Data Processing Agreement — SOKKAN Inference API

Version 2026-10-03 (adds OVHcloud, France, as GPU and inference sub-processor) · NINABOT Sàrl, Geneva, Switzerland (CHE-287.575.522) · GDPR art. 28 / Swiss FADP art. 9. This agreement supplements the SOKKAN Inference API Terms & Data Policy (the “Terms”). It applies between NINABOT Sàrl (“NINABOT”, “Processor”) and any router, reseller or platform that holds an API key for https://api.sokkan.ch (the “Customer”). It takes effect on first use of the API, or on signature of a counterpart, which NINABOT provides on request.

1. Roles

The Customer acts as controller, or as processor on behalf of its own customers, for the content its end users submit. NINABOT acts as processor, or as sub-processor of the Customer, and processes personal data only on the Customer's documented instructions. The Customer's instruction is: generate a completion for each request sent to the API, and invoice the tokens consumed. NINABOT informs the Customer if it believes an instruction infringes applicable data protection law.

2. Details of processing

• Subject matter and nature: running language-model inference on the content of API requests and returning the result.
• Duration: for the duration of each request; the agreement itself lasts as long as the Customer holds an API key.
• Categories of data: any personal data that end users choose to include in prompts (the API does not ask for any); request metadata.
• Categories of data subjects: the Customer's end users and persons mentioned in their content.
• Special categories: not requested. NINABOT applies the same zero-retention treatment if they are present.

3. No retention, no secondary use

Request and response content is processed in memory only and is never written to disk, logged or retained. It is never used for training, evaluation, product improvement or any other purpose. For billing, NINABOT records per request a request identifier, the model, the API key owner (the Customer), token counts, cost, HTTP status and latency. These records contain no request content and no end-user identifier, and are kept for 10 years (Swiss Code of Obligations, art. 958f).

4. Location of processing

Each model listed by GET /v1/models declares the country of its inference hardware. Models declared CH run in Switzerland, either on servers that NINABOT owns and operates on its premises in the Geneva area, or on GPU instances that NINABOT rents from Exoscale in its Zurich datacenter; the region field of each model (geneva or zurich) says which. NINABOT does not reroute a request to another location when capacity is reached; it answers 429. A model hosted in another country, or on infrastructure NINABOT does not own, is declared as such in /v1/models and the corresponding sub-processor is added under section 6 before that model receives traffic.

Switzerland benefits from an adequacy decision of the European Commission (GDPR art. 45), so transfers from the EU/EEA to NINABOT need no additional safeguard. Transfers by NINABOT to a sub-processor outside Switzerland, the EU/EEA or another adequate country rely on the safeguards stated in section 6.

5. Security measures

• TLS encryption from the Customer to the edge; WireGuard encryption (Tailscale) between NINABOT's own servers.
• API keys are stored only as SHA-256 hashes; one key per Customer, revocable at any time.
• HTTP access logs are disabled on the inference service; application logs never contain request content.
• Administrative access restricted to NINABOT's founders and the operating tools they run, over private encrypted channels; no third party has access to the servers.
• Per-model capacity limits and early 429 responses protect availability.
• Servers on uninterruptible power; capacity and errors monitored continuously.

Persons authorised to process data on behalf of NINABOT are bound by confidentiality.

6. Sub-processors

The Customer authorises the following sub-processors:

• Cloudflare, Inc. (United States; global network) — DNS, TLS termination and network protection in front of api.sokkan.ch. Request content passes through Cloudflare in transit, in memory, and is not stored. Safeguards: EU–US and Swiss–US Data Privacy Framework certification and Cloudflare's standard contractual clauses.
• Tailscale Inc. (Canada) — coordination of the encrypted private network between NINABOT's servers in Geneva. Traffic is end-to-end encrypted with keys Tailscale does not hold; Tailscale processes connection metadata only.
• Akenes SA (Exoscale) (Lausanne, Switzerland) — GPU instances in Exoscale's Zurich datacenter (zone ch-dk-2), for the models whose /v1/models entry declares region: zurich. Request content is processed in memory on these instances and is not stored. Processing stays in Switzerland; no transfer safeguard is needed.
• OVH GmbH (OVHcloud group), with infrastructure operated by OVH SAS in France — managed inference (AI Endpoints) and GPU instances (AI Deploy) in OVHcloud's datacenters in France, for the models whose /v1/models entry declares country_code: FR. Request content is processed in memory and is not stored. Processing stays in the EU/EEA, which benefits from Switzerland's adequacy recognition; no additional transfer safeguard is needed.

Models served on NINABOT's own hardware involve no sub-processor other than Cloudflare and Tailscale. NINABOT informs the Customer by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may stop using the affected models or terminate, without penalty. NINABOT imposes on each sub-processor data protection obligations equivalent to this agreement and remains liable for them.

7. Personal data breach

NINABOT notifies the Customer without undue delay and in any case within 48 hours after becoming aware of a breach affecting the Customer's data, with the information available (nature, likely consequences, measures taken), and cooperates with the Customer's own notification duties (GDPR art. 33-34, FADP art. 24).

8. Assistance

Since no content is retained, NINABOT holds no end-user data to access, correct or delete. NINABOT nevertheless assists the Customer, taking into account the nature of the processing, with data subject requests, data protection impact assessments and consultations with supervisory authorities.

9. Audit

NINABOT makes available to the Customer the information necessary to demonstrate compliance with this agreement, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates, bound by confidentiality, on 30 days' notice, at most once a year unless a breach or a supervisory authority requires otherwise. Each party bears its own costs.

10. End of processing

When the Customer's key is revoked, no Customer content remains to be returned or deleted. Billing records are kept as stated in section 3.

11. Precedence, law and jurisdiction

This agreement prevails over the Terms for data protection matters. It is governed by Swiss law, with place of jurisdiction in Geneva; mandatory provisions of the GDPR apply where the Customer is subject to it. Liability follows the Terms.

12. Contact

NINABOT Sàrl, Chemin de Riantbosson 19, 1217 Meyrin (GE), Switzerland — Nicolas Micaud, co-founder & CTO — [email protected].