Data Processing Addendum
Version 1 January 2026
This Data Processing Addendum ("DPA") forms part of the agreement between Identra ("Processor") and the customer ("Controller") and applies where Identra processes personal data on the Controller's behalf in providing the Services.
1. Roles
For end-user personal data submitted through the Services, the Controller determines the purposes and means of processing, and Identra acts as Processor (or sub-processor). Identra processes such data only on documented instructions, including those set out in this DPA and the configuration of the Services.
2. Confidentiality & security
Identra ensures personnel authorized to process personal data are bound by confidentiality and implements technical and organizational measures appropriate to the risk — including encryption of secrets at rest, tenant isolation enforced at the database layer, access controls, and audit logging.
3. Sub-processors
The Controller authorizes Identra to engage the sub-processors listed on our Subprocessors page. We impose data-protection obligations on sub-processors consistent with this DPA and remain responsible for their performance.
4. Data subject requests & assistance
Taking into account the nature of processing, Identra assists the Controller by appropriate technical and organizational measures in responding to data-subject requests and in meeting the Controller's security, breach-notification, and impact-assessment obligations.
5. Breach notification
Identra notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, and provides information reasonably available to assist the Controller's own obligations.
6. Deletion & return
On termination, and at the Controller's choice, Identra deletes or returns Customer Data, except where retention is required by law. Identra supports erasure paths built into the data model.
7. International transfers
Where processing involves cross-border transfers, the parties rely on an appropriate transfer mechanism as required by applicable law.
Need a signed DPA? Contact us through our contact form.