Data Processing Addendum (DPA)
Last Updated: February 5, 2026
This DPA has two parts:
- The Key Terms outlined below
- The Common Paper DPA Standard Terms Version 1.0 posted at commonpaper.com/standards/data-processing-agreement/1.0 ("DPA Standard Terms"), which is incorporated by reference
If there is any inconsistency between the Key Terms and the DPA Standard Terms, the Key Terms will control. Capitalized and highlighted terms have the meanings given here. If omitted, the default meaning will be "none" or "not applicable," and the correlating clause, sentence, or section will not apply to this Agreement.
Agreement Information
Agreement Reference
Reference to sales contract will be set when sending agreement
Provider Security Contact
Security Policy
Security Certifications
- SOC 2 Type I Certified — Company has completed a SOC 2 Type I examination, demonstrating the design effectiveness of its security controls.
- SOC 2 Type II In Progress — Company is currently in the audit observation period for SOC 2 Type II certification.
Approved Subprocessors
| Name | Country | Processing Task |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | United States | Cloud infrastructure, hosting, compute, and storage |
| Supabase, Inc. | United States | Managed database, authentication, and storage services |
| Google LLC (Google Workspace) | United States | Business productivity tools (email, documents, calendar) |
| Google LLC (Google Cloud Platform) | United States | Cloud infrastructure services |
| GitHub, Inc. | United States | Code hosting and CI/CD pipeline security |
| OpenAI, L.L.C. | United States | AI/ML model inference and evaluation services |
| Anthropic, PBC | United States | AI/ML model inference and evaluation services |
| Railway Corp. | United States | Application hosting and runtime services |
| Vercel Inc. | United States | Web and application hosting |
| Functional Software, Inc. (dba Sentry) | United States | Error monitoring, logging, and observability |
Annex I(A): List of Parties
Data Exporter
- Name: the Customer signing this DPA
- Activities relevant to transfer: See Annex 1(B)
- Role: Controller
Data Importer
- Name: Human Union Data, Inc.
- Address: 2261 Market Street STE 86509, San Francisco, California 94114, USA
- Activities relevant to transfer: See Annex 1(B)
- Role: Processor
Annex I(B): Description of Transfer and Processing Activities
Service
HUD provides an AI agent evaluation platform that enables customers to test, analyze, and improve their AI agents through comprehensive evaluation metrics and insights.
Processing Activities
- Receiving Data: Collection, access, retrieval, recording, and entry
- Holding Data: Storage, organization, and structuring
- Using Data: Analysis, consultation, testing, automated decision-making
- Updating Data: Corrections, adaptation, alignment, and combination
- Protecting Data: Restricting, encrypting, and security testing
- Sharing Data: Disclosure, dissemination, or granting access
- Returning Data: Delivery back to the data exporter or subject
- Erasing Data: Destruction and deletion
Duration of Processing
Provider will process Customer Personal Data as long as required to:
- Perform processing activities as instructed
- Comply with Applicable Data Protection Laws
Categories of Data and Subjects
| Categories of Data Subjects | Categories of Personal Data |
|---|---|
| Customer's end users or customers | Contact information such as email, phone number, or address |
| Customer's employees | User activity and analysis such as device information or IP address |
Special Category Data: No special category data (as defined in GDPR Article 9) will be processed.
Frequency of Transfer: Continuous
Service Provider Relationship
Under the California Consumer Privacy Act (CCPA), HUD is a service provider receiving Personal Data from the Customer solely to provide the agreed-upon Service. HUD:
- Will not sell or share any Customer-provided Personal Data
- Will not retain, use, or disclose Customer-provided Personal Data except as required to deliver the Service or comply with Applicable Data Protection Laws
- Certifies understanding and compliance with CCPA restrictions
- Will notify Customer promptly if it can no longer meet its obligations under CCPA
Contact Information
Human Union Data, Inc.Attn: Data Protection Officer
2261 Market Street STE 86509
San Francisco, CA 94114
privacy@hud.ai
(785) 383-1887
Data Processing Agreement (Version 1.0). Free to use under CC BY 4.0.