Data Processing Agreement
Last updated 29 October 2026.
1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is between the organization that holds an Alibi account (the "Customer") and Engrow Entropy Growth Ltd, registered in Cyprus with number HE470686, whose registered office is at Methonis 1, 5th Floor, Nicosia 1070, Cyprus ("Entropy"). It forms part of the Alibi Terms of Service (the "Terms").
1.2 This DPA applies when Entropy processes personal data on the Customer's behalf in providing Alibi ("Customer Personal Data").
1.3 "GDPR" means Regulation (EU) 2016/679, and, where it applies, the UK GDPR. Terms such as "controller", "processor", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them.
2. Roles and instructions
2.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own controllers. Entropy is the Customer's processor, or its sub-processor.
2.2 Entropy processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's own settings in Alibi are those instructions. Entropy processes Customer Personal Data for another purpose only where EU or Member State law requires it, and then tells the Customer first unless that law forbids it.
2.3 Entropy tells the Customer straight away if it believes an instruction infringes data protection law.
2.4 Annex I sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.
3. The Customer's obligations
3.1 The Customer is responsible for having a lawful basis for the processing, for informing data subjects, and for having authority to connect each tool and agent it connects.
3.2 The Customer will not connect tools whose main purpose is processing special category data or data about criminal offences, unless the parties agree in writing.
3.3 The Customer decides who it invites to its account, including people from other organisations, and which workspaces each of them can see. The Customer is responsible for the Customer Personal Data it makes available to the people it invites.
4. Confidentiality
Everyone Entropy allows to process Customer Personal Data is bound by a duty of confidentiality.
5. Security
5.1 Entropy implements the technical and organizational measures in Annex II, as required by Article 32 of the GDPR.
5.2 Entropy may update those measures, but not in a way that lowers the overall level of protection.
6. Sub-processors
6.1 The Customer gives Entropy general authorization to engage sub-processors. The current list is on the sub-processors page, which forms Annex III.
6.2 Entropy notifies the Customer of any intended addition or replacement of a sub-processor at least 30 days before it takes effect, by email to the account owner and by updating the sub-processors page.
6.3 The Customer may object on reasonable data protection grounds within those 30 days. The parties will then discuss the objection in good faith. If they cannot resolve it, the Customer may end the Terms for the affected part of the Service and receive a refund of any fees it prepaid for the period after the change.
6.4 Entropy imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for each sub-processor's performance.
7. Transfers outside the EEA
7.1 Entropy stores Customer Personal Data in the European Economic Area, except copies of the emails Alibi sends, which Resend keeps for 30 days (Annex III).
7.2 Some sub-processors process Customer Personal Data in countries without an adequacy decision. For those, Entropy uses the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Three), or the EU-US Data Privacy Framework where the provider is certified.
7.3 Where the Customer is in a country without an adequacy decision, Module Four of those Standard Contractual Clauses applies to transfers from Entropy to the Customer and is incorporated by reference. For Clause 17, the law of Cyprus applies. For Clause 18, the courts of Cyprus have jurisdiction.
7.4 Where the UK GDPR applies, the UK International Data Transfer Addendum supplements those clauses.
8. Assistance
8.1 Entropy helps the Customer respond to requests from data subjects. If Entropy receives a request directly, it forwards the request to the Customer without undue delay and does not answer it unless the Customer instructs it to. Alibi lets the Customer log erasure requests in Settings, and Entropy exports the record on request.
8.2 Entropy helps the Customer meet its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to Entropy. Entropy may charge reasonable costs for assistance beyond what the Service provides.
9. Personal data breaches
9.1 Entropy notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
9.2 The notice describes, as far as Entropy then knows, the nature of the breach, the categories and approximate numbers of data subjects and records affected, the likely consequences, and the measures taken or proposed. Entropy provides further information as it becomes available and cooperates with the Customer's response.
9.3 A notice under this section is not an admission of fault or liability.
10. Return and deletion
10.1 The Customer can ask for an export of its record while its account is open, and for 30 days after the Terms end.
10.2 Entropy then deletes Customer Personal Data within a further 30 days, including from backups, and schedules the deletion of the Customer's encryption key. EU or Member State law may require Entropy to keep some data. Entropy confirms the deletion in writing on request.
11. Information and audits
11.1 Entropy makes available to the Customer the information needed to show compliance with this DPA, including written answers to reasonable security questionnaires.
11.2 If that information is not enough, or a supervisory authority requires it, the Customer may audit Entropy's compliance once a year. The Customer must give at least 30 days' written notice, audit during business hours without disrupting the Service, keep what it learns confidential, and bear its own costs.
12. Liability and precedence
12.1 Each party's liability under this DPA is subject to the limits in the Terms, except where data protection law does not allow it.
12.2 If there is a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms.
13. Duration and governing law
13.1 This DPA lasts as long as Entropy processes Customer Personal Data.
13.2 This DPA is governed by the laws of the Republic of Cyprus, and the courts of Nicosia have exclusive jurisdiction, except where the Standard Contractual Clauses provide otherwise.
Annex I: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Alibi to the Customer under the Terms |
| Duration | The term of the Terms, plus the export and deletion periods in section 10 |
| Nature and purpose | Reading tool execution logs from the Composio projects the Customer connects, with a read-only key; storing, encrypting and indexing them as a record of actions and goals; showing the record to the Customer's users; serving it to the Customer's agents over MCP; sending digests to users who ask for them; deleting data |
| Data subjects | The Customer's users; the people and agents whose actions appear in connected tools, such as staff and contractors; people whose data appears in records in those tools, such as the Customer's customers and contacts |
| Personal data | Names; work email addresses, stored as keyed references where possible; user identifiers in connected tools; names and titles of records; tool call inputs and outputs, with secrets removed and free text replaced by fingerprints, then encrypted; goals entered by agents and users, encrypted; questions saved in Ask; timestamps |
| Special category data | None intended (section 3.2) |
| Frequency | Continuous, about every 30 seconds while a connection is live |
| Retention | As section 10 sets out |
| Supervisory authority | Commissioner for Personal Data Protection, Cyprus |
Subject matter
Providing Alibi to the Customer under the Terms
Duration
The term of the Terms, plus the export and deletion periods in section 10
Nature and purpose
Reading tool execution logs from the Composio projects the Customer connects, with a read-only key; storing, encrypting and indexing them as a record of actions and goals; showing the record to the Customer's users; serving it to the Customer's agents over MCP; sending digests to users who ask for them; deleting data
Data subjects
The Customer's users; the people and agents whose actions appear in connected tools, such as staff and contractors; people whose data appears in records in those tools, such as the Customer's customers and contacts
Personal data
Names; work email addresses, stored as keyed references where possible; user identifiers in connected tools; names and titles of records; tool call inputs and outputs, with secrets removed and free text replaced by fingerprints, then encrypted; goals entered by agents and users, encrypted; questions saved in Ask; timestamps
Special category data
None intended (section 3.2)
Frequency
Continuous, about every 30 seconds while a connection is live
Retention
As section 10 sets out
Supervisory authority
Commissioner for Personal Data Protection, Cyprus
Annex II: Technical and organizational measures
- Location. Services run in Railway's EU West region (Netherlands). The database runs on Neon in AWS Frankfurt. Encryption keys are held in AWS Key Management Service in Frankfurt.
- Encryption. TLS for data in transit over the internet. Traffic between Alibi's services runs on Railway's private network, encrypted with WireGuard. Storage encrypted at rest by our providers. On top of that, envelope encryption with a separate AWS KMS key for each customer, for tool call payloads and goals. Stored Composio keys use a platform key in AWS KMS, bound to each connection. Personal values inside payloads are also sealed with a key per person, so one person's data can be erased by destroying that key.
- Tenant isolation. Row-level security on every table that holds customer data. The application's database role cannot bypass it. Automated tests check isolation across tenants before each release.
- Least privilege. Alibi asks for Composio keys limited to reading logs, and refuses keys that can list connected accounts. The database owner role is used by the migration job and, for support and recovery tasks in our runbook, by named operators.
- Authentication. Sign-in by one-time email link. Session, API and connector tokens are stored only as hashes. Sessions and connector tokens expire. Connectors use OAuth 2.1 with PKCE. Tokens can be revoked at any time.
- Abuse controls. Rate limits on every route. IP addresses are kept only as keyed hashes in Alibi's own systems.
- Logging. Service logs exclude secrets and record content, and automated tests check this.
- Integrity. The record of actions is hash-chained, so changes to it can be detected.
- Backups. Point-in-time restore for the database. Restores are rehearsed monthly.
- People. Access to production is limited to the people who need it, and all are bound by confidentiality.
- Incidents. Breach notice follows section 9.
Annex III: Sub-processors
The current list is on the sub-processors page.