Holistic Quality LLC (US (Ohio, USA))
Contact: privacy@holisticquality.io
Under GDPR Article 28, we maintain Data Processing Agreements with all sub-processors that handle personal data on our behalf.
| Processor | Jurisdiction | Data Location | DPA Status | DPA | Executed |
|---|---|---|---|---|---|
| Cloudflare | US (global edge network) | Global edge network | in_force | View DPA | 2026-04-03 |
| Upstash | EU (Ireland) | eu-west-1 (AWS Ireland) | in_force | View DPA | 2025-04-01 |
| Vercel | US | iad1 (US-East) and global edge | in_force | View DPA | 2026-03-31 |
| Resend | US | US | in_force | View DPA | 2025-12-31 |
| Stripe | US | US | in_force | View DPA | Per active SSA |
Action required: Processors with "Pending" status require DPA execution. This page will be updated once agreements are in place.
For processors located outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (2021 Decision) to ensure adequate data protection.
| Processor | SCCs Required | SCCs Status | Transfer Mechanism |
|---|---|---|---|
| Cloudflare | Yes | in_force | 2021 EU Commission SCCs (Module 2 Controller→Processor) incorporated in Cloudflare DPA v6.4; UK IDTA Addendum B1.0; Swiss FADP terms; EU-U.S./UK-U.S./Swiss-U.S. Data Privacy Framework; Global CBPR/PRP System |
| Upstash | No | N/A | N/A — data stored in EU (eu-west-1); no cross-border transfer from EU controller perspective for this data category |
| Vercel | Yes | in_force | 2021 EU Commission SCCs incorporated in Vercel DPA; UK IDTA Addendum; Swiss FADP; EU-U.S. Data Privacy Framework (Vercel DPF-certified) |
| Resend | Yes | in_force | 2021 EU Commission SCCs incorporated in Resend DPA; EU-U.S. Data Privacy Framework (Resend DPF-certified) |
| Stripe | Yes | in_force | 2021 EU Commission SCCs and Data Transfers Addendum incorporated in Stripe DPA/SSA; PCI-DSS Level 1 certified processor |
Detailed breakdown of data categories, retention periods, and encryption for each processor.
Jurisdiction: US (global edge network) (Global edge network) · Encryption: TLS 1.2/1.3 in transit, encrypted at rest
Data categories:
| Data Type | Retention |
|---|---|
| edge security logs | Per Cloudflare provider policy (typically 7-30 days) |
| bot management data | Per Cloudflare provider policy |
Jurisdiction: EU (Ireland) (eu-west-1 (AWS Ireland)) · Encryption: TLS in transit, AES-256 at rest (Upstash-managed keys)
Data categories:
| Data Type | Retention |
|---|---|
| api keys active | Duration of active subscription (max 24 months idle on paid keys per Terms) |
| api keys post cancellation | 90 days baseline; up to 120 days if open Stripe chargeback/dispute window applies |
| trial flags | 30 days (auto-TTL) |
| usage metadata | 90 days (auto-TTL) |
| rate limits | 24 hours (auto-TTL) |
| inquiry data | 30 days (auto-TTL) |
| encrypted backups | Roll off within 35 days of source-record deletion |
Jurisdiction: US (iad1 (US-East) and global edge) · Encryption: TLS 1.3 in transit, encrypted at rest
Data categories:
| Data Type | Retention |
|---|---|
| function logs | 30 days (Vercel default) |
| cdn cache | Per Cache-Control headers |
Jurisdiction: US (US) · Encryption: TLS in transit
Data categories:
| Data Type | Retention |
|---|---|
| email logs | 28 days (Resend retention policy) |
Jurisdiction: US (US) · Encryption: TLS 1.2+ in transit, AES-256 at rest (Stripe managed)
Data categories:
| Data Type | Retention |
|---|---|
| billing data | Per Stripe retention policy |
For your full data subject rights (access, erasure, rectification, portability), see our Privacy Policy.
To exercise your right to erasure: POST /api/keys/erasure with your email address.
This compliance documentation is reviewed quarterly. Next scheduled review: 2026-07-20.
Material changes to sub-processors or data handling will be reflected here and noted in the API changelog.
ALETHEIA Safety Database · Holistic Quality LLC · API Root