Legal

Data Processing Addendum.

For customers subject to GDPR, UK GDPR, or similar regimes who need a contractual data-processor agreement with Huxkan Labs.

Summary.

Huxkan Labs acts as a data processor for the limited categories of personal data we receive (account info, hashed end-user IPs, usage events). You are the data controller for everything in your fleets, including any prompts and completions — but those never reach our infrastructure, by design. Sovereign mode is what makes this DPA short.

What we process.

• Account data: email, name, hashed password.
• Fleet metadata: fleet names, hostnames, GPU specs.
• Usage events: per-request metering (no payload data).

Sub-processors.

• AWS — hosting (Mumbai region).
• Stripe — payments (paid tiers).
• Postmark — transactional email.
• (none for analytics — we run our own).

We notify you 30 days before adding a new sub-processor.

Security.

TLS 1.2+ in transit. AES-256 at rest. RLS isolation per tenant. Pepper-based HMAC for API key hashes. We follow industry standard practices but do not currently hold SOC 2, ISO 27001, or similar formal attestations — see about for our roadmap.

Data subject rights.

You can request export, correction, or deletion via the console or by emailing privacy@huxkan.com. We respond within 30 days as required by GDPR Article 12(3).

International transfers.

Our infrastructure is in India. If you're an EU/UK controller, we rely on Standard Contractual Clauses for the transfer. Contact legal@huxkan.com for the executed SCCs.

Audit.

Enterprise customers may request a written security questionnaire response. On-site audits are evaluated case-by-case.

Contract.

By accepting our Terms of Service, you accept this DPA as part of the service. Enterprise contracts may attach a separately-signed DPA that supersedes this page.