Data Processing Addendum (DPA)

1. Scope & Scope of Application

This Data Processing Addendum (DPA) governs the processing of personal data uploaded by corporate tenants onto Saraka DMS in compliance with European GDPR, CCPA, and standard cross-border data transfer regulations.

2. Processing Standards & Security Controls

Saraka acts as the **Data Processor** acting solely under explicit directives of the **Data Controller** (the corporate tenant):

• Documents are processed strictly to supply search, semantic categorization, and OCR extractions.
• Operational staff have no default logical access to raw document objects.
• Annual security audits are performed by third-party compliance firms to verify security measures.

3. Sub-Processors

We utilize select cloud infrastructure and database suppliers to offer Saraka. Any new sub-processor is bound under matching technical security and encryption requirements:

• Cloud Hosting & Document Buckets (AWS / Neon database)
• Authentication & User Management services