# Data Processing Agreement — FALCON Verify Cloud Version: 2026-09-12.2 **Status.** This is the agreement a person accepts at sign-up on the hosted tiers. It is the text the platform records, by version, against the tenant it creates. A tenant that accepted an earlier version is shown this one on its Account page and an owner accepts it before learning under §3a can be turned on; the version line above changes whenever a word below does, and a tenant's record names the version it accepted. It has been drafted by the operator for review by counsel before the first paying customer. ## 1. Parties and roles **Controller:** the customer — the person or organisation that signs up and submits material for verification. **Processor:** One Intelligence LLC ("the operator"), which runs FALCON Verify Cloud at the domain the customer signed up on. ## 2. What is processed, and why The customer submits AI outputs and the evidence those outputs were written from ("material"), and the service verifies the outputs against the evidence. Processing is limited to that purpose, to the operation, metering and security of the service, and, unless the customer has turned it off under §3a, to improving the service's verification policy from learning observations. ## 3. What the operator keeps - **Not the material.** An inline verification keeps digests of the output and the evidence, the claims' verdicts, and the model tokens spent. It does not retain the output or the evidence text. - **Queued judging is the exception**, and only when the customer asks for it: the claim text and the evidence it is judged against are retained for the retention window the request names (seven days by default), then expired by the service. - **Learning observations,** while learning is on, as described in §3a. - **Account records:** the email address the identity provider vouched for, the tenant it belongs to, the plan, the allowance used, the connector credentials issued (hashed), and the audit chain of what the account did. - **Payment:** none. Cards, receipts and invoices are held by Stripe under its own terms; the operator holds Stripe's identifiers only. ## 3a. Learning observations A tenant created under this version has learning on. By accepting this agreement the customer instructs the operator to process for the purpose in §2. An owner of the tenant may turn learning off, and back on, at any time from the Account page; each change, who made it and when are recorded in the tenant's audit log. From the moment learning is off no further observation is written. A tenant that accepted an earlier version has learning off until it accepts this one. While learning is on, each claim the service judges leaves one *learning observation*: the shape of the request (how many claims, of which types, how much evidence overlapped), numeric features of the claim (its length, its match to the evidence, the figures and units it carries), the type of claim, which deterministic rule ran and what it found, the verdict and the confidence the judge gave, the tokens and cost of the call, and the versions of the policy and protocol in force. An observation never contains the output, the evidence, the claim text, or any excerpt of them, and the service tests for this on every release and on every day's records. Observations are pooled with the operator's own reference corpora and with other customers' observations to fit the service's routing and policy models. The operator does not fit a model for one customer from another customer's observations alone, and does not disclose any customer's observations to another. Observations do not leave the operator's hosting; no sub-processor in §4 receives them. Turning learning off changes nothing the customer receives: the service's models serve every tenant the same, whether or not that tenant's observations contributed to them. ## 4. Sub-processors | sub-processor | purpose | data | |---|---|---| | the model provider the deployment is configured with | claim extraction and judging | the output and the evidence, for the duration of the call | | Stripe | payment, invoicing | email, tenant id, plan, usage counts | | the identity provider chosen at sign-up (Google, Microsoft) | sign-in | the identity token | | the hosting provider of the domain | running the service | everything above, encrypted at rest | Learning observations are not shared with any sub-processor. The operator names any change to this list in the version line and gives thirty days' notice by email before it takes effect. ## 5. Security Transport is TLS only. Storage is encrypted at rest. Every request is authenticated and its authorization recorded in a hash-chained audit log the customer can export. Operator access to a tenant's records is by a time-limited, reason-required, audited break-glass grant that the tenant's own administration page lists. Backups are taken nightly, kept for thirty days, and the restore is rehearsed. ## 6. The customer's rights The customer may export every record the service holds about the tenant, learning observations included, and delete the tenant, from the Account page, at any time. Deletion produces a certificate naming what was removed, learning observations counted separately, and what was retained (content-addressed artifacts cited by other tenants' evidence, and audit entries that belong to no tenant), and a repeated export after deletion returns nothing. A model fitted while the tenant's observations were in the pool is refitted without them at the next scheduled fit, which deletion or turning learning off itself makes due, and in any case within thirty days. The operator does not claim that a fitted model can be edited claim by claim; the obligation is that no observation of a deleted tenant, or of a tenant that turned learning off, contributes to any model fitted afterwards, and the manifest of every fit names the tenants whose observations it drew on. ## 7. Breach The operator notifies the customer by email without undue delay, and in any case within seventy-two hours of becoming aware, of a breach affecting the tenant's records, naming what was affected and what was done. ## 8. Term This agreement lasts as long as the tenant exists. On deletion, §6 applies; on the operator's discontinuing the service, thirty days' notice and an export are given first. ## 9. Law Governed by the law of the operator's place of incorporation, to be named by counsel in the version that follows review. ## 10. Enterprise terms A customer on an enterprise agreement may elect, in that agreement, that its observations are never pooled: its learning is then off and cannot be turned on from the Account page; or that its models are fitted from its own observations and the operator's reference corpora only, with the operator's isolation test recorded against each fit. The enterprise agreement prevails over §3a where they differ.