Data Processing Agreement
Last updated Mon Nov 09 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
Version 2026-11. This Data Processing Agreement (DPA) is part of the Terms of Service between the customer (Controller, you) and Zahner Solutions, Dreibündenstrasse 64, 7000 Chur, Switzerland (Processor, we). It applies whenever media sent to the SFW API contains personal data. You accept it in the console; the accepted version and time are stored on your account. Signed copies are available on request from support@sfwapi.dev.
1. Subject matter, duration, nature and purpose
We process images, GIFs and videos that you send to the API in order to return nudity levels, scores, flags and policy verdicts. Processing is automated, happens in memory and lasts only for the duration of a request. The DPA lasts as long as the Terms of Service.
2. Categories of data subjects and data
Data subjects are the people shown in the media you send, typically your end users and third parties appearing in their uploads. Data categories are image and video data, which may reveal physical characteristics and, depending on content, data of a sensitive nature. You assess whether the media contains special categories of data under Article 9 GDPR and whether you have a lawful basis to send it.
3. Your instructions
Each API request is your documented instruction. We process media only to answer that request. We will not process it for our own purposes, do not use it to train models, and do not retain it. If we believe an instruction infringes data protection law we tell you without undue delay.
4. Confidentiality
The only people with access to the systems are the operator and personnel bound by written confidentiality obligations. No person reads customer media; the systems are designed so that media is never written to disk or logs.
5. Security measures (Annex II)
- Transport encryption (TLS 1.2 or higher) for every connection, including internal traffic through the Cloudflare edge.
- In-memory processing only; no media, URLs, hashes or file names are written to disk, databases or logs. Video decoding uses a private in-memory file system that is cleared after every request.
- Inference workers are isolated in a private network without inbound internet access and with outbound access restricted to downloading the media you reference.
- Hardened containers (read-only file systems, dropped capabilities, resource limits), unprivileged users, automatic security updates.
- Access to servers by SSH key only, from named devices; no shared passwords.
- API keys stored as SHA-256 hashes; sessions bound to the API domain.
- Encrypted off-site backups of the non-content database; backups contain no media.
- Monitoring and alerting for availability, error rates and abuse patterns.
- Hosting in Germany at a provider contractually bound to GDPR obligations.
6. Sub-processors
You give general authorisation for the sub-processors listed at /legal/subprocessors, which states location and purpose for each. We announce additions or replacements on that page and by email at least 30 days before they take effect. You may object within that period on reasonable data protection grounds; if we cannot accommodate the objection you may terminate the Terms of Service and we refund unused paid credits pro rata. We impose data protection obligations on sub-processors that are no less protective than this DPA and remain liable for their performance.
7. Assistance
We assist you, taking into account the nature of the processing, in responding to data subject requests and in meeting your obligations under Articles 32 to 36 GDPR. Because media is never retained, access, rectification and erasure requests concerning media are answered by confirming that no data is held. We provide the information in this DPA and in the data handling documentation for your records of processing and impact assessments.
8. Personal data breach
We notify you without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting your data, with the information required by Article 33(3) GDPR as far as it is available, and we keep you updated.
9. Deletion and return
Media is deleted automatically when the response is sent. Account and usage data are deleted on account closure, except where we must keep them under tax and bookkeeping law; those records are blocked for any other use.
10. Audits
We provide the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, our security documentation and third-party reports where available. You may audit once per year, or after a breach, on 30 days' written notice, during business hours, at your own cost and without access to data of other customers. Remote audits are preferred.
11. International transfers
Media is processed in Germany and does not leave the EU or EEA. Switzerland, where we are established, holds an EU adequacy decision. Where a sub-processor processes personal data outside the EU, EEA, UK or Switzerland, the EU standard contractual clauses (Module 3, processor to processor) or the EU–US Data Privacy Framework apply, as listed on the sub-processor page.
12. UK and Switzerland
For personal data subject to the UK GDPR, the UK Addendum to the EU standard contractual clauses applies to international transfers and references to the GDPR include the UK GDPR. For personal data subject to the Swiss FADP, references to the GDPR include the FADP, the Federal Data Protection and Information Commissioner is the competent authority, and the standard contractual clauses are read with the Swiss amendments.
13. Liability and precedence
Liability is governed by the Terms of Service. This DPA prevails over the Terms of Service in matters of personal data processing.