Data Processing Addendum (DPA)
Version 1.0, May 2026
This Data Processing Addendum forms part of the service agreement between vario Labs (processor) and the customer (data controller).
Subject matter of processing
vario processes electronic corporate communications (emails) exclusively for the purposes of the contracted compliance service: risk signal detection, alert generation and internal investigation.
Sub-processors
- Amazon Web Services (AWS): compute and storage infrastructure for the platform.
- AWS Bedrock: AI analysis, run as a managed service within the same cloud account perimeter. Its inference routing may process content outside the storage region; that international transfer is covered by a contractual basis with the cloud provider and by Standard Contractual Clauses where applicable. By service design, inputs and outputs are not shared with the model providers and are not used to train any model.
- Paddle: payment processing (does not access communications data).
- Clerk: identity management and authentication (does not access communications data).
International transfers
Data does not leave the region chosen by the customer (EU or LATAM Brazil). Transfers to sub-processors are covered by Standard Contractual Clauses (SCCs) under GDPR.
Audit rights
The customer may request compliance evidence about our ISO/IEC 27001:2022 information security management system, whose certification is underway. vario responds to audit requests within 30 business days.
Incident notification
In the event of a confirmed security incident affecting your data, vario notifies your designated security contact within 24 hours of confirmation. The notification describes the incident, the potentially affected data, the immediate mitigation measures and the investigation timeline. For incidents under GDPR/LGPD, vario assists with regulatory notification within 72 hours. This clause prevails over any general support provisions.