OpenAI Data Processing Addendum
Parties: Pacific Apps, Inc. and OpenAI
Executed: July 9, 2023
Status: Executed agreement; public redacted copy available
Original: Executed record retained internally
Contact: support@idialogue.app
Why we publish it
Pacific Apps makes a redacted copy of its executed OpenAI Data Processing Addendum publicly available so customers can review the contractual data-protection terms governing this important processing relationship.
The public copy removes signatures, electronic execution metadata, and the OpenAI organization ID. The original executed agreement is retained internally and can be validated through a controlled review when required for procurement or security due diligence.
What the DPA covers
The agreement supplements the applicable OpenAI services agreement and establishes contractual safeguards for the processing of personal data.
At a high level, the agreement addresses:
- processor and controller responsibilities;
- documented processing instructions;
- confidentiality and security obligations;
- subprocessors;
- assistance with individual rights and data-protection obligations;
- security incidents;
- return or deletion of personal data;
- audits and compliance information; and
- international-transfer safeguards where applicable.
The executed agreement controls. This summary is provided for convenience and is not a replacement, amendment, or legal interpretation of its terms.
What should be evaluated separately
The DPA establishes contractual data-protection obligations between Pacific Apps and OpenAI. Current product behavior and operational controls should be evaluated separately, including:
- the data supplied to OpenAI by a particular agent or file-processing workflow;
- whether a workflow provides dialogue continuity or performs a task-based document, OCR, image, or transaction step;
- requested repository files and generated artifacts;
- operational, security, support, usage, and billing records;
- provider administration for a customer-provided OpenAI key;
- optional provider data-sharing or service-improvement settings;
- security certifications or attestations applicable to Pacific Apps or OpenAI.
These controls can vary by provider configuration, iDialogue workflow, and customer deployment.
Current product guidance
The DPA is the contractual safeguard for this processing relationship; it is not the product guide for every iDialogue workflow. Current product behavior is explained in the Trust Center, AI & Agent Governance, and Security & Data Handling.
In summary:
- Under the iDialogue-managed OpenAI integration, customer data sent through the OpenAI API is not used to train OpenAI models.
- iDialogue can retain approved conversation context for dialogue continuity, so users do not have to repeat or re-teach earlier discussions.
- Document generation, OCR, image analysis, and transactional work are task-based and do not create conversational memory.
- Requested repository files, generated artifacts, and operational records are separate from conversational memory and follow their applicable lifecycles.
See the Data Retention Policy for current lifecycle guidance and the Third-Party Security Policy for provider governance.
Customer-provided OpenAI keys
Approved deployments can use a customer-provided OpenAI API key, placing provider-level administration, billing, usage visibility, rate limits, and applicable account settings within the customer's OpenAI organization.
A customer-provided key does not by itself change which data an iDialogue workflow uses, how dialogue continuity is provided, which requested files or generated artifacts are retained, or which operational records are maintained.
Review the OpenAI Connection guide for additional information about this control boundary.
Need the DPA for a security or procurement review?
For questions about the agreement, validation of the executed record, or additional procurement documentation, contact support@idialogue.app.