Epickod, operator of EpicIMS · Version 2026-09-30

Data Processing Agreement information

EpicIMS processes customer business data as a processor. The executed customer DPA, not this summary, controls the parties, instructions, security measures, subprocessors, transfer safeguards and liability terms.

Effective date: 30 September 2026. Last reviewed: 30 September 2026.

Controller and processor roles

The customer determines the purposes and means of processing client, invoice, payment, expense, receipt and related business data. Epicod processes that data only to provide EpicIMS, follow documented customer instructions, maintain security, meet legal obligations, and establish or defend claims. Epicod controls account, billing, support, security and service-operation data described in the Privacy Notice.

Required DPA terms

  • Documented instructions, data categories, data-subject categories, duration and processing purposes.
  • Confidentiality duties and access limited to personnel who need it.
  • Appropriate technical and organizational security measures, including tenant isolation, TLS, access control, logging, backups and incident response.
  • Assistance with data-subject requests, security incidents, DPIAs, consultations and deletion/export.
  • Subprocessor authorization, advance notice, objection handling and equivalent obligations downstream.
  • Return or deletion at the end of service, subject to legal retention and legal holds.
  • Audit and evidence rights proportionate to the processing risk.

AI-specific terms

Penny is optional. When enabled, the customer instructs EpicIMS to send the prompt and the minimum retrieved context needed for the requested answer to the configured AI provider. Penny is not used to train a model by Epicod. The customer must confirm the provider's retention and no-training terms, transfer mechanism, DPIA/LIA outcome and whether client data may be sent before enabling the feature.

International transfers

The DPA must attach the applicable EU SCCs or other lawful transfer instrument and complete the transfer annexes. The public subprocessor register identifies the processing chain; the signed DPA controls the actual legal commitments.

Request the DPA

Customers may request the current DPA and security annex at legal@epickod.org. Do not launch a regulated or international customer without an executed DPA where one is required.