Legal
Data processing agreement
Effective 1 January 2026 · Prismma, Frankfurt · Art. 28 GDPR
Scope
This Data Processing Agreement (DPA) governs the processing of personal data by Prismma ('Processor') on behalf of the customer ('Controller') in connection with the Prismma API gateway service.
Processing details
Subject matter: API request routing. Duration: term of service agreement. Nature: transit and logging of usage metadata. Purpose: service delivery and billing. Data categories: API usage logs (model id, token count, timestamp, API key identifier). Data subjects: end users of the customer's application.
Sub-processors
Prismma engages the following sub-processors: Hetzner Online GmbH (Frankfurt, DE) for compute; Stripe Inc. (DE entity) for payment processing. We maintain an up-to-date sub-processor list at prismma.ai/sub-processors.
Security measures
Prismma implements technical and organisational measures including TLS 1.3 in transit, AES-256 at rest, access logging, and annual penetration tests. A full description of TOMs is available on request.