Data processing agreement (DPA)
Custodos processes your workspace's content on behalf of your organisation. The basis for this is the data processing agreement under Art. 28(3) GDPR and Art. 9 of the Swiss Federal Act on Data Protection (revFADP). This page shows how it comes into force and what it covers.
Last checked on 28 September 2026
On this page
How the DPA comes into force
The DPA is part of the terms of service. Anyone who creates a workspace confirms, before Create workspace, the box I accept the terms of service including the data processing agreement and have read the privacy policy. The DPA then applies to all content Custodos processes for your workspace. No separate signature is needed.
If you need a signed copy for your records, you can request one countersigned by Custodos from the support address named in the DPA or through the contact page. The signature lines for both parties are at the end of the document.
What the DPA covers
| Topic | Content |
|---|---|
| Subject and duration | provision of the platform; the DPA runs as long as the main contract |
| Data subjects and data | account data of the users and the content entered, meaning prompts, files and replies. Depending on use, these can contain every category of personal data. |
| Instructions | The workspace configuration counts as a documented instruction: processing region, allowed models, protection of personal data, retention and web search. |
| Sub-processors | Annex 3 lists them. Some are only used if you switch on the related option. Custodos gives notice of planned changes in advance; you can object on important data protection grounds. |
| Assistance | with requests from data subjects and with the obligations under Art. 32 to 36 GDPR, including notification of personal data breaches without undue delay |
| End of contract | deletion or return of the data, by data export on request. Usage and billing data are kept for ten years under the Swiss bookkeeping obligation. |
| Evidence | self-assessment and documentation of the measures; further audits where there is good reason and with advance notice |
| Technical and organisational measures | described in Annex 2 |
Where to find the DPA
The DPA is a page in the Custodos app. When you create a workspace, it is linked from the confirmation box. In the navigation of the legal pages it sits next to the legal notice, privacy policy and terms of service. The current version is dated September 2026.
The page is made for printing: the navigation is hidden when you print it. The privacy policy for this website is under Privacy.
Settings that touch the DPA
Which sub-processors work for your workspace partly depends on your settings. The Global region admits models that process outside the EU and Switzerland, see Processing region. Web search sends search queries to a European search index; admins can switch it off.
The activity log records every change to these settings with the person and the time. This shows which configuration applied when.
What the DPA does not replace
The DPA governs processing on your behalf. Whether using Custodos is permissible in your specific case is for you to assess. Professionals bound by secrecy are also subject to their country's professional secrecy rules, such as section 203 of the German Criminal Code, section 121 of the Austrian Criminal Code or Art. 321 of the Swiss Criminal Code. The DPA and the settings in Custodos provide technical and contractual groundwork for that, not a legal assessment.
Read next
Still have a question? Write to us.