PrismGuard Data Processing Agreement

Last updated: 2026-06-20

This operational DPA describes PrismGuard processing for the landing site, account subscription backend, VPN admission, and Premium Shield.

Roles

For normal VPN service operation, PrismGuard acts as service provider/controller for account, payment, entitlement, and abuse-prevention records. For business customers, a separate signed DPA may define controller/processor roles.

Processed data

PrismGuard may process:

• wallet public key, plan id, entitlement tier, expiry, transaction signature, currency, amount, and quote id;
• short-lived app-session JWT and RS256 VPN credential metadata;
• server selection, allowed server ids, transport selection, and operational health data;
• Shield request fields submitted by the user or client, such as domain, recipient, transaction payload, clipboard address, route preference, or RPC context;
• support messages and legal/abuse notices.

Sub-processors and infrastructure

Current architecture may use Solana RPC/Helius, Cloudflare Pages for the public site, the PrismGuard backend, and the VPN server fleet. The backend runs on dedicated infrastructure; specific sub-processor details are available on request.

Security measures

Security controls include account-based access, short-lived credentials, RS256 JWKS validation for VPN admission, Premium gating for Shield endpoints, TLS, firewalling, rate limits, and operational monitoring.

Retention

Operational records are retained only as long as needed for subscription, abuse handling, security, accounting, or legal obligations. Private keys and seed phrases are never collected.