⚠ Version bêta — non validée par un conseil juridique

Ce document est publié sans revue préalable par un avocat ou un DPO externe. Il décrit la situation réelle du traitement de vos données aussi précisément que possible et sera mis à jour dès qu'une revue juridique aura été réalisée. Aucune clause ne doit être présentée comme définitivement opposable sans cette revue.

Dernière mise à jour : 2026-08-16 · Contact : direction@helix-core.io

Data Processing Agreement (DPA)

Helix-Core SAS · GDPR Art. 28 · v1.0 · 2026-05-08

1. Parties

This Data Processing Agreement ("DPA") is entered into between :

Controller : the Customer (your Fortune 500 organization)
Processor : Helix-Core SAS (the "Service Provider")

2. Subject matter and duration

Helix-Core processes Customer's data solely to provide AaaS (Agents-as-a-Service) cascade functionality. Duration : term of the Service Agreement.

3. Categories of data subjects

Customer's employees with platform access
Customer's leads and prospects (B2B contact data)

4. Categories of personal data

Identification : email, name, company
Behavioral : platform usage, agent activations, cascade interactions
Financial (if connected) : Stripe metrics aggregated (no card data)

5. Sub-processors

Helix-Core uses the following sub-processors :

Les garanties contractuelles (clauses contractuelles types / Data Privacy Framework) avec chacun de ces sous-traitants sont en cours de confirmation. Nous préférons vous l'indiquer plutôt que d'affirmer une conformité que nous n'avons pas vérifiée pour chacun.

Vercel Inc. (USA) — hosting + edge functions — SCC
Supabase Inc. (USA, EU regions) — PostgreSQL + Storage — SCC
Sentry, Inc. (USA) — error monitoring — SCC
Stripe Inc. (USA) — payment processing — SCC + PCI-DSS Level 1 certified
Resend (USA) — transactional email — SCC

Sub-processor certifications beyond the contractual SCC (including Data Privacy Framework participation) are verified individually against each provider's own published documentation and the official DPF list. This page states only what those documents state.

6. Technical and organizational measures (Art. 32)

Encryption at rest (AES-256) + in transit (TLS 1.3)
Row-Level Security (RLS) Postgres policies on all client_* tables
Multi-Factor Authentication for admin endpoints
Audit logging via unified_audit_log + Sentry
Doctrine F7 invariants enforced (8 invariants runtime BD)
Backups daily 3am UTC + disaster recovery monthly test

7. Data subject rights

Helix-Core supports Customer in fulfilling :

Right to access (Art. 15) — endpoint /api/v1/account/export
Right to rectification (Art. 16) — admin dashboard
Right to erasure (Art. 17) — by written request to direction@helix-core.io, fulfilled manually within a 30-day SLA (no self-service deletion endpoint)
Right to portability (Art. 20) — JSON+CSV export within 72h SLA

8. Breach notification (Art. 33-34)

Helix-Core notifies Customer of any personal data breach within 72 hours via email + audit_log entry severity=critical.

9. International transfers

For data residing in non-EU regions, Helix-Core relies on EU Standard Contractual Clauses (SCC) 2021/914. Where a given sub-processor additionally participates in the EU-U.S. Data Privacy Framework, that participation supplements — and does not replace — the contractual clauses, and is verified against that provider's own documentation.

10. Audits

Customer may audit Helix-Core compliance once per year (or upon material breach) with 30 days notice.

Signature

Pour signature électronique : legal@helix-core.io
Helix-Core retournera la version signée sous 5 jours ouvrés.

Helix-Core SAS · 2026-05-08 · DPA v1.0 · GDPR Art. 28 compliant