Data Processing Agreement
How we process personal data in your workspace on your behalf.
Last updated 13 October 2026
Parties and roles
The customer is the controller of personal data in its workspace; Brainkin Sdn Bhd is its processor. This agreement forms part of the Terms of Service and applies for as long as we process that data.
Subject matter and details
Purpose: providing the Vantiqo service. Data subjects: the customer's users and people whose data appears in the customer's estate (for example in logs or resource tags). Categories: identification and contact data, sign-in and audit records, and whatever personal data the customer's estate contains in the information Vantiqo reads. Duration: the term of the service plus the deletion periods below.
Instructions
We process customer personal data only on the customer's documented instructions — using the service as configured, including automatic rules, is such an instruction — unless the law requires otherwise, in which case we tell the customer first unless the law forbids it.
Confidentiality and staff
Everyone who processes the data is bound by confidentiality. Our staff and the customer's partner (if any) access a workspace only through time-limited support access that the customer can see and end, recorded in the workspace's audit log.
Security measures
Separate database and encryption key per workspace; secrets encrypted with keys protected by AWS KMS; TLS everywhere; two-factor sign-in and passkeys; IP allowlists; rate limiting and lockouts; least-privilege access to customer cloud accounts within a permissions boundary that forbids reading data contents; approval workflows for changes; audit logging; nightly encrypted backups with restore tests; patching and monitoring of our infrastructure; a public status page.
Sub-processors
The customer authorises the sub-processors listed on the Sub-processors page. We impose data protection terms on them no less protective than these, give 30 days' notice of new sub-processors to workspace administrators, and the customer may object and terminate if we can't accommodate the objection.
Data location and transfers
Workspace data is kept in the workspace's data region. Transfers to sub-processors outside it rely on appropriate safeguards (such as standard contractual clauses).
Assistance and breaches
We help the customer answer data-subject requests and carry out impact assessments and consultations. We notify the customer without undue delay — target within 48 hours — after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations.
Return and deletion
At the end of the service the customer can export its data for 30 days; we then delete the workspace and destroy its encryption key, and backups expire within about 35 days.
Audits
We make available the information needed to demonstrate compliance (including our security documentation and the SOC 2 / ISO 27001 evidence reports the service produces) and allow reasonable audits, once a year, with 30 days' notice, at the customer's cost.
Vantiqo and Vantiqo AI are provided by Brainkin Sdn Bhd (Registration No. 202601041233 (1703328-D)).