# TITAN ENTERPRISE MASTER LEGAL PACK: MUTUAL NDA & DATA PROCESSING ADDENDUM (DPA) **Document Reference:** TITAN-LEGAL-2026-V1 **Effective Date:** October 16, 2026 **Governing Entities:** Al-Haram Lab & TITAN Technologies LLC (Service Provider / Processor) and the Registered Enterprise Customer (Customer / Controller) **Compliance Standards:** GDPR Article 28(3), EU Standard Contractual Clauses (2021/914), UK International Data Transfer Addendum (IDTA), SOC 2 Type II, ISO/IEC 27001:2022, and EU AI Act (Regulation (EU) 2024/1689) Article 50. --- ## PART I: B2B MUTUAL NON-DISCLOSURE AGREEMENT (MNDA) ### 1. Purpose and Scope This Mutual Non-Disclosure Agreement (Agreement) governs the disclosure and protection of proprietary, commercial, operational, architectural, and technical information shared between the Parties in connection with the evaluation, deployment, and operation of the TITAN Enterprise Autonomous Platform. ### 2. Definition of Confidential Information Confidential Information means all non-public information disclosed by either Party (Disclosing Party) to the other Party (Receiving Party), whether orally, visually, electronically, or in writing, including but not limited to: - Source code, software architectures, neural routing algorithms, API specifications, and prompt designs; - Information security policies, vulnerability scan reports, penetration test telemetry, and SOC 2 Type II workpapers; - Business metrics, pricing structures, customer records, and strategic roadmaps. ### 3. Obligations of Receiving Party The Receiving Party agrees to: - Hold all Confidential Information in strict confidence, exercising at least the degree of care used for its own confidential information (and never less than reasonable care); - Restrict access to employees, contractors, and legal/financial advisors who have a need to know and are bound by confidentiality obligations at least as restrictive as this Agreement; - Never copy, reverse-engineer, decompile, or synthesize the Disclosing Party's Confidential Information; - Refrain from feeding any proprietary prompts, frameworks, or source code into unapproved public AI models. ### 4. Duration This Agreement remains in effect for three (3) years from the Effective Date, provided that Trade Secrets shall remain protected perpetually under applicable law. --- ## PART II: GDPR ARTICLE 28 DATA PROCESSING ADDENDUM (DPA) This Data Processing Addendum (DPA) supplements the Master Services Agreement / Terms of Service. ### 1. Roles and Instructions - **Controller & Processor:** Customer acts as the Data Controller; Al-Haram Lab & TITAN Technologies LLC act as Data Processor. - **Documented Instructions:** Processor processes Customer Personal Data solely upon documented instructions of Controller, as set forth in the Main Agreement, this DPA, and Controller's configuration of the Services. - **Compliance with Article 28(3)(a):** Processor shall not transfer personal data to a third country or international organisation without documented instructions from Controller, subject to Chapter V of the GDPR. ### 2. Confidentiality & Personnel Processor ensures that all individuals authorized to process Personal Data have committed themselves to confidentiality or are under statutory confidentiality obligations. ### 3. Technical and Organizational Security Measures (TOMs) Processor implements and maintains industry-leading technical and organizational security measures pursuant to Article 32 GDPR, including: - **Encryption in Transit:** TLS 1.3 mandatory with strong cipher suites across all endpoints. - **Encryption at Rest:** AES-256-GCM / ChaCha20-Poly1305 applied across all databases, backups, and NVMe volumes. - **Zero-Trust Network Perimeter:** Mutual TLS (mTLS), Cloudflare Magic Transit, and internal WireGuard mesh. - **Access Control & RBAC:** Least-privilege access, multi-factor authentication (FIDO2 / TOTP), and automated session expiration. - **Automated Incident Response:** Real-time SIEM logging, immutable audit trails, and automated anomaly detection. ### 4. Sub-Processor Management & Transparency Controller grants general written authorization to Processor to engage the sub-processors listed below: 1. **Cloudflare, Inc.** (Global Edge Network, DDoS Defense, Anycast CDN, WAF) — Location: Global/EU/US — Transfer: EU SCCs. 2. **Stripe, Inc.** (Payment Processing, Invoicing, Billing Gateway) — Location: US/EU — Transfer: EU SCCs & PCI-DSS L1. 3. **Listmonk Engine (Self-Hosted)** (Transactional Email Dispatch) — Location: Private Cloud (Frankfurt, Germany) — Transfer: Internal EU sovereign enclave. 4. **Vaultwarden Engine (Self-Hosted)** (Secrets Vault & Token Store) — Location: On-Premise Air-Gapped NVMe — Transfer: Internal sovereign zero-knowledge enclave. 5. **LiteLLM / Local Inference Node (Self-Hosted)** (Local AI Model Hub) — Location: Private TITAN Compute Enclave — Zero external data egress. Processor shall give Controller at least 30 days prior written notice of any intended changes or additions to Sub-processors. ### 5. Personal Data Breach Notification Processor shall notify Controller in writing without undue delay, and in any event within **twenty-four (24) hours**, upon becoming aware of any confirmed Personal Data Breach impacting Controller's data. ### 6. Data Subject Rights & Regulatory Assistance Processor provides automated APIs and administrative tools allowing Controller to fulfill Data Subject Access Requests (DSAR), including rectification, erasure, restriction, and portability under GDPR Articles 15-22. ### 7. Audits and Certifications Processor shall make available all information necessary to demonstrate compliance with GDPR Article 28. Controller may satisfy audit requirements via annual independent SOC 2 Type II audit reports and ISO/IEC 27001 certifications. ### 8. Deletion and Return of Data Upon termination of the Services, Processor shall, at Controller's election, securely delete or return all Personal Data in accordance with NIST SP 800-88 Rev 1 guidelines within thirty (30) days. --- ## PART III: EU AI ACT ARTICLE 50 TRANSPARENCY ADDENDUM Pursuant to Regulation (EU) 2024/1689 (EU Artificial Intelligence Act) Article 50: 1. **Transparency Disclosures:** All autonomous AI agent interactions, automated synthesis processes, and machine-generated outputs are clearly marked and auditable. 2. **No Unconsented Model Training:** Customer data and prompts are NEVER utilized for training or fine-tuning foundation models without explicit written agreement. 3. **Human-in-the-Loop Safeguards:** Mission-critical automations maintain human supervision controls, configurable thresholds, and instant kill switches. --- ## PART IV: EXECUTION AND COUNTER-SIGNATURE **SERVICE PROVIDER / PROCESSOR:** **Al-Haram Lab & TITAN Technologies LLC** By: *Legal & Security Operations Directorate* Verification Hash: Contact: legal@alharamlab.com | security@alharamlab.com **REGISTERED ENTERPRISE CONTROLLER:** Executed digitally via the TITAN Enterprise Trust Center Portal.