This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Controller” / “Data Fiduciary”) and TriageWire Technologies (“Processor”) and applies where we process personal data on your behalf in providing the Service, under India’s Digital Personal Data Protection Act, 2023 and other applicable data protection laws.
1. Scope & Roles
You determine the purposes and means of processing personal data contained in tickets, CRM records and workflow payloads (“Customer Personal Data”). We process it only on your documented instructions, namely your configuration and use of the Service, and this DPA.
2. Our Obligations
- Process Customer Personal Data only to provide and support the Service, and not for our own purposes or to train AI models.
- Ensure personnel with access are bound by confidentiality.
- Implement appropriate technical and organisational measures (see section 5).
- Assist you, taking into account the nature of processing, in responding to data principal/subject requests and in meeting your legal obligations.
- Notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
- On termination, delete or return Customer Personal Data as described in section 7.
3. Your Obligations
You are responsible for having a lawful basis and any required notices or consents for the data you send to the Service, and for the accuracy and lawfulness of your instructions.
4. Sub-Processors
You authorise us to use the following categories of sub-processors, each bound by written data protection terms:
- Cloud infrastructure & hosting: Amazon Web Services (AWS) or equivalent.
- LLM inference: enterprise API providers configured with zero-data-retention.
- Payments / Merchant of Record: Dodo Payments, Razorpay, Stripe (billing data only).
We will give reasonable notice (by email or dashboard) of new sub-processors, and you may object on reasonable data protection grounds by writing to contact@triagewire.in. We remain responsible for our sub-processors.
5. Security Measures
- Encryption in transit (TLS 1.2/1.3) and encryption at rest for credentials and tokens.
- Signature verification of inbound webhooks and tenant-level data isolation.
- Access controls, least-privilege and logging of administrative access.
- Regular backups and incident response procedures.
6. International Transfers
Customer Personal Data may be processed outside India by our sub-processors. We do so only where permitted by applicable law and with appropriate safeguards.
7. Return & Deletion
On termination or on your request, we delete operational workflow logs and integration tokens within 30 days, except where retention is required by law (such as tax records).
8. Audit & Information
On reasonable written request, not more than once a year, we will provide information needed to demonstrate compliance with this DPA. Any on-site audit requires mutual agreement and confidentiality terms.
9. Liability & Precedence
Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms regarding personal data, this DPA prevails.
10. Contact
- Processor: TriageWire Technologies (Proprietor: Ashish Mishra)
- Email: contact@triagewire.in, ashish@triagewire.in