Data Handling Agreement

Effective Date: August 9, 2026

1. Parties and Incorporation

This Data Handling Agreement ("DHA" or "Agreement") is entered into between Eira OS ("Eira OS," "we," "us," "our") and the entity engaging Eira OS for commercial services ("Member," "you," "your"). This Agreement is incorporated by reference into and forms part of the Eira OS Terms of Service. In the event of a conflict between this Agreement and the Terms of Service, the Terms of Service control. This Agreement applies to Memberships only. Consumer products, when available, are governed by separate terms.

2. Definitions

• "Member Data" means any data, information, materials, or content provided by the Member to Eira OS for the purpose of performing Services during an Membership, including but not limited to: configuration files, policy documents, network architecture diagrams, system logs, user directories, compliance documentation, and any data derived from or generated by analysis of such materials.
• "Derived Data" means any output, analysis, finding, or content produced by Eira OS through processing Member Data, including AI-generated analysis, expert findings, Deliverables, and discovery knowledge bases.
• "Processing" means any operation performed on Member Data, including collection, analysis, transformation, storage, retrieval, display, transmission, or destruction.
• "Personal Data" means any information relating to an identified or identifiable natural person, to the extent such information is included in Member Data.
• "Membership" has the meaning defined in the Terms of Service.

3. Data We Collect

Eira OS collects and processes only the Member Data necessary to perform the Services defined in the applicable Membership. This may include:

• Infrastructure Data: System configurations, service configurations, network architecture, user directories, access control lists, device inventories;
• Compliance Data: Existing policies, procedures, control documentation, audit reports, risk assessments, remediation records;
• Operational Data: System logs, performance metrics, network traffic summaries, error logs;
• Identity Data: User account names, role assignments, group memberships (as needed for access control analysis).

Eira OS does not collect more data than is necessary for the Membership. If the Member provides data that Eira OS does not need, Eira OS will flag it and exclude it from processing. The Member is responsible for ensuring all Member Data provided to Eira OS is properly authorized for sharing under applicable law and any obligations to third parties.

4. How Data Is Processed

Member Data is processed for the sole purpose of performing the Services defined in the Membership. Processing activities include:

1. Analysis: AI-assisted and expert analysis of Member Data to produce findings, gap analyses, and recommendations;
2. Cross-Referencing: Mapping Member Data against compliance frameworks, security standards, and best practices;
3. Knowledge Base Compilation: Organizing Member Data and findings into structured knowledge bases in requested formats;
4. Deliverable Production: Generating reports, roadmaps, policies, and other Deliverables for the Member.

Member Data is not processed for any purpose other than performing the Services. Eira OS does not use Member Data for marketing, product development, model training, service improvement, or any purpose unrelated to the Membership. See Section 7 for the prohibition on model training.

5. Where Data Is Processed

• Processing Location: Eira OS's on-premise infrastructure, physically located in the United States;
• No Third-Party Cloud: Member Data is not transmitted to, stored on, or processed by any third-party cloud service (AWS, Azure, GCP, or others) unless explicitly agreed in writing in the Membership;
• No Offshore Processing: Member Data is not transmitted to, stored on, or processed by any system located outside the United States;
• Transfer Restrictions: Member Data is not transferred to any third party without the Member's written consent, except as required by law;
• Network Isolation: The infrastructure processing Member Data is network-isolated. Outbound connections are restricted to Eira OS-authorized endpoints only. No inbound remote connections are accepted.

6. Security Measures

Eira OS implements and maintains reasonable and appropriate technical, physical, and organizational security measures to protect Member Data. These measures include:

Technical Security

• Encryption at Rest: Member Data stored on Eira OS infrastructure is encrypted using LUKS2 with AES-256 or equivalent;
• Encryption in Transit: All data transmissions to and from Eira OS infrastructure use TLS 1.3 or equivalent. No unencrypted transmission of Member Data is permitted;
• Access Controls: Access to Member Data is restricted to a single authorized Eira OS operator. No shared accounts. No generic credentials. All access is logged;
• Authentication: Multi-factor authentication is required for all access to infrastructure hosting Member Data;
• Network Security: Infrastructure hosting Member Data is protected by firewall rules restricting inbound connections. No inbound remote connections are accepted. All management access is through encrypted, authenticated channels;
• Key Management: Encryption keys are managed on Eira OS-controlled infrastructure. No master keys, no backdoors, no key escrow with third parties. Keys are rotated periodically;
• Operating System Hardening: Infrastructure hosting Member Data runs hardened Linux with current security patches, minimal attack surface, and disabled unnecessary services.

Physical Security

• Physical Access Control: Physical access to infrastructure hosting Member Data is restricted and logged. Only authorized Eira OS personnel have physical access;
• Location: Infrastructure is located in a controlled-access facility within the United States.

Organizational Security

• Personnel: Only authorized Eira OS personnel with a need to know may access Member Data. All personnel are bound by confidentiality obligations;
• Training: Eira OS personnel are trained on data handling, security practices, and this Agreement;
• Incident Response: Eira OS maintains an incident response plan for suspected or actual data security incidents.

7. No Model Training

Specifically:

• Member Data is not used as training data for any AI model;
• Member Data is not used to fine-tune or adapt existing AI models;
• Member Data is not used to evaluate, test, or benchmark AI model performance;
• Member Data is not used to develop or improve Eira OS's commercial products or services;
• Derived Data (findings, analyses, knowledge bases) is not used for model training, fine-tuning, or service improvement;
• No AI model used in the processing of Member Data retains, memorizes, or can reproduce Member Data after the Membership concludes.

8. No Sub-Processors

Eira OS does not use sub-processors for Member Data processing. All processing is performed by Eira OS personnel on Eira OS-controlled infrastructure. No third party processes, accesses, or stores Member Data.

If Eira OS ever needs to engage a sub-processor for a specific Membership, Eira OS will:

1. Notify the Member in writing before engaging the sub-processor;
2. Obtain the Member's written consent;
3. Ensure the sub-processor is bound by data protection obligations no less protective than this Agreement;
4. Remain fully liable for the sub-processor's handling of Member Data.

Until and unless such written notice and consent occurs, no sub-processor processes any Member Data. The current list of sub-processors is: none.

9. Data Retention and Purge

Member Data is retained only for the duration necessary to perform the Services in the Membership. After the Membership concludes:

1. Default Timeline: All Member Data and Derived Data is purged no later than thirty (30) days after termination or completion of the Membership, unless a different timeline is specified in the Membership;
2. Purge Method: Data is securely deleted using cryptographic erasure or multi-pass overwrite in accordance with NIST SP 800-88 guidelines. Simple file deletion is not sufficient;
3. Verification: Upon request, Eira OS will provide written confirmation that Member Data has been purged;
4. Legal Hold: If Eira OS is legally required to retain Member Data beyond the purge timeline (e.g., litigation hold, regulatory requirement), Eira OS will notify the Member and retain only the data required for the minimum period necessary;
5. No Backup Retention: Eira OS does not maintain backup copies of Member Data beyond the purge timeline. Backups, if any exist during the Membership, are purged on the same schedule as primary data.

10. Data Return and Destruction

Upon termination or completion of the Membership, the Member may request return of its Member Data. Eira OS will:

1. Return all Member Data to the Member in a mutually agreed format (e.g., encrypted archive, secure transfer);
2. Provide Deliverables and Derived Data as specified in the Membership;
3. Purge all Member Data, Derived Data, and any copies from Eira OS infrastructure within thirty (30) days of the return or termination date;
4. Provide written certification of destruction upon request;
5. Not retain any copy of Member Data except as required by law and with notice to the Member.

The Member is responsible for maintaining its own backups of Member Data. Eira OS is not responsible for data loss after the purge timeline has elapsed.

11. Breach Notification

In the event of a suspected or confirmed data security incident involving Member Data, Eira OS will:

1. Notify the Member: Within seventy-two (72) hours of confirming that a security breach has occurred that is reasonably likely to have compromised Member Data. Notification will be made by phone and confirmed in writing;
2. Provide Details: To the extent known at the time of notification, Eira OS will provide: the nature of the breach, the categories of Member Data affected, the likely consequences, and the measures taken or proposed to address the breach;
3. Investigate: Eira OS will conduct a prompt investigation to determine the scope and impact of the breach;
4. Remediate: Eira OS will take reasonable steps to contain the breach, secure affected systems, and prevent recurrence;
5. Document: Eira OS will maintain a record of the breach, the investigation, and the remediation measures;
6. Cooperate: Eira OS will cooperate with the Member and any regulatory authorities as required by law.

Eira OS is not required to notify the Member of a breach that does not involve Member Data or that has no reasonable likelihood of affecting Member Data.

12. Data Subject Rights

If Member Data contains Personal Data, the Member is responsible for handling data subject requests. Eira OS will assist the Member in fulfilling data subject requests where feasible, including:

• Access: Providing the Member with a copy of the Personal Data processed during the Membership;
• Correction: Correcting inaccurate Personal Data at the Member's request during the Membership;
• Deletion: Purging Personal Data per the retention timeline in Section 9;
• Restriction: Restricting processing of specific Personal Data at the Member's request, where feasible;
• Portability: Returning Personal Data to the Member in a structured, commonly used format.

Eira OS does not interact directly with the Member's data subjects. The Member remains the data controller and is responsible for all data subject communications. Eira OS acts as a data processor on behalf of the Member.

13. Cross-Border Data Transfer Prohibition

• No Member Data is stored on systems located outside the United States;
• No Member Data is processed by systems located outside the United States;
• No personnel located outside the United States have access to Member Data;
• No remote access to Member Data is granted from outside the United States;
• No third party outside the United States is engaged to process, store, or transmit Member Data.

This provision does not apply to data that has been anonymized or de-identified such that it can no longer be associated with the Member or any individual, and that is used solely for aggregate, non-identifiable statistical purposes. However, Eira OS does not currently engage in such anonymization during or after Memberships.

14. Audit Rights

The Member may audit Eira OS's compliance with this Data Handling Agreement upon thirty (30) days written notice. Audits may include:

• Review of data handling practices and procedures;
• Review of security measures and configurations (summary level, not including credentials or keys);
• Verification of data purge completion;
• Review of incident response records;
• Verification that no sub-processors are in use.

Audits will be conducted during business hours, at the Member's expense, and will not unreasonably interfere with Eira OS operations. The Member may audit no more than once per twelve (12) month period unless a documented security incident has occurred. Audit results are confidential and subject to the confidentiality provisions of the Terms of Service.

15. Liability for Data Incidents

Eira OS's liability for any data security incident involving Member Data is governed by the limitation of liability provisions in the Terms of Service, Section 11. The Member acknowledges that:

• Eira OS is not an insurer of Member Data. The liability cap in the Terms of Service applies to data incidents;
• The Member bears responsibility for data it provides to Eira OS, including ensuring it has the right to share such data;
• Eira OS is not liable for data incidents caused by the Member's failure to maintain security on its own infrastructure;
• Eira OS is not liable for data incidents caused by the Member's MSP or third-party technology provider, including unauthorized access to Eira OS infrastructure by such parties (see Acceptable Use Policy, Section 4, MSP Restrictions);
• Eira OS is not liable for data incidents caused by events outside its reasonable control, including force majeure events as defined in the Terms of Service.

16. Changes to This Agreement

Eira OS may update this Data Handling Agreement from time to time. The effective date at the top of this page indicates when the current version was posted. Changes apply to new Memberships entered into after the effective date. Memberships already in progress are governed by the Agreement in effect at the time the Membership was initiated, unless the Membership expressly provides otherwise.

17. Execution

This Data Handling Agreement may be executed electronically or in writing. Execution may be by: (a) signing an Membership that references this Agreement, (b) written acknowledgment of this Agreement, or (c) making payment for Services, which constitutes acceptance of this Agreement as part of the Terms of Service.

Relationship to Terms of Service: This Data Handling Agreement is incorporated by reference into the Eira OS Terms of Service. In the event of a conflict between this Agreement and the Terms of Service, the Terms of Service control. This Agreement does not create any warranty or right not expressly stated in the Terms of Service or the applicable Membership.