API7 Cloud Data Processing Addendum
Last updated: November 9, 2026
Version 1
1. Scope and roles
This Data Processing Addendum (“DPA”) forms part of the agreement governing Customer's use of API7 Cloud (“Agreement”) with APISEVEN PTE. LTD. (“API7”). It applies where API7 processes Customer Personal Data for Customer in providing API7 Cloud, including on free and trial plans. It applies for as long as API7 holds or otherwise processes Customer Personal Data.
“Customer Personal Data” means personal data that API7 processes on Customer's behalf under the Agreement. “Applicable Data Protection Law” means the data protection laws that apply to that processing. Customer acts as controller or, where it processes personal data for another controller, as processor. API7 acts respectively as processor or subprocessor and, where the Singapore PDPA applies, as a data intermediary for processing it performs on Customer's behalf. Where Customer acts as a processor, it confirms that its instructions and appointment of API7 are authorized by the relevant controller. API7's processing for its own account administration, billing, and business relationship purposes is governed by applicable law and its privacy notice.
2. Instructions and confidentiality
API7 will process Customer Personal Data only on Customer's documented instructions, including for transfers. The Agreement, this DPA, Customer's permitted use and configuration of the service, and any other written instructions agreed by the parties constitute documented instructions. API7 may also process data as required by applicable law and will inform Customer of the legal requirement before processing unless the law prohibits notice. API7 will inform Customer promptly if it considers that an instruction infringes Applicable Data Protection Law and may suspend the affected processing while the parties address the issue.
API7 will limit access to authorized personnel who need it to carry out those instructions and are subject to confidentiality obligations. API7 will use Customer Personal Data for providing and securing the service under those instructions and will require the same purpose limitation from its subprocessors. API7 will process Customer Personal Data to create anonymized statistics for analysis or improvement only where Customer gives a documented instruction authorizing that processing.
Customer may submit sensitive data, including health data, government identification numbers, or payment card data, in hosted gateway configurations or support materials only with API7's prior written consent and subject to agreed safeguards.
3. Security and incident notification
API7 will maintain risk-appropriate technical and organizational measures for the processing described in Schedule 1, including the measures in Schedule 2. API7 may update the measures as long as the overall level of protection is maintained. Customer is responsible for appropriate security and configuration in its own environment.
API7 will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Where the Singapore PDPA requires notification on reason to believe a breach has occurred, API7 will notify Customer without undue delay on that basis. API7 will notify Customer's designated security contact, or its account contact if no security contact has been designated, and provide information as it becomes available, including the nature of the breach, likely consequences, categories and approximate numbers affected where known, mitigation, and an incident contact. API7 will take reasonable steps to contain, investigate, and mitigate the breach and assist Customer with applicable notification obligations. Customer may report Cloud security concerns to security@api7.ai.
4. Subprocessors
Customer gives general written authorization for API7 to use the subprocessors listed in Schedule 3 and any additions or replacements made under this section. API7 will email Customer at least 30 days before a new or replacement subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds within 15 days of notice. The parties will work in good faith to resolve the objection, including by considering a reasonable alternative. If they cannot resolve the objection before the change, Customer may terminate the affected part of the service before the change takes effect. The applicable Order Form and law govern the treatment of prepaid fees.
API7 will impose equivalent data protection obligations on each subprocessor for the relevant processing, including confidentiality, security, and transfer safeguards. API7 remains responsible to Customer for its subprocessors' performance of those obligations.
5. Assistance and verification
Taking account of the nature of the processing and information available to it, API7 will assist Customer with data subject requests through appropriate technical and organizational measures and will assist with security, breach assessment and notification, data protection impact assessments, and prior consultation with regulators where required. API7 will forward requests it receives directly concerning Customer Personal Data unless legally prohibited and will respond only as instructed by Customer or as required by law. Customer may contact support@api7.ai for assistance under this DPA.
API7 will make available information reasonably necessary to demonstrate compliance with the processor obligations in this DPA and Applicable Data Protection Law. API7 will allow and contribute to audits, including inspections, by Customer or its appointed auditor. API7 will make available relevant audit reports or other evidence where that information can meet the audit need. If further audit is needed, the parties will agree on reasonable scope, confidentiality, security, scheduling, and any costs in advance. These arrangements will preserve rights and obligations under applicable law and mandatory transfer clauses, including in an urgent incident or where a regulator requires access.
6. Return and deletion
At the end of the relevant services, API7 will, at Customer's choice, return or delete Customer Personal Data and delete remaining copies, except to the extent applicable law requires storage. Customer may contact API7 Support at support@api7.ai to request return or deletion, including for trial or free services. API7 will restrict access to legally retained copies and process them only as required by law. Unless Customer requests earlier deletion, the applicable Order Form specifies a different period, or applicable law requires otherwise, API7 will retain Customer's workspace and gateway configuration for 30 days after the paid service ends solely for export and then delete them from production systems. Customer can request that export through API7 Support during the applicable period. API7 will communicate the applicable arrangements for return or deletion to Customer. Where backups cannot be individually erased, API7 will protect and isolate the data until the backups expire under the applicable rotation cycle. If a backup is restored, API7 will reapply the relevant deletion instructions before returning restored data to ordinary use. These arrangements are subject to applicable law and transfer terms. API7 will confirm deletion on request, subject to those requirements and the applicable deletion schedule.
7. International transfers and priority
Each party will meet the transfer requirements applicable to its role. When a restricted transfer requires safeguards, the parties will identify and implement a valid transfer mechanism before the transfer, including for onward transfer and relevant access from another country. This may include an applicable adequacy decision or standard contractual clauses where available and appropriate. API7 will provide reasonably necessary information for transfer assessments and cooperate on required supplementary measures.
Schedule 4 describes the applicable jurisdiction-specific requirements. The parties will complete any necessary transfer instruments, annexes, tables, and assessments before the relevant restricted transfer. API7 will make information about the relevant processing and safeguards available to Customer to complete that work. For any EU SCCs, UK Addendum, or other mandatory terms that apply, those terms control in a conflict to the extent of their scope. This DPA then controls over conflicting terms of the Agreement concerning covered processing. A separately signed DPA applicable to this service governs in place of this standard DPA within its scope. General liability and dispute terms follow the Agreement to the extent consistent with Applicable Data Protection Law and the applicable mandatory transfer terms.
Schedule 1. Processing details
| Item | Description |
|---|---|
| Subject matter and purpose | Operate, secure, and support the API7 Cloud hosted control plane for API gateways and AI gateways. Manage and synchronize gateway configuration, monitor aggregate metrics, send organization invitations and alerts as instructed by Customer, and handle information Customer submits for support. When Customer uses Cloud Assistant, process questions and relevant conversation context to generate responses and provide conversation history. API7 does not use those questions to train AI models. |
| Nature and frequency | Receipt, storage, access, configuration synchronization, monitoring, email delivery, return or export as instructed, and deletion. Configuration processing can occur throughout the service term. Technical support processing is limited to materials Customer submits, such as tickets, chat messages, logs, and screenshots. Cloud Assistant processing includes storing conversation history and processing relevant inputs with AI models that API7 operates on the hosting infrastructure listed in Schedule 3 to generate responses. |
| Data subjects | Customer personnel, authorized users and invitees, and individuals whose personal data Customer includes in gateway configurations, Cloud Assistant interactions, or support materials. |
| Data categories | Organization access records and contact details used for invitations or alerts. Personal data in customer-supplied gateway configurations may include consumer identifiers, user-linked authentication information, and values entered in descriptions, labels, or plugin settings. Personal data may also be present in Cloud Assistant questions and conversation context, or in materials Customer submits for support. |
| Duration and exit | Processing for the applicable service term and thereafter as needed to complete return or deletion under Section 6 or as required by law. |
| Deployment scope | API and AI gateway runtime traffic stays in Customer's environment. For runtime monitoring, API7's hosted systems receive aggregate request counts, status code distributions, latency, and similar summary metrics. They do not receive per-request records, client IP addresses, full URLs, request IDs, API consumer identifiers, headers, request or response bodies, runtime prompts, or model outputs from that traffic. |
Schedule 2. Technical and organizational measures
API7 maintains measures appropriate to the risks presented by the processing. Those measures address the following areas for the applicable services.
| Control area | Measures |
|---|---|
| Access and isolation | Tenant separation and role-based controls for the hosted control plane. Access to Customer Personal Data is limited to authorized personnel who need it for the applicable task. |
| Encryption and secrets | Encryption in transit and at rest. Connections between customer gateways and the hosted control plane use mutual TLS. Secrets are subject to restricted access. |
| Logging and incident management | Audit logs record administrative actions. Access to logs is restricted and sensitive fields are masked as applicable. API7 maintains incident response and escalation procedures. |
| Resilience and recovery | Backups are maintained for recovery and access is restricted. Backup expiry and handling on restoration follow Section 6. |
| Development and operations | Code review, security testing, and vulnerability management for the services. API7 reviews the safeguards of its subprocessors. |
| Rights and lifecycle | Workflows to locate, return, restrict or delete data, including backups and reapplication of deletion after restore where applicable. |
Schedule 3. Subprocessors
The following providers are used to process Customer Personal Data for API7 Cloud as described in Section 4. Cloud Assistant uses AI models that API7 operates on the AWS and Microsoft Azure infrastructure listed below and does not send Customer Personal Data to a third-party model provider.
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Host the API7 Cloud production control plane, its data, and API7-operated Cloud Assistant models. |
| Microsoft Azure | Host the API7 Cloud production control plane, its data, and API7-operated Cloud Assistant models. |
| Zendesk | Process support tickets and materials Customer submits. |
| Crisp | Operate the support chat and process Customer's messages and the account identifier used to associate chat sessions with accounts. |
| Resend | Deliver organization invitations and alert emails sent on Customer's instructions. |
Schedule 4. Jurisdiction-specific terms and transfers
- EU/EEA. Where the EU SCCs under Decision (EU) 2021/914 are available and appropriate for a restricted transfer, the parties will execute the official clauses and select Module Two for controller-to-processor or Module Three for processor-to-processor, as applicable.
- United Kingdom. Where needed, the parties will execute the approved UK International Data Transfer Agreement or the UK Addendum to the appropriate EU SCCs and complete the relevant tables.
- Singapore. The parties will comply with applicable PDPA protection, retention, and data breach obligations and ensure comparable protection for transfers subject to the PDPA.