Hessian

Data Processing Addendum

Last updated: 25th May, 2026

Plain-English summary. This summary is for convenience only — the binding terms are below.

  • This DPA covers how we handle personal data on your behalf when you use the Hessian Service. It supplements our Terms of Service.
  • Roles: you're the controller, we're the processor.
  • Security: encryption in transit and at rest, access controls, tenant isolation, monitoring, confidentiality with personnel. See Annex 2.
  • Sub-processors: current list at /legal/subprocessors; subscribe there for updates.
  • Breach notification: without undue delay.
  • EU/UK/Swiss transfers: we rely on the EU Standard Contractual Clauses and the UK Addendum.
  • Deletion: after termination you have 90 days to export, then we delete or anonymize.

1. Scope and definitions

This Data Processing Addendum ("DPA") forms part of the Agreement between Hessian Inc. ("Hessian", "we", "us") and the Customer governing use of the Hessian Service, and sets out the terms on which Hessian processes Customer Personal Data on the Customer's behalf. By using the Hessian Service, the Customer instructs Hessian to process Customer Personal Data in accordance with this DPA. No signature is required. If this DPA conflicts with the rest of the Agreement, this DPA prevails on matters relating to the processing of Customer Personal Data. Capitalized terms not defined here have the meanings given in the Terms of Service.

  • "CCPA" means the California Consumer Privacy Act of 2018, as amended.
  • "Customer Personal Data" means Personal Data within Customer Data that Hessian processes on the Customer's behalf.
  • "Data Protection Laws" means laws applicable to the processing of Personal Data under the Agreement, including (as applicable) the EU GDPR, UK GDPR, Swiss FADP, and CCPA.
  • "Data Subject Request" means a request from a Data Subject to exercise rights under Data Protection Laws.
  • "EU SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
  • "Personal Data", "Data Subject", "controller", "processor", "processing", and "supervisory authority" have the meanings given in the GDPR (and equivalent terms under other applicable Data Protection Laws, including "business", "service provider", and "consumer" under the CCPA).
  • "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • "Restricted Transfer" means a transfer of Customer Personal Data from a jurisdiction that restricts cross-border transfers (including the EEA, UK, and Switzerland) to a jurisdiction not recognized as providing adequate protection.
  • "Sub-processor" means any third party engaged by Hessian to process Customer Personal Data.
  • "UK Addendum" means the UK ICO's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses.

2. Roles and scope

The Customer is the controller (or, where the Customer acts on behalf of a third party, the processor on instructions from a third-party controller). Hessian is the processor (or, where applicable, sub-processor). Each party shall comply with its respective obligations under Data Protection Laws.

Hessian shall process Customer Personal Data only (a) on the Customer's documented instructions, which include the Agreement, Hessian's documentation, and any further reasonable written instructions; (b) as needed to provide, support, secure, monitor, and improve the Hessian Service; or (c) as required by law, in which case Hessian shall, to the extent legally permitted, notify the Customer before processing.

The subject matter, nature, purpose, duration, categories of Data Subjects, and types of Personal Data are set out in Annex 1.

3. Customer obligations

The Customer represents and warrants that it has provided all required notices to, and obtained all required consents from, Data Subjects; that its instructions and use of the Hessian Service comply with Data Protection Laws; and that it has the right to disclose Customer Personal Data to Hessian and to authorize Hessian to process it as contemplated by the Agreement.

The Customer shall not transmit special categories of Personal Data (Article 9 GDPR), data relating to criminal convictions, or Personal Data of children under 18 through the Hessian Service without first notifying Hessian and obtaining Hessian's agreement.

4. Security and confidentiality

Hessian shall maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex 2. Hessian may update those measures from time to time provided that any update does not materially degrade the overall security of the Hessian Service. The Customer is responsible for evaluating whether the measures are sufficient for its intended use.

Hessian shall ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations, are granted access only as necessary, and receive appropriate data protection training.

5. Sub-processors

The Customer gives Hessian a general authorization to engage Sub-processors. The current list is published at https://hessian.sh/legal/subprocessors. Publication of the updated list constitutes specific written notice of changes for the purposes of the EU SCCs and equivalent transfer mechanisms.

If the Customer objects on reasonable data protection grounds to a new Sub-processor within 30 days of its addition to the list, the Customer's sole and exclusive remedy is to terminate the Agreement on written notice. Hessian shall bind each Sub-processor to data protection obligations no less protective than this DPA and remains liable for its Sub-processors' acts and omissions in respect of Customer Personal Data.

6. Assistance

The Hessian Service provides functionality to access, correct, export, and delete Customer Personal Data, which is generally sufficient for the Customer to respond to Data Subject Requests without further assistance from Hessian. Where it is not, Hessian shall provide reasonable assistance, taking into account the nature of the processing.

If Hessian receives a Data Subject Request directly relating to Customer Personal Data, Hessian shall promptly notify the Customer and shall not respond except to confirm receipt and direct the Data Subject to the Customer.

Taking into account the nature of the processing and the information available to Hessian, Hessian shall provide reasonable assistance to the Customer with any data protection impact assessment or prior consultation with a supervisory authority that the Customer is required to carry out.

7. Breach notification

Hessian shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and shall share information reasonably available at the time. Hessian shall provide further information as it becomes available and shall reasonably cooperate with the Customer in investigating, mitigating, and remediating the breach. Hessian's notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

8. Audit

On reasonable written request and subject to the Customer's acceptance of reasonable confidentiality terms, Hessian shall share information necessary to demonstrate compliance with this DPA, including any then-current independent third-party audit reports or certifications it holds. Where that is not sufficient, the Customer may, no more than once per calendar year (unless required by a supervisory authority or following a confirmed Personal Data Breach affecting the Customer), request a written response to a reasonable list of questions concerning Hessian's data protection practices. On-site audits are not permitted, except where expressly required by a supervisory authority. All audit-related activities are at the Customer's expense and shall not unreasonably interfere with Hessian's business operations.

9. Return and deletion

During the Term, the Customer may export Customer Personal Data using the Hessian Service's standard functionality. On termination or expiration, the Customer has 90 days to export. After that, and except where retention is required by law, Hessian shall delete or anonymize Customer Personal Data within a reasonable time, and shall procure the same of its Sub-processors. Backups may persist until overwritten in the ordinary course, subject to the confidentiality and security obligations of this DPA. On reasonable written request, Hessian shall confirm in writing that deletion has occurred.

10. International transfers

The Customer acknowledges that processing of Customer Personal Data will involve transfers to, and processing in, the United States and other jurisdictions in which Hessian or its Sub-processors operate.

To the extent any processing involves a Restricted Transfer:

  • EU SCCs apply for transfers from the EEA, with Module Two (controller-to-processor) or Module Three (processor-to-processor) applying as appropriate; the Clause 7 docking clause applying; Clause 9 Option 2 (general written authorization) applying with the notice mechanism in section 5 above; the Clause 11 optional redress language not applying; Clause 17 governing law being Ireland; Clause 18 jurisdiction being Ireland; and Annexes I.A, I.B, II, and III being deemed populated with the information in Annexes 1, 2, and 3 to this DPA. The competent supervisory authority is the supervisory authority of the EU Member State in which the Customer (or relevant controller) is established, or the Irish Data Protection Commission where the Customer is not established in the EEA.
  • UK Addendum applies for transfers subject to the UK GDPR. Table 1 is populated with the parties to this DPA; Table 2 with the EU SCCs as completed above; Table 3 with the appendices to the EU SCCs (corresponding to the Annexes here); and Table 4 with both parties having the right to end the UK Addendum.
  • Switzerland. The EU SCCs apply with references to the GDPR deemed to include the Swiss FADP, references to "EU Member State" not limiting Swiss Data Subjects' rights, and the competent authority being the Swiss FDPIC.

If the European Commission, UK ICO, or Swiss FDPIC adopts a new or revised transfer mechanism, the parties agree to comply with it, and this DPA is deemed updated accordingly without further action. To the extent the EU SCCs, UK Addendum, or any equivalent mechanism conflict with this DPA or the Agreement, they prevail in respect of the relevant Restricted Transfer.

11. CCPA

To the extent Hessian processes Personal Data subject to the CCPA: the Customer is a "business" and Hessian is a "service provider"; Customer Personal Data is disclosed solely for the limited and specified business purposes set out in the Agreement and Annex 1; Hessian shall not (a) "sell" or "share" Customer Personal Data; (b) retain, use, or disclose it for any purpose other than providing the Hessian Service; (c) retain, use, or disclose it outside the direct business relationship between the parties; or (d) combine it with Personal Data from other sources, except as permitted by the CCPA. Hessian shall provide the same level of privacy protection as required of a "business" under the CCPA, and shall notify the Customer if it determines it can no longer meet its obligations under the CCPA. Nothing in this DPA restricts Hessian's ability to use Customer Personal Data as permitted under the CCPA for service providers, including to detect security incidents, protect against fraudulent or illegal activity, and comply with applicable laws.

12. General

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, calculated on a combined basis under the cap in the Terms of Service. Hessian's obligations under this DPA in respect of Customer Personal Data survive termination of the Agreement for so long as Hessian processes Customer Personal Data. If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in effect. Except as expressly amended by this DPA, all other terms of the Agreement remain in full force and effect.

Annex 1: Description of Processing

Item Details
Subject matter Provision of the Hessian Service under the Agreement.
Nature and purpose Hosting, storing, transmitting, executing, monitoring, securing, and supporting Customer Workflows; providing related platform features; and providing technical support.
Duration The Term of the Agreement, plus any period required for deletion or return of Customer Personal Data under section 9.
Categories of Data Subjects Determined by the Customer. Typically: Customer personnel (Users), and end users, customers, employees, contractors, suppliers, or other individuals whose Personal Data the Customer chooses to process through the Hessian Service.
Types of Personal Data Determined by the Customer. Typically: identifiers (names, emails, user IDs, IP addresses), business contact information, content of communications and prompts, outputs of Workflows, and any other Personal Data the Customer chooses to transmit.
Special categories The Customer shall not process special categories of Personal Data (Article 9 GDPR) or criminal-conviction data on the Hessian Service without first notifying Hessian and obtaining Hessian's agreement.
Frequency Continuous, for the Term.

Annex 2: Technical and Organizational Measures

Hessian implements and maintains the following measures, reviewed and updated from time to time:

  • Infrastructure. Hosted on Amazon Web Services, which holds ISO 27001, SOC 1, SOC 2, and SOC 3 certifications. Production infrastructure is provisioned as code and deployed through reviewed changes.
  • Encryption. Customer Personal Data is encrypted in transit (TLS 1.2 or above) and at rest (AES-256 or equivalent). Keys are managed using AWS KMS or an equivalent managed key service.
  • Access control. Access to production systems and Customer Personal Data is restricted to authorized personnel on the principle of least privilege. Multi-factor authentication is required. Access is reviewed periodically and revoked promptly on role change or termination.
  • Tenant isolation. The Hessian Service logically separates Customer Data on a per-tenant basis at the application and database layers.
  • Security monitoring. The Hessian Service is monitored for security events, and Hessian maintains a documented incident response process.
  • Vulnerability management. Production dependencies are scanned for known vulnerabilities. Source code is subject to peer review and static analysis before release.
  • Resilience. Customer Data is backed up regularly and stored redundantly across availability zones.
  • Personnel. All Hessian personnel are subject to written confidentiality obligations and receive security and data protection training.
  • Sub-processor management. Hessian assesses the security and privacy practices of each Sub-processor before engaging it, and binds it to written data protection obligations no less protective than this DPA.

Annex 3: Sub-processors

The current list of Sub-processors is published at https://hessian.sh/legal/subprocessors. As of the date above, Sub-processors include:

Sub-processor Purpose Location
Amazon Web Services, Inc. Cloud infrastructure (compute, storage, networking, managed databases) for the Hessian Service. United States
Cloudflare, Inc. Edge network, DDoS protection, and TLS termination. Global edge network
GitHub, Inc. OAuth authentication for sign-in. United States
PostHog, Inc. Product analytics for our website and dashboard. United States
Apollo.io, Inc. B2B visitor identification. United States
OpenAI OpCo, LLC AI model inference used to generate AI Output as part of Customer Workflows. United States
Anthropic, PBC AI model inference used to generate AI Output as part of Customer Workflows. United States
Google LLC AI model inference (via Google Cloud / Vertex AI) used to generate AI Output as part of Customer Workflows. United States

Other third-party services that the Customer chooses to integrate directly with the Hessian Service (for example, the Customer's own SaaS tools that a Workflow calls out to) are not Sub-processors of Hessian under this DPA. The Customer is solely responsible for entering into any necessary data processing arrangements with such third parties.