Version 1.0 — 9 September 2026
This Data Processing Agreement ("DPA") forms part of the Terms of service between Suraag ("the Processor") and the organisation using the platform ("the Customer" or "the Fiduciary"). It sets out how the Processor handles personal data on the Customer's behalf, in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Customer's own legal obligations.
1. Roles
- The Customer is the Data Fiduciary for the footage it uploads or streams and for every output derived from it: detections, crops, embeddings, attributes, plate reads, face vectors (where enabled), events, alerts, reports and case data ("Customer Data").
- Suraag is the Data Processor for Customer Data. Suraag processes it only on the Customer's documented instructions.
- Suraag is a Data Fiduciary in its own right only for the account data of the Customer's users, for audit records it must keep, and for its own operational logs, as described in the Privacy policy.
2. Subject matter, nature and purpose
| Subject matter | CCTV and drone footage held by the Customer, and analysis derived from it. |
|---|---|
| Nature of processing | Upload and storage; object detection, tracking and re-identification; number-plate reading; attribute estimation; optional face matching against Customer-enrolled watchlists; incident detection and alerting; enhancement and redaction; report sealing; search and question answering. |
| Purpose | The Customer's security, investigative or law-enforcement purpose as recorded by the Customer in the platform. |
| Categories of data subject | People and vehicles appearing in the Customer's footage; the Customer's users. |
| Categories of data | Images and video of persons and vehicles; positions and timestamps; appearance embeddings; number plates; face vectors and reference photographs (gated); account identifiers. |
| Duration | The term of the agreement, plus the deletion period in section 9. |
3. Processing instructions
The Customer's instructions are: these terms, the settings its administrators choose in the console (cameras, zones, armed hours, rules, retention, alert channels, gated capabilities, AI provider) and the actions its users take (uploads, searches, reviews, report seals). Suraag will:
- process Customer Data only for those instructions and never for its own purposes;
- not use Customer Data to train or fine-tune models without a separate written agreement;
- tell the Customer promptly if it believes an instruction breaches the law;
- inform the Customer if a court or authority requires disclosure of Customer Data, before disclosing where the law allows, and disclose only what is required.
4. Confidentiality and personnel
Suraag limits access to Customer Data to personnel who need it to operate or support the service, bound by confidentiality obligations. Operational access to production systems is by named SSH key and is logged. Support staff access the console only through an account the Customer can see in its user list and audit trail.
5. Security measures
Suraag maintains the technical and organisational measures described on the Security page, which at the date of this DPA include: TLS on every connection; server-enforced tenant isolation on every query; role-based access with gated capabilities; bcrypt password hashing; hashed API, device and enrolment tokens with revocation; 24-hour session tokens with instant revocation on password change or deactivation; SHA-256 hashing of every upload at intake, evidence numbers, legal hold, sealed reports with verifiable hashes; an append-only audit trail; malware scanning of uploads where the scanner sidecar is deployed; HMAC-signed expiring media links; SSRF checks and HMAC signatures on outbound webhooks; production start-up guards; and 6-hourly database backups verified by checksum.
Suraag will not reduce the overall level of protection during the term. Data at rest is not currently encrypted at the storage layer; the Customer can require an on-premises deployment where its own disk encryption applies.
6. Sub-processors
The Customer authorises the sub-processors listed in the Privacy policy, section 6, as at the date of this DPA:
| Sub-processor | Purpose | What it receives |
|---|---|---|
| Vultr (Mumbai) | Hosting of the platform and analysis data | Analysis metadata, crops, embeddings, plates, accounts, audit. Raw footage on the Customer's assigned server. |
| RunPod | GPU inference | Frames and object crops during a job, in memory. No raw video retained. |
| OpenRouter (or the Customer's own endpoint) | Question phrasing and narration | Text only: the question and structured facts. |
| Meta (WhatsApp Cloud API), MSG91 / Twilio, the Customer's SMTP provider | Alert delivery, where the Customer configures it | Alert type, camera, time, and a 48-hour link to the evidence crop. |
| GitHub (private repository) | Off-site copy of database backups | Database dumps; never footage. |
Suraag will give the Customer at least 30 days' written notice before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected part of the service without penalty. Suraag remains responsible for its sub-processors' performance. The Customer may instead require an on-premises deployment in which no sub-processor receives Customer Data.
7. Assistance to the Fiduciary
Suraag will assist the Customer, at reasonable cost where the effort is substantial, in:
- answering data-principal requests for access, correction or erasure — requests received by Suraag directly are forwarded to the Customer within 5 working days;
- meeting its security, breach-notification and impact-assessment obligations;
- producing audit-trail extracts, custody ledgers and report-verification results for a court or inquiry.
8. Personal-data breach
Suraag will notify the Customer without undue delay and in any case within 72 hours of becoming aware of a personal-data breach affecting Customer Data, with the nature of the breach, the categories and approximate volume of data and data subjects, the likely consequences, the measures taken or proposed, and a contact point. Suraag will keep the Customer informed as the investigation develops and cooperate with the Customer's own notifications.
9. Return and deletion
- During the term, the Customer's administrators may delete footage and derived data at any time, subject to evidence lock and legal hold set by the Customer's own users.
- On termination or expiry, Suraag will keep Customer Data available for export for 30 days, then delete it — footage, derived data, vectors, crops and backups as they roll over — within a further 30 days, and confirm deletion in writing on request.
- The audit trail, which contains identifiers but no imagery, is retained as Suraag's own record of processing for as long as a legal or evidential obligation may require it, and is then deleted.
- Deletion is not performed where the law, a court order or an active legal hold requires retention; Suraag will tell the Customer which data is retained and why.
10. Audit rights
- Suraag will make available the information reasonably necessary to demonstrate compliance with this DPA, including the Security page, the sub-processor list, the backup and recovery documentation, and the Customer's own audit trail (which the Customer's administrators can export at any time).
- Once in any 12-month period, or after a breach, the Customer or an independent auditor bound by confidentiality may audit Suraag's processing on 30 days' notice, during business hours, without disrupting other customers. Government customers may additionally exercise the audit rights in their contract.
11. Cross-border transfer
Analysis metadata is stored in India. GPU inference and language-model phrasing may run on sub-processors outside India as listed in section 6, limited to frames, crops and text as described. The Customer may require an in-India or on-premises configuration for these components; the Central Government's notifications under section 16 of the DPDP Act, if any, apply.
12. Liability and term
Liability under this DPA is subject to the limitations in the Terms of service. This DPA lasts as long as Suraag processes Customer Data.
13. Contact
Data-protection contact for the Processor: support@suraag.xyz, Suraag, Hyderabad, Telangana, India. The Customer's contact is the administrator e-mail on record.