Data Processing Addendum
Last Updated: February 2026
This Data Processing Addendum ("DPA") forms part of and is incorporated into the IdentityRM™ License Agreement and Terms of Service (collectively, the "Agreement") between Evolved Identity Solutions LLC ("Evolved Identity"), a Texas limited liability company, and the Customer.
In the event of any conflict between this DPA and the Agreement, this DPA shall control with respect to personal data processing obligations only.
1. Definitions
- "Controller" means the entity that determines the purposes and means of processing personal data.
- "Processor" means the entity that processes personal data on behalf of the Controller.
- "Personal Data" means information relating to an identified or identifiable natural person processed by IdentityRM™ on behalf of Customer.
- "Subprocessor" means a third party engaged by Evolved Identity to process Personal Data.
For purposes of this DPA, Customer is the Controller and Evolved Identity is the Processor.
2. Scope and Purpose of Processing
Evolved Identity processes Personal Data solely for the purpose of providing IdentityRM™ services as defined in the Agreement, including identity governance, runtime authority management, access controls, and audit logging.
Processing may include:
- Collection
- Storage
- Organization
- Retrieval
- Use for identity governance execution
- Deletion upon instruction
Evolved Identity shall process Personal Data only on documented instructions from Customer.
3. AI and Data Usage Restrictions
Evolved Identity does not use Customer Personal Data to train generalized artificial intelligence models.
Customer data, identity context data, and decision traces are processed solely to deliver authorized runtime and governance functionality and are not used for behavioral cloning, AI model distillation, or competitive derivative systems.
These restrictions align with the IdentityRM™ License Agreement.
4. Confidentiality
Evolved Identity ensures that personnel authorized to process Personal Data are bound by confidentiality obligations.
5. Security Measures
Evolved Identity implements commercially reasonable technical and organizational security measures appropriate to the nature of the services, including:
- Logical access controls
- Encryption in transit where applicable
- Audit logging
- Role-based access controls
- Infrastructure monitoring
Customer remains responsible for implementing its own security architecture and controls as required under Section 4 of the Terms of Service.
6. Subprocessors
Evolved Identity may engage Subprocessors to provide infrastructure, hosting, analytics, or support services.
Evolved Identity shall:
- Impose data protection obligations on Subprocessors consistent with this DPA
- Remain responsible for Subprocessor compliance
- Provide notice of material Subprocessor changes upon request
7. International Data Transfers
Where Personal Data is transferred internationally, Evolved Identity will implement appropriate safeguards consistent with applicable data protection laws. Where required, Standard Contractual Clauses (SCCs) may be incorporated by reference.
8. Data Subject Rights
Evolved Identity shall, to the extent legally permitted and technically feasible, assist Customer in responding to data subject access, correction, deletion, or portability requests.
9. Breach Notification
Evolved Identity shall notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer data.
Notification will include reasonably available information necessary for Customer to meet its regulatory obligations.
10. Audit Rights
Upon reasonable written notice and no more than once annually, Customer may request documentation demonstrating Evolved Identity's compliance with this DPA. Audits shall not compromise platform security, confidentiality of other customers, or intellectual property protections.
11. Data Retention and Deletion
Upon termination of the Agreement, Evolved Identity shall delete or return Personal Data in accordance with the Agreement, except where retention is required by law.
12. Governing Law
This DPA shall be governed by the laws of the State of Texas, except where superseded by mandatory data protection regulations.
13. Order of Precedence
This DPA supplements the IdentityRM™ License Agreement and Terms of Service. All intellectual property, AI protections, and usage restrictions defined in the License Agreement remain in full force and effect.
© Evolved Identity Solutions LLC, a Texas limited liability company. All rights reserved.
Schedule 1 – Description of Processing Activities
This Schedule 1 forms part of the IdentityRM™ Data Processing Addendum.
1. Subject Matter of Processing
Provision of IdentityRM™ identity governance, identity context, and authority runtime services under the applicable IdentityRM™ License Agreement.
2. Duration of Processing
Processing shall occur for the duration of the applicable IdentityRM™ License Agreement, including any agreed transition or data return/deletion period following termination.
3. Nature and Purpose of Processing
Processing activities are limited to those necessary to provide the IdentityRM™ platform, including:
- Identity lifecycle management
- Organizational node and hierarchy management
- Role and permission assignment
- Access request workflows and approvals
- Temporal access controls
- Audit logging and decision trace generation
- Security monitoring and fraud prevention
- AI-assisted governance workflows operating within Customer-defined authority constraints
IdentityRM™ does not use Customer Personal Data to train, fine-tune, or improve generalized machine learning or foundation models. AI-assisted features operate solely to provide services to the applicable Customer instance and do not incorporate Customer Personal Data into shared model training datasets.
4. Categories of Data Subjects
- Customer employees
- Customer contractors
- Authorized end users
- Customer partner or affiliate users (as configured by Customer)
5. Categories of Personal Data
Processing may include the following categories of personal data, as determined and configured by Customer:
- Name
- Business email address
- Username or internal identifier
- Job title or role designation
- Organizational unit or node assignment
- Role, entitlement, and permission metadata
- Access request and approval records
- Access event logs and decision trace metadata
- Authentication and identity provider identifiers (where integrated by Customer)
IdentityRM™ is not designed to require or intentionally process personal data beyond the categories listed above.
6. Special Categories of Data
IdentityRM™ is not intended to process special categories of personal data (including health data, biometric data, financial account data, or children's data). Customer agrees not to configure or use the Services to store or process such data unless expressly agreed in writing.
7. Hosting Location
IdentityRM™ services are hosted in the United States. Evolved Identity Solutions LLC does not provide EU data residency commitments unless expressly agreed in writing. Any cross-border data transfer obligations shall be addressed pursuant to applicable contractual safeguards between the parties.
