Data Processing Agreement

1. Execution & Implementation Scope

This Data Processing Agreement ("DPA") modifies our core Terms of Service. By deploying compute instances, network block storage, or interacting with our API from an IP within the European Economic Area (EEA), or by storing data subjects originating from the EEA, you automatically execute this agreement. GOZEN HOST LLC acts strictly as the Data Processor. You, the client, operate as the ultimate Data Controller.

2. Processor Operational Obligations

As your infrastructure processor, our technical obligations are mathematically rigid:

• We shall process arbitrary customer data (your deployed payloads) only in accordance with your documented API or UI instructions.
• We will not mine, extract, or parse raw data strings sitting inside your NVMe arrays for internal algorithmic research or AI-modeling without explicit deployment parameters.
• Upon termination of your service, all block metadata and instance configs will be purged entirely from volatile memory and wiped from SSD sectors utilizing a zero-overwrite pass within 30 days.

3. Controller Responsibilities

As the Data Controller, you maintain absolute responsibility for the legality of the personal data you inject into our infrastructure. This includes:

• Securing valid, documented consent from your end-users before transmitting their PII endpoints to our servers.
• Configuring local server firewalls (e.g. UFW, iptables) and managing application-level encryption keys for data resting on your partitioned volumes.

4. Physical & Cryptographic Security

We implement extensive architectural safeguards to protect processor-handled data against unauthorized interception:

• Transit Security: API and Control Panel commands are forced through TLS 1.3 protocol pipelines.
• Physical Isolation: Datacenter cages maintain multi-factor biometric entry authentication, restricted exclusively to cleared Level 3 hardware administrators.
• Network Segmentation: Dedicated hypervisor management networks are completely segregated from public customer-facing VLANs via hardware boundary firewalls.

5. Sub-Processor Authorization Networks

We maintain the right to engage external Sub-Processors to provision core infrastructure (e.g. BGP peering networks, bare metal component leasing). We guarantee that every contracted Sub-Processor is legally bound by Standard Contractual Clauses (SCCs) demanding equal or superior cryptographic and physical security thresholds compared to this master agreement.

6. Breach Escalation Protocols

If our internal telemetry or external auditors confirm a catastrophic leak affecting the integrity of the underlying hypervisor clusters or storage nodes:

1. We will formally notify all affected Data Controllers via their registered emergency administrative emails within 48 operational hours of verifying the leak.
2. We will provide known hardware vectors, mitigation steps executed, and coordinate with EU Supervisory Authorities where mandated by law.