Legal · Version 1.0
Data Processing Agreement
AxForge's Article 28 processing terms in summary form. This agreement applies to personal data AxForge processes on a customer's behalf under the Terms of Service; a countersigned copy is available on request.
Read this first
How this agreement applies
This page is the agreement text in summary form. It follows the structure of Article 28(3) GDPR. It is incorporated into the Terms of Service by reference; where the two conflict, this agreement prevails for personal-data processing. Customers who need a countersigned copy request it at hello@axforge.ai.
Scope
Parties, subject-matter and duration
| Parties and roles | The customer is the controller; AxForge is the processor. |
| Subject-matter | Provision of AI infrastructure services (the serverless API, dedicated GPU rentals and managed deployments) on hardware AxForge owns and operates in the EEA. |
| Duration | The term of the service agreement. Processing ends when the agreement ends, followed by deletion or return as set out below. |
| Nature and purpose | Serverless API: receiving customer-submitted prompts and context, running them through the selected models and returning completions; prompt and completion bodies are processed in memory only and discarded when the request completes. Dedicated GPU rental: providing a dedicated machine that the customer operates, and deleting it with all data on it when the rental ends. No other purpose, and never training. |
Annex I summary
Data categories and data subjects
| Data categories | Prompts, completions, uploaded context and API request metadata; for dedicated GPU rentals, whatever the customer stores or processes on the rented machine, including any personal data the customer places in that content. |
| Special categories | Determined by the customer, who must have a lawful basis. Special-category data is discouraged on the shared API. |
| Data subjects | Determined by the customer, typically the customer's own users, employees and customers. |
Article 28(3)
Processor obligations
| Documented instructions | AxForge processes personal data only on the customer's documented instructions; each API request, and each rental the customer books and operates, is such an instruction. If we believe an instruction infringes data-protection law, we inform the customer. |
| Confidentiality | Access is limited to named operators, each committed to confidentiality. |
| Technical and organisational measures | In summary: TLS 1.3 at the EU edge; encrypted private WireGuard tunnels from edge to each compute site; prompt and completion bodies held in memory only, never written to disk; enforced row-level-security tenant isolation; cryptographically authenticated internal service calls; one customer per rented machine, deleted with its data at the end of the rental; compute on hardware AxForge owns in controlled-access facilities in Sweden and Spain. The full TOMs annex is available under NDA. |
| Subprocessors | General written authorisation with a public subprocessor register, currently Hetzner Online GmbH (EU edge hosting, Germany), Atom9 (console sign-in identity, Sweden) and Stripe Payments Europe, Limited (payment processing, Ireland). Register subscribers are notified by email 30 days before a new subprocessor takes effect; objections via hello@axforge.ai. |
| Data-subject assistance | We assist the customer in responding to data-subject requests. Prompt and completion bodies are never stored, so there is typically nothing held to access or erase; retained metadata follows the retention table. Data on a rented machine is under the customer's own control during the rental. |
| DPIA and regulatory assistance | We provide reasonable assistance with data-protection impact assessments and prior consultation (Articles 35 to 36), based on the information available to us as processor. |
| Personal-data breach notification | We notify affected controllers of a personal-data breach without undue delay (Article 33(2)), to the customer's registered contact. |
| Audits and inspections | We make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by the customer or a mandated auditor. Supporting evidence grows as the assurance programme on the security page completes. |
| Deletion and return | At the end of the service we delete or return personal data at the customer's choice and delete existing copies, unless EU or member-state law requires storage. Prompt and completion bodies are never stored, and rented machines are deleted with their data when the rental ends, so end-of-service deletion covers account and metadata stores; backups hold metadata only, on a 35-day rotation, and never contain prompt or completion bodies or rented-machine contents. |
Residency
Processing location and disclosure
| EEA-only processing | All processing under this agreement takes place inside the EEA: eu-se-1 · Stockholm for serverless inference and RTX 3060 rentals, eu-es-1 · Málaga for dedicated DGX Spark workloads. |
| No foreign failover | If all EEA capacity is unavailable, requests queue or fail. They are never routed outside the EEA. |
| Legally compelled disclosure | If legally compelled to disclose customer personal data, we challenge the demand where lawful and notify the customer, unless we are legally prohibited from doing so. There are no stored prompt or completion bodies to hand over. |
Related
Where the details live
Document history
Version
Version 1.0 · Effective 2026-09-04 · Last reviewed 2026-09-04.
- 2026-09-04, version 1.0: applies under the Terms of Service by reference; dedicated GPU rentals and payment processing added; subprocessor list and processing locations updated.
- 2026-08-26, first published version.