Processor: Ambulatio Consulting BV, The Netherlands | Last updated: 13 October 2026 | Version: dpa-2026-10-13 | Contact: security@limitguard.ai
When this version applies. The corrections of 13 October 2026 describe processing that already happens, so they apply from that date for everyone. The text before these corrections is the version of 7 October 2026. The changes of 4 October 2026 apply to everyone who signs up from that date. For customers who signed up before 4 October 2026, the changes take effect on 4 November 2026, 30 days after notice. Until then the previous version applies to them. For customers who signed up before 7 October 2026, the addition of Anthropic in section 6 applies 30 days after our notice email; until then the version of 4 October 2026 applies. All previous versions.
What changed on 13 October 2026
These changes correct the text so that it describes what the service already does. They add no new processing.
- Section 2 says how an IBAN is kept. A stored report keeps it masked to the country code and the last four characters, with an unkeyed SHA-256 hash. Check records keep a keyed hash. Lead lists keep only the last four characters, the country and the bank name and BIC.
- Section 4 says that per-entity reports keep the full report, including the company name and identifiers. The audit log keeps only hashed identifiers.
- Section 4 says when deleted data leaves the encrypted backups. Erasure requests go to privacy@limitguard.ai.
- Section 6 adds TypeSafe, which runs Jev, the decision service we consult in checks and in the chat, with its location, the data it receives and its transfer tool.
- Section 6 adds the encrypted database backups in Cloudflare R2 to the Cloudflare row, and lists every kind of email in the Resend row.
- Section 7 names the encryption at rest that the service uses, Fernet, and the fields it covers. Active penetration testing runs every night, not every week.
- Section 9 says that data subject requests go to privacy@limitguard.ai.
What changed on 7 October 2026
- Section 6 adds Anthropic, which writes the answers in Ask Limitguard, the AI chat assistant in the dashboard.
- Section 6 says how we pass on notices about sub-processors that our sub-processors engage, and what happens when you object to a new one.
What changed on 4 October 2026
- Scope now covers the dashboard, lead lists, the MCP server and the A2A service, and says for which data we are controller and for which processor (section 1).
- Lead list contents and report emails added to the categories of data, with the data subjects (section 2).
- Purposes: security, billing and preventing abuse are named, so the text no longer conflicts with how we run the service (section 3).
- New retention rows for lead lists and invoices (section 4).
- Sub-processor list now includes Resend, OpenSanctions, Stripe, Cloudflare Turnstile, Coinbase (x402 payments) and dilisense (adverse media screening), with a column for the transfer tool, and the locations of Resend, Supabase and OpenSanctions are stated precisely (section 6).
- Lead lists are deleted when the account closes (section 11).
- Hosting location stated as the European Union (Contabo data centre) instead of Germany (section 6).
1. Parties and scope
This Data Processing Agreement ("DPA") applies between Ambulatio Consulting BV ("Processor") and the customer ("Controller") using the Limitguard service. This DPA forms part of the service agreement, is accepted when the Controller signs up, and governs all personal data processed by the Processor on behalf of the Controller in connection with the Limitguard service: the checks, lead lists and requests that the Controller sends through the API, the MCP server, the A2A service or the dashboard.
This DPA does not cover personal data for which Ambulatio Consulting BV is itself the controller: account, billing, signup, security and abuse-prevention data. These are described in the Privacy Policy.
This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
2. Categories of data processed
| Category | Examples | Purpose |
|---|---|---|
| Entity identifiers | Business name, KVK number, CBE number, VAT number | Business registry verification |
| Business contact data | Registered address, domain name | Domain intelligence, jurisdiction assessment |
| Lead list contents | Contact names, business email addresses, company names, the last four characters of an IBAN with its country, bank name and BIC | Running the checks the Controller asked for |
| Financial identifiers | IBAN, wallet address. A stored report keeps the IBAN masked to its country code and last four characters, plus an unkeyed SHA-256 hash that links reports on the same IBAN, and the bank code, BIC and bank name. Check records keep a keyed hash of the IBAN. Lead lists keep only its last four characters, its country and the bank name and BIC | Financial trust verification, wallet address format validation |
| Report emails | The Controller's check results, sent to the Controller's own account email | Delivering the report the Controller asked for |
| Risk scores | Trust score, sanctions match status, risk level | Returned to Controller for their own use |
| API usage data | Endpoint called, timestamp, response time, IP address | Audit logging, rate limiting, abuse prevention |
Data subjects are employees and contacts of the Controller's leads and counterparties, directors and owners of companies as they appear in public registers (limited for sole traders as described in the Privacy Policy), and the Controller's own users.
The Processor does not intentionally process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). If the Controller submits such data through the API or a lead list, the Controller is responsible for ensuring an appropriate lawful basis exists.
3. Nature and purpose of processing
The Processor processes data solely to provide the Limitguard service: accepting entity data from the Controller, querying third-party verification sources, computing trust scores, and returning results. Processing is carried out on instructions from the Controller via API calls, lead lists and the dashboard.
The Processor will not process personal data for any purpose other than providing the contracted service, except for the following limited purposes that are compatible with it: security, abuse prevention and rate limiting; and billing. For the data in the Privacy Policy that the Processor handles for its own purposes, it acts as an independent controller. The Processor will not train machine learning models on Controller data, sell it to third parties, or use it for the Processor's own marketing.
4. Data retention
| Data Type | Default Retention | Configurable? |
|---|---|---|
| Entity check requests and results (check records) | 365 days | No |
| Lead lists and their per-row results | Until deleted by the Controller; otherwise removed by the daily purge 30 days after upload | Yes, the Controller can delete a list at any time |
| API usage logs | 90 days | No |
| Audit log entries and per-entity reports. Audit log entries keep hashed entity identifiers. Per-entity reports keep the full report, including the company name and identifiers | 7 years | No |
| API key metadata | Duration of account + 30 days post-deletion | No, required for security |
| Payment and invoice records (Stripe and x402) | 7 years | No, Dutch accounting law |
| Annual accounts from KVK's open data (Open Dataset Jaarrekeningen), by KVK number only. This is public data Limitguard holds for all customers, not Controller data. The 14-day registry cache applies to the paid KVK API only | Until two newer years replace it, or until an objection for the KVK number | No, it is not Controller data |
Controllers may request immediate deletion of all their data by submitting a GDPR erasure request to privacy@limitguard.ai. Deletion is processed within 30 days, except where retention is required by law (Article 17(3) GDPR). Data in encrypted database backups is removed as the backups rotate, at the latest after 12 months, and in server backups after 35 days.
5. Data hosting and location
Application data is hosted in the EU: on servers located in the European Union (EU) operated by Contabo GmbH (API and audit logs) and Hetzner Online GmbH (dashboard application and encrypted backups of the API server, kept 35 days), and in a database in Ireland (EU) operated by Supabase, Inc. (dashboard accounts, workspaces, check records and lead lists). Some sub-processors process limited data outside the European Economic Area, as the sub-processor list below shows, each with the transfer tool named there.
6. Sub-processors
| Sub-Processor | Service | Location | Data Processed | Transfer tool |
|---|---|---|---|---|
| Contabo GmbH | API hosting (VPS) | European Union (Contabo data centre) | API requests and responses, audit logs, cache | None needed (EU) |
| Hetzner Online GmbH | Dashboard hosting; encrypted backups of the API server (kept 35 days) | European Union | Dashboard requests in processing; encrypted backup archives | None needed (EU) |
| Supabase, Inc. | Database and authentication | Ireland (EU), AWS eu-west-1 | Dashboard accounts and sign-in data, workspaces, check records, lead lists | None needed for storage (EU). Supabase, Inc. is a US company: its data processing agreement (Standard Contractual Clauses) covers remote access from the US |
| Cloudflare, Inc. | CDN, WAF, DDoS protection; Turnstile on the sign-up form; encrypted database backups (Cloudflare R2) | US (EU-adequate via DPF). The backups use the location hint Western Europe. Cloudflare does not guarantee an EU location for them | Request metadata, IP addresses (not request bodies); sign-up challenge data; encrypted backup files. The backups are encrypted before upload, so Cloudflare cannot read them. One backup is made every night. The last 30 daily backups and one backup for each of the last 12 months are kept | EU-US Data Privacy Framework |
| Resend | Email delivery | EU (sending region Ireland, AWS eu-west-1); Resend, Inc. is a US company | Recipient email address and email content: sign-in and confirmation emails, waitlist confirmation, sign-in codes, workspace invitations and reminders, low-balance notices, failed plan payments (with the plan, the price and the workspace name), a VAT number that could not be confirmed, a paused automatic top-up, account deletion scheduled and done, watchlist alerts and digests (with check results), report emails (with check results), welcome and lifecycle emails, and marketing emails for those who opted in. Emails sent from mail.limitguard.ai are measured: Resend records when an email is opened and which link is clicked | Resend's data processing agreement, with Standard Contractual Clauses for access from the US |
| OpenSanctions | Sanctions matching API | Germany (EU); hosted on Google Cloud in Frankfurt, according to the provider | Name and country of the entities checked (companies, and persons screened as possible politically exposed persons), for the standard check, the deep check and sign-up screening | None needed (EU) |
| Stripe | Payments (card, Bancontact, iDEAL | Wero, SEPA Direct Debit) | EU (Stripe Payments Europe, Ltd., Ireland); US group companies | Billing contact and payment data of the Controller's workspace. Never lead or check data. For payment, fraud prevention and its own legal duties Stripe acts as an independent controller | Stripe's data processing agreement; Standard Contractual Clauses or the Data Privacy Framework |
| dilisense GmbH | Adverse media screening API (extended deep check) | Switzerland (EU adequacy decision) | Names of the entities screened (company names, and person names if the Controller enters one). dilisense states that it does not store these search requests | Adequacy decision of the European Commission for Switzerland |
| Coinbase (Coinbase Developer Platform) | Verification and settlement of x402 payments, on some endpoints | United States | Paying wallet address and signed payment authorisation, which are published on the public blockchain when the payment settles. Never lead or check data | Derogation for the payment the payer requests (Art. 49(1)(b) GDPR) |
| TypeSafe | Decision service (Jev), consulted in checks, sanctions reviews, report advice and the chat. Its API is reached through Cloudflare's network | United States (TypeSafe AI, Inc., San Francisco, California) | Chat messages as typed. From checks: scores and flags, and company names only when the name has a company legal form such as B.V. or GmbH (the company name searched, the names in the register and the search text typed for a KVK search; a name that could be a person's is not sent). Register and VAT numbers found on a company website, with the registered name. For sanctions decisions about legal entities: names, registration numbers and founding year. For report advice: the report's figures. TypeSafe states that it does not train its models on this data and passes it only to its own service providers. Its published terms set no fixed storage period | EU Standard Contractual Clauses in TypeSafe's published data processing addendum, which its Master Customer Agreement incorporates |
| Anthropic Ireland, Limited (Anthropic) | AI chat assistant (Ask Limitguard): writes answers and explains check results | United States (an answer may be generated in another country) | Chat questions, answers and the check results shown in the chat; no individuals' contact details or full bank account numbers; not used for training; deleted within 30 days, or up to 2 years for a request Anthropic's safety systems flag | EU Standard Contractual Clauses in Anthropic's data processing addendum |
Better Stack (status page and uptime monitoring) checks only the public health addresses of the API and the dashboard and receives no personal data of the Controller. The Processor's operational telemetry (Langfuse) runs on the Processor's own server and is not a sub-processor. The public registers, company-identifier directories (GLEIF), blockchain indexes and nodes, and sanctions lists that the Processor queries receive only the public identifier listed in section 4 of the Privacy Policy and are not sub-processors.
The Processor will notify the Controller of any intended changes to this sub-processor list (additions or replacements) at least 30 days in advance by updating this page and notifying registered users by email. The Controller has the right to object to new sub-processors in accordance with Article 28(2) GDPR. For sub-processors engaged by its own sub-processors, the Processor passes on the notice it receives without delay. If the Controller objects to a new sub-processor on reasonable data protection grounds, the Processor will switch the feature that uses it off for the Controller's workspace.
7. Security measures (Article 32 GDPR)
The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit (TLS 1.2+) and at rest: the email address stored with an API key, webhook signing secrets, Slack alert webhook addresses and the paying wallet address in payment settlement records are encrypted with Fernet (AES-128-CBC with HMAC-SHA256)
- Access controls: RBAC, API key authentication, audit logging of all access
- Container hardening: read-only filesystem, capability dropping, non-root process
- Network isolation: internal Docker network, no direct external database access
- Continuous security scanning: SAST on every PR, nightly dependency audits, nightly active penetration testing
- Incident response procedures with documented response times
Full details are available on the Security Architecture page.
8. Data breach notification (Article 33 GDPR)
In the event of a personal data breach, the Processor will:
- Notify the Controller without undue delay and within 72 hours of becoming aware of the breach
- Provide details including: nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed
- Cooperate fully with the Controller in fulfilling their notification obligations to supervisory authorities and data subjects
Breach notifications will be sent to the email address registered with the Controller's account or API key.
9. Data subject rights
The Processor will assist the Controller in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) within the timescales required by GDPR. Data subject requests and erasure requests should be submitted to privacy@limitguard.ai.
10. Audit rights
The Controller has the right to audit compliance with this DPA. The Processor will make available all information necessary to demonstrate compliance and will allow for and contribute to audits conducted by the Controller or a third-party auditor mandated by the Controller, subject to reasonable notice (minimum 30 days) and confidentiality obligations. The Processor may satisfy audit rights through provision of current third-party audit reports where available.
11. Termination and return of data
Upon termination of the service agreement, the Processor will, at the Controller's choice, delete or return all personal data processed on behalf of the Controller within 30 days, and certify deletion in writing. Lead lists are deleted when the account closes. Deletion does not apply to data retained under a legal obligation.
Contact for DPA queries: security@limitguard.ai | Signed copies: Available on request within 5 business days.
