DRAFT - version draft-2026-11-03. Not yet in force.

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the HideFirst Terms of Service (the "Terms") between the customer named in the order or account ("Customer") and HideFirst, Inc., a Delaware corporation, [REGISTERED ADDRESS] ("HideFirst"). It applies whenever HideFirst processes Customer Personal Data in providing the Services.

Drafting note: the DPA is written so that it holds whether or not a court would treat the Payload as personal data (clause 2). Annex IV gives the reasoning and is meant to be shown to customers' DPOs: it is the honest answer to the first question they will ask.

1. Definitions

1.1 Terms defined in the GDPR (Regulation (EU) 2016/679) have the same meaning here: personal data, processing, controller, processor, sub-processor, data subject, personal data breach, pseudonymisation, supervisory authority.

1.2 "Payload" means the data the SDK, the Python helper or the Extension sends to the HideFirst API to obtain scores: per word, integer feature values and identifiers that contain no letters, no hash of a word and no character offsets, as described in Annex I. "Scores" means what the API returns for a Payload: per word, probabilities and placeholder types.

1.3 "Customer Personal Data" means personal data processed by HideFirst on behalf of Customer under the Terms, including the Payload and the Scores, to the extent they are personal data or are treated as such under clause 2.

1.4 "Customer Content" means the text Customer processes with the SDK, the Python helper or the Extension. Customer Content is processed on Customer's own devices and systems. HideFirst does not receive it.

1.5 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

1.6 "Data Protection Law" means the GDPR and the national law implementing or supplementing it that applies to the processing, including the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

2. The Payload is treated as personal data

2.1 The Payload is derived from Customer Content on Customer's side. It contains no letters, and most of it cannot be linked to a person. It is not anonymous: part of it can, with effort, be linked back to words in the original text, including some names (Annex IV).

2.2 The parties therefore agree to treat the Payload and the Scores as pseudonymised personal data of the persons mentioned in Customer Content, and to apply this DPA to them in full, without either party having to show in a given case that a Payload relates to an identifiable person.

2.3 The Payload may be derived from text that contains special categories of personal data (art. 9 GDPR) or data relating to criminal convictions (art. 10 GDPR). Customer is responsible for having a lawful basis and, where required, an exception under art. 9(2) or a basis under art. 10 for the processing of Customer Content, including its pseudonymisation through the Services.

3. Roles, scope and instructions

3.1 Customer is the controller of Customer Personal Data, or a processor acting for its own customers. HideFirst is Customer's processor, or sub-processor, as the case may be.

3.2 HideFirst is a separate controller for the data it needs to run its business with Customer: the accounts of Customer's users, API keys, usage counts, billing data and technical logs. That processing is described in the Privacy Statement and is not governed by this DPA.

3.3 The subject matter, nature, purpose and duration of the processing, the categories of data and of data subjects are set out in Annex I.

3.4 HideFirst processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless Union or Member State law to which HideFirst is subject requires otherwise; in that case HideFirst informs Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest (art. 28(3)(a) GDPR). The Terms, this DPA and Customer's use and configuration of the Services are Customer's complete instructions at the date of this DPA. Further instructions must be in writing and consistent with the Terms.

3.5 HideFirst informs Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

3.6 HideFirst does not:

(a) store the Payload or the Scores beyond the time needed to compute and return the Scores for the request;
(b) attempt to recover words, names or other information about any person from a Payload, or link a Payload to any other data, except where Customer asks for it in writing for a test of its own data;
(c) use the Payload or the Scores to train, tune or evaluate any model, or for any other purpose of its own;
(d) sell or share Customer Personal Data.

Drafting note: 3.6(c) is a firm promise that HideFirst never learns from customer traffic. It matches the product today (nothing is stored). If you want to keep the option of training on traffic later, it has to be an opt-in per customer, not a silent change: delete (c) only together with adding that opt-in.

4. Confidentiality

HideFirst ensures that persons authorised to process Customer Personal Data are bound by confidentiality, by contract or by law (art. 28(3)(b) GDPR), and have access only to the extent needed to operate, secure and support the Services.

5. Security

5.1 HideFirst implements and maintains the technical and organisational measures in Annex II, which are appropriate to the risk as required by art. 32 GDPR. The measures that operate on Customer's side (local processing of Customer Content, local rules, encryption of the alias book) depend on Customer using the SDK and the Extension as documented.

5.2 HideFirst may change the measures as technology evolves, provided the overall level of security is not reduced.

5.3 Customer is responsible for the security of its own systems, devices, API keys and passphrases, and for reviewing the output of the Services where the stakes require it. The Services reduce, but do not eliminate, the personal data that remains in pseudonymised text (clause 9 of the Terms).

6. Sub-processors

6.1 Customer gives HideFirst general authorisation to engage sub-processors. The sub-processors at the date of this DPA are listed in Annex III.

6.2 HideFirst informs Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by e-mail to Customer's account owner and on [URL OF THE SUB-PROCESSOR PAGE]. Customer may object on reasonable grounds relating to data protection within that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Services with effect from the date of the change, and HideFirst refunds any prepaid fees for the period after termination.

6.3 HideFirst imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA (art. 28(4) GDPR), and remains fully liable to Customer for the performance of the sub-processor's obligations.

7. Assistance

7.1 Data subject requests. Taking into account the nature of the processing, HideFirst assists Customer by appropriate technical and organisational measures in responding to requests from data subjects (art. 28(3)(e) GDPR). As HideFirst stores no Payload, it has nothing to search, retrieve, rectify or erase; it will say so in writing on request. HideFirst forwards to Customer, without undue delay, any request it receives that concerns Customer Personal Data, and does not respond to it itself except to confirm receipt and redirect the requester.

7.2 Security, impact assessments, prior consultation. HideFirst assists Customer in ensuring compliance with arts. 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (art. 28(3)(f) GDPR), in particular by providing the description of the Payload, the measures in Annex II and the assessment in Annex IV for Customer's data protection impact assessment.

7.3 Personal data breaches. HideFirst notifies Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. HideFirst supplements the notice as information becomes available, and takes reasonable steps to contain the breach and mitigate its effects. A notice is not an admission of fault.

8. Deletion and return

8.1 HideFirst does not retain the Payload or the Scores after a request has been answered, so there is no Customer Personal Data to return at the end of the Services. Technical logs contain no Payload or Scores (Annex II).

8.2 Any other Customer Personal Data that HideFirst may hold, for example a Payload Customer has sent to support for diagnosis at its own request, is deleted at the end of the Services or earlier on request, unless Union or Member State law requires its storage (art. 28(3)(g) GDPR).

9. Information and audits

9.1 HideFirst makes available to Customer all information necessary to demonstrate compliance with art. 28 GDPR, including this DPA, Annex II, Annex IV, the current sub-processor list and, once available, summaries of independent security assessments.

9.2 HideFirst allows for and contributes to audits, including inspections, by Customer or an independent auditor mandated by Customer and bound by confidentiality (art. 28(3)(h) GDPR), on at least 30 days' written notice, during business hours, not more than once in any 12 months unless a supervisory authority requires it or after a personal data breach, and in a way that does not compromise the security of the Services or the confidentiality of other customers' data or of HideFirst's trade secrets. Each party bears its own costs, unless the audit reveals a material breach by HideFirst.

10. International transfers

10.1 Where the data is. HideFirst processes Customer Personal Data on servers in the European Union (Germany). It does not move the Payload or the Scores out of the European Economic Area.

10.2 Why the SCCs still apply. HideFirst, Inc. is incorporated in the United States. To the extent that making Customer Personal Data available to HideFirst is a transfer to a third country within the meaning of Chapter V GDPR, the parties enter into the SCCs, which are incorporated into this DPA by reference, as follows:

(a) Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor;
(b) clause 7 (docking clause) applies;
(c) clause 9: option 2 (general written authorisation), with the notice period in clause 6.2 of this DPA;
(d) clause 11: the optional language does not apply;
(e) clause 13(a): where Customer is established in an EU Member State, the supervisory authority responsible for Customer's compliance with the GDPR; where Customer is not established in the EU but falls within art. 3(2) GDPR and has appointed a representative under art. 27(1), the authority of the Member State where that representative is established; where Customer falls within art. 3(2) without having to appoint a representative, the authority of one of the Member States in which the data subjects are located;
(f) clause 17: option 1, the law of Belgium;
(g) clause 18: the courts of Brussels, Belgium;
(h) Annex I.A and I.B: the parties and Annex I of this DPA; Annex II: Annex II of this DPA; Annex III: Annex III of this DPA.

10.3 Data Privacy Framework. [If and while HideFirst, Inc. is certified under the EU-US Data Privacy Framework, it relies on that certification as the primary basis for any such transfer, and the SCCs apply as a fallback if the certification or the adequacy decision ceases to apply.]

10.4 Requests from public authorities. If HideFirst receives a legally binding request from a public authority, including a US authority, for Customer Personal Data, it: (a) notifies Customer promptly, unless the law prohibits it, and then uses its best efforts to obtain a waiver of the prohibition; (b) reviews the legality of the request and challenges it where there are reasonable grounds to consider it unlawful; (c) discloses only the minimum the request requires; (d) documents the request and its response. HideFirst has received no such request at the date of this DPA. HideFirst stores no Payloads or Scores, so a request for stored Payloads would find none; an order to capture live traffic, or a request for account data and logs, is handled under (a) to (d). Annex V is HideFirst's transfer impact assessment.

10.5 Onward transfers. HideFirst does not transfer Customer Personal Data to a sub-processor outside the EEA without a valid transfer mechanism under Chapter V GDPR and a prior notice under clause 6.2.

Drafting note: whether a Delaware company running EU servers from Belgium "imports" data at all is unsettled (EDPB Guidelines 05/2021 count an importer in a third country as such even when the GDPR applies to it). The 2021/914 SCCs are meant for importers whose processing is not subject to the GDPR (Decision 2021/914, art. 1 and recital 7). If HideFirst, Inc. has a Belgian establishment (art. 3(1)) or falls under art. 3(2), they are a stopgap, not a cure; the Commission's SCCs for such importers are still pending. The solid routes are the DPF certification (10.3) or an EU contracting entity (founder summary, choice 2). Keep 10.2 because customers expect it, but don't present it as settling the question.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law or the SCCs provide otherwise, and without limiting the rights of data subjects under art. 82 GDPR.

12. Term, precedence, law

12.1 This DPA applies for as long as HideFirst processes Customer Personal Data and ends automatically when the Terms end and that processing has stopped.

12.2 In case of conflict: the SCCs prevail over this DPA, and this DPA prevails over the Terms in matters of data protection.

12.3 This DPA is governed by Belgian law. The courts of Brussels have exclusive jurisdiction, without prejudice to clause 18 of the SCCs and to the rights of data subjects.

---

Annex I. Description of the processing


Parties	Data exporter: Customer (contact: the account owner). Data importer: HideFirst, Inc., [REGISTERED ADDRESS]; privacy contact [privacy@hidefirst.com]; [EU REPRESENTATIVE / EU ESTABLISHMENT]
Data subjects	Any natural person mentioned in Customer Content: for example clients, patients, employees, counterparties, witnesses, family members of these persons, and Customer's own users when they appear in their own text
Categories of data	The Payload: per word, integer feature values (case, length bucket, digit and punctuation flags, regex and checksum flags, position, capitalisation, distances to punctuation), the identifier of one of about 200 function words, the identifier of a certified common word (about 33,600 generic words; 0 for every other word, including capitalised names), two per-request group numbers (which words repeat, renumbered at random for every request), rule-family flags; per document, about 40 aggregate style values (rates of letter combinations, sizes); the order and number of words. The Scores: per word, probabilities and placeholder types. Never letters, a hash of a word, or character offsets. During the blinded common-word lookup (OPRF elements), HideFirst learns neither the word nor whether it is listed; the elements are randomised, are not personal data and are processed only to answer the lookup. For a word that is on the list, the client then sends its id in the Payload, so HideFirst does see which common word it is
Special categories	Possible, in pseudonymised form only, where Customer Content contains them (clause 2.3). No measures beyond Annex II are needed because nothing is stored; Customer considers this in its own impact assessment
Frequency	Continuous, per request, as Customer uses the Services
Nature and purpose	Automated scoring: computing, for each word, the probability that it should be masked and the placeholder type, so that Customer's SDK or Extension can pseudonymise Customer Content locally. No other purpose
Duration and retention	For the duration of each request (typically under one second). Payload and Scores are held in memory only and are not written to disk, logs or backups
Sub-processors	Annex III

Annex II. Technical and organisational measures

On Customer's side (through the SDK and the Extension, when used as documented) 1. Customer Content is tokenised, turned into numbers and pseudonymised on Customer's device or system. The text, character offsets and the alias book never leave it. 2. Only the feature columns the served model declares are sent (data minimisation by design). 3. Identifiers with a valid checksum, e-mail addresses and telephone numbers are masked by local rules, whatever the Scores say. 4. The client refuses malformed Scores (values out of range, inconsistent types, invalid thresholds) and then produces no output. 5. The alias book is encrypted with AES-256-GCM, under a key derived from a passphrase (PBKDF2-SHA-256, 600,000 iterations) or, in the Extension, a non-extractable device key. 6. The Extension contains no remote code, no analytics and no telemetry.

On HideFirst's side 7. Stateless scoring service: Payload and Scores are processed in memory and discarded after the response. 8. Logs record method, path, status, number of words, duration and per-key counts; never Payload or Scores. 9. Common-word lookups use a verifiable oblivious pseudorandom function (RFC 9497) with a per-customer key; during the lookup HideFirst learns neither the word nor the result. The id of a listed common word is then part of the Payload (Annex I). 10. Group numbers are renumbered at random for every request. 11. Transport encryption (TLS) on every endpoint; HTTP redirects to HTTPS. 12. Access control: API keys are signed, expiring tokens, revocable through a deny list; per-key rate limits and an hourly cap on lookups, with an alarm on unusual volume. 13. Servers: hosted in Germany; SSH by key only; host firewall open only for SSH, HTTP and HTTPS; automatic security updates. 14. Model bundles are signed; the production service refuses unsigned bundles. 15. Secrets are kept in a password manager and referenced, not stored in code or documents. 16. Staff access to production is limited to [the founder / named administrators] and logged [confirm]. 17. Incident response: a breach procedure with the 48-hour notice of clause 7.3. 18. [Backups: the account database is backed up [frequency, location]; Payloads and Scores are never in backups.]

Annex III. Sub-processors of Customer Personal Data

Sub-processor	Service	Location of processing	Transfer basis
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Server hosting for the scoring service	Falkenstein, Germany	None needed (EU)

The following providers support HideFirst's own business and do not receive Customer Personal Data as defined in this DPA: Cloudflare, Inc. (DNS resolution only; API traffic does not pass through Cloudflare), Resend (transactional e-mail to account users), Stripe (payments, when paid plans start). They are listed in the Privacy Statement for the data HideFirst controls.

Drafting note: keep the API hostnames "DNS only" in Cloudflare. Turning on Cloudflare's proxy would route every Payload through Cloudflare and make it a sub-processor under clause 6.2, with 30 days' notice to every customer.

Annex IV. Is the Payload personal data? An assessment

The rule. Data is personal data if it relates to a natural person who is identifiable, directly or indirectly, taking account of all the means reasonably likely to be used to identify the person, by the controller or by another person (art. 4(1) and recital 26 GDPR). Pseudonymised data, which can be attributed to a person with additional information, remains personal data (art. 4(5), recital 26). Whether data is personal for a given recipient depends on whether that recipient has means reasonably likely to be used to identify the person (CJEU, Breyer, C-582/14; EDPS v SRB, C-413/23 P, 4 September 2025), while the controller's own position governs its obligations at the time of collection.

For Customer, the controller, the Payload is plainly personal data: Customer holds the original text and the alias book, and can tie every Payload row to a word.

For HideFirst, the recipient, the question is closer. What HideFirst cannot see: letters, word hashes, offsets, the original text, the alias book; common-word lookups are blinded. What HideFirst can see, by design or by analysis, measured on our own data ([LINK TO THE PUBLISHED RED-TEAM SUMMARY]; internal source: docs/2026-10-03-blind-model-writeup.md §7):

about 44 % of words reach the server as the word itself, through the identifiers of function words and common words. Context around a name ("his wife", "the cardiologist", "born in March") arrives as words;
a model trained to invert the Payload recovers about 30 % of person-name words and about 16 % of full names on held-out documents of one kind, and about 12 % and 6 % on a harder set; in about 38 % of documents at least one person's name comes out. These are lower bounds: a better-resourced attacker would do better;
the per-document values single out a document among 10,000 in about 99 % of cases, so a document that also exists in public, such as a published judgment, can be matched to its public version, names included.

Some of these words and names relate to identifiable persons. A recipient that runs the analysis above has means reasonably likely to be used. The Payload is therefore best regarded as pseudonymised personal data in HideFirst's hands too, at least for part of the traffic. It would not be honest to call it anonymous.

What follows. HideFirst acts as a processor and this DPA applies (clause 2). The measures in Annex II, above all that nothing is stored and nothing is learned from the traffic, keep the risk to data subjects low; they are what a DPIA should weigh. They do not change the classification.

What would change it. Padding document length, removing the remaining letter statistics, and further reductions measured by a new red team could lower the recovery rates. This annex will be updated with each measurement.

Annex V. Transfer impact assessment (summary)


What could reach US law	HideFirst, Inc. is a US corporation and may receive orders under US law (for example the CLOUD Act, or FISA section 702 if it qualifies as an electronic communication service provider), whatever the location of its servers
Stored data in scope	No Payloads or Scores (never stored). Technical logs (counts, no content) and account data, which HideFirst holds as controller
Live data in scope	An order could in theory require capturing Payloads in transit. A Payload has no letters; the risk to data subjects is the partial re-identification described in Annex IV
Measures	EU hosting; no storage of Payloads; data minimisation in the Payload; the commitments in clause 10.4; [DPF certification]; transparency report [yearly, once requests exist]
Assessment	[To be completed and signed by HideFirst before the first customer relies on it: likelihood of access, given the type of provider and data, and the residual risk]