Overview
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Tensor Machine ("Tensor Machine", the "Processor") and the customer ("Customer", the "Controller" or "Data Fiduciary" as applicable under Indian law).
This DPA governs Tensor Machine's processing of personal data on behalf of the Customer when the Customer uses Tensor Machine's AI inference services. Enterprise customers requiring a signed DPA for audit purposes should contact legal@tensormachine.ai.
Definitions
Personal Data / Personal Information: As defined in the Digital Personal Data Protection Act 2023 — any data about an individual who is identifiable by or in relation to such data.
Processing: Any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or deletion.
Data Principal: The individual to whom the personal data relates.
DPDP Act: The Digital Personal Data Protection Act 2023 (India) and all subordinate legislation, rules, and notifications made thereunder.
Details of Processing
Subject matter: AI inference — executing model inference requests submitted by the Customer via the Tensor Machine API.
Duration: For the duration of the Customer's subscription to the Services.
Nature of processing: In-memory inference processing. Prompts and responses are processed in volatile memory and not written to persistent storage. No logs of inference payload content are maintained.
Categories of Data Principals: End users of the Customer's applications whose data may be included in API requests.
Categories of personal data: As determined by the Customer. Tensor Machine has no visibility into the content of individual requests and does not categorise or enumerate the personal data included therein.
Processor Obligations
Tensor Machine shall:
Process only on instruction: Process personal data only as instructed by the Customer through use of the API, and not for any other purpose including model training, analytics, or disclosure to third parties.
Confidentiality: Ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations.
Security: Implement technical and organisational measures to ensure appropriate security of personal data, as further described in our Security page at tensormachine.ai/security.
Sub-processors: Engage sub-processors only with prior written authorisation (general authorisation is granted by Customer's acceptance of these Terms, subject to the right to object). A current list of sub-processors is maintained at tensormachine.ai/legal/sub-processors.
Assistance: Assist the Customer in fulfilling its obligations under the DPDP Act, including responding to Data Principal rights requests, within commercially reasonable timelines.
Deletion: Upon termination of the Services or on Customer request, delete all personal data held on behalf of the Customer, subject to legal retention obligations.
Data Localisation
All inference processing occurs within Indian data centres (AWS Mumbai region). No personal data submitted via the API is transferred outside India. Account and billing data is likewise stored in India. This architecture is designed to support compliance with data localisation requirements applicable to regulated industries under DPDP Act notifications and sector-specific RBI, IRDAI, and MoHFW guidelines.
Security Incident Notification
In the event of a personal data breach affecting Customer data, Tensor Machine will notify the Customer without undue delay and in any case within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories and approximate volume of Data Principals affected, likely consequences, and measures taken or proposed. Tensor Machine will cooperate with the Customer to contain the breach and fulfil any applicable regulatory notification obligations.
Audit Rights
Enterprise customers may request evidence of Tensor Machine's compliance with this DPA by requesting a copy of applicable security certifications, audit reports, or penetration test summaries (subject to confidentiality obligations). On-site audits may be requested with 30 days advance notice and are subject to reasonable restrictions to protect the confidentiality of other customers and Tensor Machine's proprietary information.
Governing Law
This DPA is governed by the laws of India. Disputes shall be resolved in accordance with the dispute resolution provisions of the Terms of Service, with the seat of arbitration in Bengaluru.