Data Processing Addendum
Last updated Jul 15, 2026
How ELIXIR CONSUMERS processes personal data in customer content on your behalf.
Roles
The customer is the controller and ELIXIR CONSUMERS is the processor of personal data contained in customer content.
Processing instructions
ELIXIR CONSUMERS processes customer personal data only on documented instructions, which are the Terms, this DPA and the customer's use of the service.
Security measures
Encryption at rest (AES-256) and in transit (TLS 1.3), per-tenant isolation, role-based access, logging, vulnerability management and annual third-party testing, as detailed in our Security Standards.
Subprocessors
ELIXIR CONSUMERS may engage the subprocessors listed on our Subprocessors page and gives 30 days' notice of new subprocessors, during which the customer may object.
Breach notification
ELIXIR CONSUMERS notifies the customer without undue delay and within 72 hours of becoming aware of a personal data breach affecting customer data.
Return and deletion
On termination ELIXIR CONSUMERS deletes customer personal data within 30 days and certifies deletion on request.
Audits
ELIXIR CONSUMERS provides its SOC 2 Type II report annually and responds to reasonable security questionnaires.