Data Processing Addendum (DPA)

Last Updated: February 5, 2026

This DPA has two parts:

  1. The Key Terms outlined below
  2. The Common Paper DPA Standard Terms Version 1.0 posted at commonpaper.com/standards/data-processing-agreement/1.0 ("DPA Standard Terms"), which is incorporated by reference

If there is any inconsistency between the Key Terms and the DPA Standard Terms, the Key Terms will control. Capitalized and highlighted terms have the meanings given here. If omitted, the default meaning will be "none" or "not applicable," and the correlating clause, sentence, or section will not apply to this Agreement.

Agreement Information

Agreement Reference

Reference to sales contract will be set when sending agreement

Provider Security Contact

parth@hud.ai

Security Policy

trust.hud.ai

Security Certifications

  • SOC 2 Type I Certified — Company has completed a SOC 2 Type I examination, demonstrating the design effectiveness of its security controls.
  • SOC 2 Type II In Progress — Company is currently in the audit observation period for SOC 2 Type II certification.

Approved Subprocessors

NameCountryProcessing Task
Amazon Web Services, Inc. (AWS)United StatesCloud infrastructure, hosting, compute, and storage
Supabase, Inc.United StatesManaged database, authentication, and storage services
Google LLC (Google Workspace)United StatesBusiness productivity tools (email, documents, calendar)
Google LLC (Google Cloud Platform)United StatesCloud infrastructure services
GitHub, Inc.United StatesCode hosting and CI/CD pipeline security
OpenAI, L.L.C.United StatesAI/ML model inference and evaluation services
Anthropic, PBCUnited StatesAI/ML model inference and evaluation services
Railway Corp.United StatesApplication hosting and runtime services
Vercel Inc.United StatesWeb and application hosting
Functional Software, Inc. (dba Sentry)United StatesError monitoring, logging, and observability

Annex I(A): List of Parties

Data Exporter

  • Name: the Customer signing this DPA
  • Activities relevant to transfer: See Annex 1(B)
  • Role: Controller

Data Importer

  • Name: Human Union Data, Inc.
  • Address: 2261 Market Street STE 86509, San Francisco, California 94114, USA
  • Activities relevant to transfer: See Annex 1(B)
  • Role: Processor

Annex I(B): Description of Transfer and Processing Activities

Service

HUD provides an AI agent evaluation platform that enables customers to test, analyze, and improve their AI agents through comprehensive evaluation metrics and insights.

Processing Activities

  • Receiving Data: Collection, access, retrieval, recording, and entry
  • Holding Data: Storage, organization, and structuring
  • Using Data: Analysis, consultation, testing, automated decision-making
  • Updating Data: Corrections, adaptation, alignment, and combination
  • Protecting Data: Restricting, encrypting, and security testing
  • Sharing Data: Disclosure, dissemination, or granting access
  • Returning Data: Delivery back to the data exporter or subject
  • Erasing Data: Destruction and deletion

Duration of Processing

Provider will process Customer Personal Data as long as required to:

  • Perform processing activities as instructed
  • Comply with Applicable Data Protection Laws

Categories of Data and Subjects

Categories of Data SubjectsCategories of Personal Data
Customer's end users or customersContact information such as email, phone number, or address
Customer's employeesUser activity and analysis such as device information or IP address

Special Category Data: No special category data (as defined in GDPR Article 9) will be processed.

Frequency of Transfer: Continuous

Service Provider Relationship

Under the California Consumer Privacy Act (CCPA), HUD is a service provider receiving Personal Data from the Customer solely to provide the agreed-upon Service. HUD:

  • Will not sell or share any Customer-provided Personal Data
  • Will not retain, use, or disclose Customer-provided Personal Data except as required to deliver the Service or comply with Applicable Data Protection Laws
  • Certifies understanding and compliance with CCPA restrictions
  • Will notify Customer promptly if it can no longer meet its obligations under CCPA

Contact Information

Human Union Data, Inc.
Attn: Data Protection Officer
2261 Market Street STE 86509
San Francisco, CA 94114

privacy@hud.ai
(785) 383-1887

Data Processing Agreement (Version 1.0). Free to use under CC BY 4.0.