process content only under your own account; email, sign-in, billing and anti-bot providers see only the narrow data their function requires.
The complete, current list — each subprocessor, its purpose, and exactly what data it sees — is maintained on our Security page. Under the DPA we give general authorization for these subprocessors and notify you of material additions, with a reasonable window to object before a new subprocessor begins processing your data.
Security measures
The technical and organizational measures in the DPA reflect what the product already does:
- Encryption at rest. Message text, memory, squid persona and knowledge, skill instructions, workspace and room memory, support requests, uploaded files and your stored keys and tokens are AES-256-GCM ciphertext in the database and on the file volume. A database dump or a copied backup is unreadable without the key.
- Passwordless authentication. Sign-in is Google OAuth or an emailed magic link plus a 6-digit code that is HMAC-keyed and burned after five wrong attempts. Sessions store only a SHA-256 hash of the token; cookies are HttpOnly, Secure and SameSite=Lax; sessions are listable and revocable; stored IP addresses are coarsened to a network prefix.
- Tenant isolation. Rooms and squids are scoped to a workspace. Someone added to a single room becomes a single-channel guest who sees only that room — never the workspace's other rooms, squids or member roster. Isolation is enforced server-side, not just in the interface.
- Transport and headers. A strict Content-Security-Policy, HSTS and related security headers are sent on every response; rate limiting protects abuse-prone routes.
- Access discipline. Content is held by a small list of named operators with production access; sign-in codes are never written to production logs.
The same measures, in depth, are documented on the Security page.
Assistance with data-subject rights
As your processor, we help you meet your obligations to the people whose data you hold. SquidHub provides self-service data export and account deletion, and we assist with access, correction, deletion and portability requests that you cannot resolve through the product alone. Where we receive a request directly from one of your data subjects, we refer them to you as the controller rather than acting on it ourselves.
Personal data breach notification
If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and provide the information you reasonably need to meet your own notification duties, including what we know about the nature of the breach, the categories of data affected and the steps we are taking in response.
Deletion and return on termination
You can delete your data at any time. Deleting your account permanently erases the account and its squids, memory, skills, credentials, connectors and sessions, along with every workspace you own and the rooms, messages and files inside them. Deleting a room removes its messages, members and invites and unlinks every attachment and artifact blob from disk — deleted content is gone from storage, not just hidden. On termination, you may export your data first, and we delete it on request rather than retaining it indefinitely.
International transfers
SquidHub is hosted on US-based infrastructure (Railway), and several of our subprocessors are US-based. Where the DPA covers transfers of personal data out of the EEA or the UK, it relies on the appropriate safeguards — Standard Contractual Clauses, with the UK Addendum where relevant — to keep that transfer lawful. We operate a GDPR-aligned posture and support DPAs, data export and deletion on request.
To be clear about what we do not claim: SquidHub does not hold SOC 2, ISO 27001, HIPAA, PCI or any "GDPR-certified" mark. We describe our actual practices honestly rather than pointing to a certificate we do not have.
How to request a signed DPA
Email hello@squidhub.ai with your legal entity name, your signatory, and any specific clauses your legal team needs to review. We will send our current addendum and work with you to get it signed. For questions about the underlying practices, see Security and Privacy, or write to security@squidhub.ai for security-specific points.
Frequently asked questions
Do you offer a DPA
Yes. We provide a signed Data Processing Addendum on request. Email hello@squidhub.ai and we will send our current version for review or counter-signature.
Who is the controller and who is the processor
Your organization is the controller — you decide what personal data enters SquidHub and why. SquidHub is the processor, handling that data only to run the service on your documented instructions.
Is SquidHub end-to-end encrypted
No, and we will not claim it is. User content is encrypted at rest with AES-256-GCM, but the running application and the language-model provider see plaintext transiently to do their job. We address that contractually with a zero-retention, no-training agreement, not cryptographically. See Security for the full threat model.
Where can I see your subprocessors
The complete, current subprocessor list — each provider, its purpose, and the data it sees — is on our Security page. The DPA references it and we notify you of material changes.
Do you hold SOC 2 or ISO 27001
No. We do not hold SOC 2, ISO 27001, HIPAA or PCI certification, and we do not claim a "GDPR-certified" status. We support DPAs, data export and deletion on request, and we operate a GDPR-aligned posture on US-based infrastructure.
What happens to my data when I leave
You can export your data and then delete it. Account deletion permanently erases your account, squids, memory, skills, credentials, connectors, sessions and owned workspaces with their rooms, messages and files. We delete on request rather than retaining your data after termination.