Obscura Cloud Data Processing Agreement (DPA)

1. Parties and Scope

1.1. This agreement is made between the Customer (the "Controller") and PT Virtue Digital Indonesia, NIB 0220108402782, of PIK Avenue Mall, Level 6, Jalan Pantai Indah Kapuk Boulevard, Kel. Kamal Muara, Kec. Penjaringan, Kota Adm. Jakarta Utara, DKI Jakarta 14470 (the "Processor" or "we").

1.2. This agreement forms part of the Obscura Cloud Terms of Service and applies from when the Customer accepts those Terms, or from joint signature if the parties agree so. It applies for as long as the Processor processes personal data on behalf of the Customer.

1.3. This agreement applies only to Obscura Cloud. The Private and Enterprise editions are governed by a separate licence agreement.

1.4. Terms such as "Personal Data", "Controller", "Processor" and "Data Subject" follow Law 27/2022 on Personal Data Protection (the "PDP Law"). "Customer Data" means personal data the Processor processes on the Controller's behalf in the Service, as described in Annex 1.

2. Roles

2.1. For Customer Data, the Customer is the Controller and PT Virtue Digital Indonesia is the Processor (Article 51 of the PDP Law).

2.2. For our own customer-relationship data (sign-up and billing contacts, invoices, prospects), data about visitors to our website, and the security logs we need to protect the Service, we are the Controller, as explained in the Privacy Policy. This agreement does not cover that data.

3. Instructions

3.1. The Processor processes Customer Data only on documented written instructions from the Controller (Article 51(1) of the PDP Law).

3.2. The Controller's instructions are: (a) this agreement and the Terms of Service; (b) the Controller's use of the Service and its product settings, including retention, AI, classification and access-rights settings; and (c) other reasonable written instructions consistent with the Service.

3.3. If the Processor believes an instruction breaks the law, it tells the Controller and may delay carrying it out.

3.4. The Controller warrants that it has a lawful basis for processing Customer Data and has met its duty to inform Data Subjects.

4. Rights and Obligations of the Parties

4.1. The Controller decides the purposes and means of processing, keeps the data it enters accurate, sets document retention, and manages Users and their access rights.

4.2. The Processor processes Customer Data under Section 3, keeps it secure under Section 6, assists the Controller under Sections 9 and 10, and does not use Customer Data for its own purposes, including not to train AI models.

4.3. Processing records. The Processor keeps records of processing carried out on the Controller's behalf and makes them available on reasonable request (Article 31 of the PDP Law).

5. Personnel Confidentiality

The Processor ensures that personnel who can access Customer Data are bound by confidentiality and access data only as far as needed to run the Service (Articles 36 and 52 of the PDP Law).

6. Security

The Processor applies technical and organisational measures appropriate to the risk, at least those in Annex 2 (Articles 35, 38 and 39 of the PDP Law). The Processor may update them as long as overall protection does not decrease.

7. Subprocessors

7.1. By accepting this agreement the Controller gives prior general written approval for the subprocessors listed in Annex 3.

7.2. The Processor gives the Controller 30 days' notice before adding or replacing a subprocessor, by email to the Admin and/or inside the Service. The Controller may object in writing, on reasonable data-protection grounds, within the notice period (Article 51(4) and (5) of the PDP Law).

7.3. If the objection cannot be resolved, the Controller may terminate the affected Service and receive a pro rata refund of prepaid subscription fees for the remaining period.

7.4. The Processor requires each subprocessor to follow data-protection obligations that are in substance equivalent to this agreement, and remains responsible to the Controller for their performance.

7.5. Peruri acts as a licensed PSrE and e-Meterai provider under its own terms; that relationship is described in the Terms of Service.

8. Transfers Abroad

8.1. Customer Data is stored in Indonesia, on the Processor's own servers in a data centre in Jakarta, backups included. Service emails are sent through the Processor's own mail server in Indonesia.

8.2. The routine cross-border transfers are these:

• to the AI providers in the United States (OpenAI or Anthropic), only when AI features are on with the default provider;
• to Apple and Google push services (global), for notification metadata only;
• to WhatsApp (Meta Platforms) (global), only if the Controller turns on WhatsApp delivery;
• to Cloudflare (global), for DNS queries for our domains only.

8.3. Basis for the transfer under Article 56 of the PDP Law: the Processor makes sure the destination country has an equal or higher level of protection; if not, it relies on adequate and binding safeguards (for example a data processing agreement with the provider); if neither exists, consent.

8.4. The Controller can switch AI off, use its own provider key or a self-hosted endpoint, or block AI by document classification. Private Vault folders are never sent to AI.

9. Assistance to the Controller

9.1. Data Subject requests. If the Processor receives a request directly from a Data Subject about Customer Data, it forwards it to the Controller within 2 business days and does not answer it itself unless instructed. The Processor helps the Controller meet Data Subjects' rights using the Service's features (for example search, export and deletion) in time for the Controller to meet the 3 x 24 hour deadlines under the PDP Law.

9.2. Accuracy and records. The Processor helps the Controller keep data accurate and meet record-keeping duties (Articles 29 and 31 of the PDP Law).

9.3. Impact assessment. The Processor provides reasonable information to help the Controller carry out a personal data protection impact assessment (Article 34 of the PDP Law).

10. Personal Data Protection Failures

10.1. The Processor notifies the Controller without undue delay and within 24 hours after a failure is confirmed.

10.2. The notice contains, as far as possible, what Article 46(2) of the PDP Law requires: the personal data disclosed, when and how it was disclosed, and the handling and recovery steps, so that the Controller can notify Data Subjects and the competent authority within 3 x 24 hours. Information not yet available is supplied in stages.

10.3. After that, the Processor helps investigate, contain and recover.

11. Audit and Supervision

11.1. The Controller may ask for evidence of compliance. The Processor meets this mainly by providing its ISO/IEC 27001 certificate and relevant reports.

11.2. If that evidence is not enough, the Controller may audit once a year, on reasonable notice (at least 30 days), during business hours, limited to the processing of Customer Data, and without disrupting other customers or exposing their data. Further audits may follow an incident or an authority's order. The Controller bears audit costs unless a material breach is found.

12. Return and Deletion

12.1. When the Service ends, the Controller can export Customer Data for 30 days (encrypted ZIP; link valid 15 minutes; archive deleted after 7 days).

12.2. The Processor deletes Customer Data within 90 days after the subscription ends. Exceptions: billing records that the law requires to be kept, and backups, which age out with the backup cycle (daily, 7 copies by default).

12.3. On request, the Processor confirms deletion in writing.

13. Orders from Authorities

If a competent authority orders the Processor to hand over Customer Data (Article 49 of the PDP Law), the Processor complies only as far as the law requires, tells the Controller first where the law allows, and limits disclosure to what is requested.

14. Processing Outside Instructions

If the Processor processes data outside the Controller's instructions, the Processor is responsible as Controller for that processing (Article 51(6) of the PDP Law).

15. Liability, Law and Language

15.1. The parties' liability under this agreement is subject to the limitation of liability in the Terms of Service.

15.2. Governing law and dispute resolution are the same as in the Terms of Service (Indonesian law; 30 days of negotiation; then Pengadilan Negeri Jakarta Selatan).

15.3. This agreement is made in Indonesian and English. If there is any difference, the Indonesian version prevails.

16. Version and Effective Date

Version 2026-10. Effective from 28 October 2026.

Annex 1: Description of Processing

Annex 2: Security Measures

The measures below apply to the Cloud Service. This list describes what exists; it is not a guarantee that an incident will never occur.

• Information security management system: the Service is developed and operated under PT Virtue Digital Indonesia's ISO/IEC 27001-certified information security management system.
• Encryption at rest: files are encrypted using per-object envelope encryption. Signing keys, MFA secrets and stored credentials are encrypted.
• Encryption in transit: TLS to the Service.
• Tenant isolation: a separate database schema and storage namespace for each organisation.
• Audit log: append-only, hash-chained (tampering is detectable), verified regularly.
• Access control and authentication: MFA (TOTP, passkeys), SSO (OIDC, LDAP, SCIM), account lockout after repeated failures, a minimum password length of 12 characters stored as an argon2id hash.
• Document protection: forensic watermarking of issued copies; AI controls by classification (DLP); Private Vault is not sent to AI.
• Backups: daily; 7 copies by default; kept on servers in Indonesia.
• Personnel confidentiality: Section 5.
• Incident handling: Section 10.

Annex 3: Subprocessor List