Firstier Data Processing Agreement

Service

Firstier Shield — Control web app and Web browser extension: inventory of AI tools used in the browser, enforcement of the Customer's data-loss-prevention policies, compliance audit trail.

Data exporter

Customer, as named in the signature block; address as stated in the Agreement. Role: Controller.

Data importer

Provider (Firstier AI Governance GmbH), Franz-Joseph-Straße 48, 80801 Munich, Germany. Contact: the Managing Directors of Firstier AI Governance GmbH (see the Legal Notice). Role: Processor.

Categories of data subjects

• Customer's employees

Categories of personal data

• Name
• Contact information such as email, phone number, or address
• User activity and analysis such as device information or IP address

Special category data

No special category data is processed.

Frequency of transfer

Continuous.

Nature and purpose of processing

Provider processes Customer Personal Data as instructed in Section 3.2 of the DPA Standard Terms. The nature of processing includes:

• Receiving data, including collection, accessing, retrieval, recording, and data entry
• Holding data, including storage, organization, and structuring
• Protecting data, including restricting, encrypting, and security testing
• Erasing data, including destruction and deletion

Duration of processing

Provider processes Customer Personal Data as long as required (i) to conduct the processing activities instructed in Section 2.2(a)–(d) of the Standard Terms; or (ii) by Applicable Laws.

Approved sub-processors

• Supabase (database and authentication) — location: EU. Storage of discovery and audit metadata and account authentication — never prompt or file content.
• Cloudflare (hosting, WAF/DDoS protection, API gateway) — location: EU edge / global network. Hosting, edge and API gateway traffic.
• Resend (transactional e-mail) — location: USA. Sending invitations and notifications — recipient address and links only.
• Sentry (technical error diagnostics) — location: EU. Error diagnostics without personal content.

Provider security contact

[email protected] · Firstier AI Governance GmbH, Franz-Joseph-Straße 48, 80801 Munich, Germany

Governing law and chosen courts

Germany (courts of Munich). Restricted transfers (EEA): Germany.

Competent supervisory authority

The supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Technical and organizational security measures (Annex II)

• User identification and authorization: Every organisation's data is isolated by row-level security; only authenticated users of that organisation can access it. Provider staff access to the admin console requires single sign-on behind an access gateway.
• In transit: All traffic between the browser extension, the web app and the backend is encrypted with TLS.
• At rest: Customer Personal Data is stored in the EU region of the database sub-processor (Supabase), encrypted at rest.
• Events logging: Policy-enforcement and audit events (action type, outcome, policy applied) are logged per organisation and available to the Customer's administrators.
• Data minimization: Detection and redaction run on the user's device; prompt and file content never leave the device. Only metadata is stored (AI service domain, timestamp, organisation/user identifiers, policy outcome).
• Limited data retention: Discovery and audit events are retained for at most 24 months unless agreed otherwise with the Customer, then deleted.