This document is a draft under legal review. Highlighted text is still to be filled in. Until it’s final, the agreement you sign with us governs.
1Scope and roles
This Data processing agreement (“DPA”) is between the Customer and Twospoon legal entity name (“Twospoon”). It applies when Twospoon processes personal data in Customer Data on the Customer’s behalf. The Customer is the controller and Twospoon is the processor. Terms such as “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR, the UK GDPR and other applicable data protection law.
2Processing on instructions
Twospoon processes personal data only on the Customer’s documented instructions: this DPA, the Terms, the Customer’s settings in Miles, and the tasks its Users give agents. Twospoon will tell the Customer if it believes an instruction breaks data protection law. The details of the processing are in Annex 1.
3Confidentiality of personnel
Twospoon makes sure everyone authorised to process the personal data is bound by confidentiality, and gives access only to those who need it to provide, secure or support the Service.
4Security
Twospoon maintains the technical and organisational measures in Annex 2, and may improve them, but won’t reduce the overall level of protection during the term.
5Subprocessors
The Customer authorises Twospoon to use the subprocessors on the Subprocessors page. Twospoon will give at least 30 days’ notice of a new subprocessor. The Customer may object on reasonable data protection grounds within that time; if the parties can’t resolve it, the Customer may end the affected part of the Service and receive a refund of prepaid fees for it. Twospoon binds each subprocessor to data protection terms no less protective than this DPA and remains responsible for it.
When the Customer runs Miles in its own cloud account or on its premises, the computers, files and models run in the Customer’s environment and are not processed by Twospoon’s subprocessors. Air-gapped deployments send Twospoon nothing.
6Assistance
Taking into account the nature of the processing, Twospoon will help the Customer answer requests from individuals exercising their rights, and with security, breach notification, data protection impact assessments and consultation with authorities. Most requests can be handled in Miles itself. Twospoon will pass on any request it receives directly and won’t answer it without the Customer’s instruction.
7Personal data breaches
Twospoon will tell the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs to meet its own obligations, and will take reasonable steps to contain it.
8Return and deletion
When the agreement ends, the Customer may export Customer Data for 30 days. Twospoon then deletes it from the systems it runs, unless the law requires keeping it, in which case it stays protected by this DPA. The audit log is kept for one year from each event unless the Customer deletes its workspace.
9Audits
Twospoon will make available the information needed to show it meets this DPA, including answers to reasonable security questionnaires. Where that isn’t enough, the Customer may audit, once a year, with 30 days’ notice, during business hours, through an independent auditor under confidentiality, at its own cost.
10International transfers
Where personal data is transferred out of the European Economic Area, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission’s standard contractual clauses (module two, or module three for subprocessors), with the UK addendum where it applies. The details for the clauses are those in Annex 1 and Annex 2.
11Annex 1: details of processing
| Subject matter | Providing Miles: AI agents that work on their own computers and in connected apps for the Customer |
| Duration | The term of the agreement, plus the export window |
| Nature and purpose | Hosting, storing, displaying and processing Customer Data so agents can carry out the Customer’s tasks, and securing and supporting the Service |
| Data subjects | The Customer’s Users, and people whose data appears in the Customer’s apps, files and tasks, such as customers, employees and contacts |
| Categories of data | Names, contact details, account and role details, and any personal data in chats, files, screens and connected apps that the Customer chooses to process |
| Special categories | Only if the Customer chooses to process them; the Customer is responsible for having a lawful basis |
| AI models | Miles agents use open-source AI models that Miles runs itself: in Miles Managed Cloud, in your own cloud account, or on your own premises, depending on how you deploy. We don’t send Customer Data to third-party AI model providers, and we don’t use Customer Data to train models. |
12Annex 2: security measures
- Single sign-on through SAML, directory sync (SCIM), and two-step sign-in that can be required for every role.
- Session policies: sign-out after inactivity, capped session length, and signing out everyone.
- Role-based access: each person’s chats and files are private to them; administrators see setup, cost, apps and the record, not chats.
- Credentials for connected apps are never shown to anyone, administrators included.
- Approval before agents send, pay or delete, with a second approver above a money threshold.
- A tamper-evident audit log: hash-chained, signed every hour, and kept for a year.
- A kill switch that stops every agent and computer at once.
- Deployment where the Customer chooses: Miles Managed Cloud, the Customer’s cloud region, or its premises, including air-gapped.
- Encryption in transit and at rest, backups and staff security training: confirm the specifics before launch