Data Processing Addendum (DPA) — OracleAppsGuide.com
Version: 2.0 · Effective 2026-10-29 · Legal review required before execution with a customer. This document is published at
https://oracleappsguide.com/docs/DPA.md.
1. Purpose
This Data Processing Addendum ("DPA") supplements the OAG Terms of Service and describes how OracleAppsGuide.com ("OAG", the "Processor") processes Customer Data on behalf of the customer (the "Controller") when the customer uses the OAG AI Consultant platform.
2. Data residency
- Primary region: United States (Iowa) — used for the OAG Cloud Backend: managed database, object storage, application hosting, background workers, secret management, and logging.
- Cross-region replication is disabled unless required for disaster recovery, with prior notice.
- A data-residency attestation is available on request.
3. Sub-processors
OAG engages the following categories of sub-processor. The named legal entity for each category is recorded in Schedule B of the executed DPA and is provided to customers on request.
| Category | Purpose | Data processed | Region | Controls |
|---|---|---|---|---|
| OAG Cloud Backend (managed database, storage, identity, hosting, secrets, logging) | Identity, application state, retrieval storage, hosting, secrets, observability | Email, workspace data, knowledge documents, execution logs | US (Iowa) | Inherited SOC 2 / ISO 27001 controls; default-deny access rules |
| OAG Model Runtime (managed model inference) | Answer generation and embeddings | Prompts plus redacted retrieval context | US | redactSensitiveData() runs before embedding; keys held in secret manager; 90-day Tier-1 rotation |
| OAG Secondary Inference Endpoint (failover) | Failover generation and embeddings | Prompts, redacted chunk text | Cloud-hosted | Same redaction pipeline; circuit breakers |
| OAG Payment Processor | Payment capture and GST invoicing | Order and payment references only; card/UPI data stays on the processor's hosted checkout — OAG never receives raw PAN | IN | HMAC webhook verification; PCI DSS is the processor's responsibility |
| OAG Edge Rate Limiting | Edge rate limiting and IP-ban state | IP address (transient, 1-hour TTL) | Global edge | No personal data persisted |
| OAG Error Telemetry | Error tracking | Stack traces and request context with personal data scrubbed | US | Credentials held in secret manager |
OAG notifies customers of any new sub-processor at least 14 days in advance via the Trust page and/or email, giving the customer an opportunity to object.
4. Security measures
- AES-256-GCM field-level encryption for sensitive fields at rest.
redactSensitiveData()is applied after document extraction and before chunking/embedding.- Workspace-scoped access: every private read filters on the authenticated
workspaceId. - Human-in-the-loop approval for any write operation against a customer ERP system.
- Pre-commit secret scanning, pinned dependencies, and non-root containers.
5. Customer instructions
The customer instructs OAG to process Customer Data solely to provide the OAG AI Consultant (diagnostics, retrieval, document generation, and approved execution) as described in this DPA and the product documentation.
6. Data subject rights and breach notification
- OAG assists with GDPR / DPDP / CCPA requests through account and workspace deletion flows.
- Breach notification is made without undue delay, and within 72 hours where feasible.
7. Retention and deletion
| Data | Retention |
|---|---|
| Audit logs | 7 years |
| Knowledge documents and execution logs | Until workspace deletion or customer request |
| Contact and lead records | Until deletion request |
8. Model training
Customer code, schemas, query output, and documents are never used to train models. The platform runs on a Pure BYOK model: the customer supplies their own model provider key and pays that provider directly.
9. Contact
Security and DPA inquiries: security@oracleappsguide.com or via /support.
For a countersigned DPA, contact Enterprise Sales via /design-partner-program.
Related: SLA, Compliance register.