Pilae
Talk to us

Operate

Deploy

Services

Start with one workload

Fixed-price onboarding, then a monthly plan per managed app. Your estate grows one app at a time.

09:41 discover  keycloak 26.1.4
09:41 backup    verified, ch-zh1
02:00 apply     rolling, ok
02:01 restore   drill ok, 1m02s
Talk to us

By project

By industry

By role

Private AI, on your own servers

Chat, search and drafting with open models on infrastructure you control, operated by Pilae.

See private AI

AI and LLM

Workflow and data

Collaboration and identity

Business

Engineering and security

Browse

Security and operations

Compliance and legal

Request the security pack

DPA, sub-processor list and architecture overview, sent to your security or procurement team.

Request the pack

Learn

Compare

Company

Lausanne, Switzerland

Rue de Bourg 27, 1003 Lausanne. Swiss law, Swiss data protection, engineers on the support line.

Follow on LinkedIn
  1. Home
  2. Trust
  3. Data processing agreement

Data processing agreement (DPA)

One standard agreement covers the Swiss revised FADP and the GDPR. It is signed at onboarding and lists every company that touches your service.

Talk to our teamRequest the security pack

Covers
Revised FADP (art. 9) and GDPR (art. 28)
Signed
At onboarding, before any data moves
Transfers
Standard contractual clauses where a transfer needs them
Requests
privacy@pilae.com

What the Pilae DPA sets out

A DPA should answer the questions your legal team asks before signing. Ours answers them in writing.

Subject matter and purpose

The apps we operate for you, the categories of personal data they hold, and the purposes you set.

Location of processing

Your premises or the Pilae Cloud region you choose, as named in your contract. A change needs your written agreement.

Security measures

An annex describing the technical and organisational measures, built to ISO 27001 controls.

Sub-processors

Every company that processes data for your service, what it does and where, named in your signed agreement. Changes are notified in advance.

Breach notification

We report a breach affecting your data without delay, with the facts you need for your regulator.

Return and deletion

At the end of the contract your data comes back in open formats, then we delete it from machines and backups.

One agreement for the revised FADP and the GDPR

When Pilae operates your apps, we process personal data on your behalf. Swiss law (art. 9 of the revised FADP) and European law (art. 28 of the GDPR) both require a written agreement for that. Our standard DPA covers both, so an organisation with users in Switzerland and the EU signs one document. How it fits your wider obligations is on the Swiss nLPD page.

The DPA is available on request before you sign and is signed at onboarding, before any data is migrated. Where a sub-processor sits outside Switzerland and the EU, the agreement relies on standard contractual clauses or on an adequacy decision for that country.

Where your data is processed

On your own premises, your application data stays on your servers and no hosting provider holds it. In Pilae Cloud, your data sits on dedicated machines in ISO 27001-certified datacentres in the region you chose. Pilae Cloud has 12 regions, six of them in Switzerland and the EU. Details of each region are on the regions page and the data residency page.

Every sub-processor for your service is named in your signed DPA, with what it does and where. We notify you in advance of any addition or replacement, and you can object before it takes effect.

What your contract includes

Standard DPA
Sent on request before you sign, and signed at onboarding.
Your own template
Reviewed on request for organisations that require their own DPA.
Transfer clauses
Standard contractual clauses attached where a sub-processor sits outside Switzerland and the EU.
Sub-processor changes
Notified to you in advance, with a right to object before the change takes effect.
Audit support
Answers to your security questionnaire, and access to the audit log for your auditors.

Questions

Can I read the DPA before signing the contract?

Yes. Write to privacy@pilae.com or ask your contact at Pilae, and we send the standard DPA with its sub-processor list and security annex.

Can we use our own DPA instead of yours?

Yes, on request. Public bodies and large organisations often require their own template. We review it and sign it where it matches how the service runs.

Which sub-processors see my application data?

That depends on where you deploy. On your premises, your application data stays on your servers. In Pilae Cloud, the hosting provider for your region holds it on dedicated machines. The DPA lists each sub-processor and its role for your service.

Where do I find the sub-processors for my service?

In your signed DPA, which is authoritative. We notify every customer in advance before a sub-processor is added or replaced, and you can object before the change takes effect.

Do you send my data to an external AI provider?

Only if you enable an optional AI feature that uses one. If you do not enable it, nothing is sent, and you can run AI features on a model hosted inside your own perimeter instead.

Related

Trust

Swiss nLPD

How Pilae supports your controller obligations under the revised FADP: processor agreement, records, data security and breach reporting.

Trust

Data residency

Your data stays in the country you choose, Switzerland, the EU or your premises, operated by a Swiss company under Swiss law.

Trust

Security

Private networking, hardened machines, named access, tracked advisories and a full audit log, built to ISO 27001 controls.

Trust

Backups and recovery

Daily encrypted offsite backups, retention per plan, monthly restore tests and recovery objectives written into your contract.

Get the DPA in front of your legal team.

Ask for the standard agreement, the security annex and the sub-processor list. We answer your questionnaire in the same exchange.

Talk to our teamBook a 30-minute briefing