Beam Prism: Data Processing Agreement

Last updated: 4 November 2026

This Data Processing Agreement ("DPA") forms part of the contract, order or terms under which the customer (the "Controller") uses Beam Prism ("Prism") from Beam Technologies GmbH, Schönhauser Allee 74a, 10437 Berlin, Germany (the "Processor") (together, the "Agreement"). It applies where the Processor processes personal data on behalf of the Controller within the meaning of Article 28 of the General Data Protection Regulation ("GDPR"). It covers Prism only. The Beam agent platform is governed by its own data processing terms at beam.ai/legal/data-security.

1. Subject matter and duration

1.1 The subject matter of the processing is the provision of Prism to the Controller under the Agreement.

1.2 This DPA runs for the term of the Agreement. Termination of the Agreement terminates this DPA. Either party's right to terminate for good cause is unaffected. Termination must be made in writing.

2. Scope of processing

2.1 The Processor processes personal data only for the purpose of performing the Agreement and only on the Controller's documented instructions, unless required to do so by law. In that case the Processor informs the Controller before processing, unless the law prohibits it.

2.2 The categories of data subjects and personal data are set out in Annex 1.

2.3 Processing takes place in the European Union, except where this DPA states otherwise. Processing outside the European Union or the European Economic Area is permitted only where the requirements of Chapter V GDPR (Articles 44 to 49) are met, as described in Section 11.

3. Technical and organisational measures

3.1 The Processor has implemented the technical and organisational measures set out in Annex 2 in accordance with Article 32 GDPR. The Controller has reviewed them and accepts them as appropriate.

3.2 The Processor may replace individual measures with alternative measures, provided the level of protection is not reduced. Material changes are documented and the Controller is informed.

4. Rights of data subjects

4.1 The Processor assists the Controller, by appropriate technical and organisational measures, in responding to requests from data subjects under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection).

4.2 Requests received directly by the Processor are forwarded to the Controller without undue delay. The Processor does not respond to such requests itself unless instructed by the Controller.

5. Obligations of the Processor

5.1 Only personnel who are bound by confidentiality and instructed in their data protection obligations process personal data under this DPA.

5.2 The Processor informs the Controller without undue delay if it believes an instruction infringes the GDPR or other data protection law.

5.3 The Processor notifies the Controller of a personal data breach affecting the Controller's data without undue delay after becoming aware of it, with the information required under Article 33(3) GDPR, and supports the Controller in meeting its notification duties.

5.4 The Processor assists the Controller with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to it.

5.5 The Processor maintains a record of processing activities carried out on behalf of the Controller under Article 30(2) GDPR.

5.6 The Processor cooperates with the competent supervisory authority and informs the Controller without undue delay of any inspection or inquiry relating to the processing under this DPA.

6. Sub-processors

6.1 The Controller authorises the Processor to engage the sub-processors listed in Annex 3. The Processor has concluded a written contract with each sub-processor imposing data protection obligations equivalent to those in this DPA.

6.2 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 30 days before the change takes effect, by notifying the Controller by email with the updated Annex 3 and publishing it at prism.beam.ai/legal/data-processing.

6.3 The Controller may object to the change in writing within 30 days of the notification on reasonable data protection grounds. If no objection is received, the change is deemed accepted. If the parties cannot resolve an objection, either party may terminate the affected service.

6.4 Ancillary services, such as telecommunications, transport or hardware maintenance, are not sub-processing. The Processor ensures appropriate confidentiality and security for such services.

7. Audit rights

7.1 The Controller may verify the Processor's compliance with this DPA once per contract year, by requesting information and documentation, including current reports or attestations from independent auditors where available.

7.2 Where documentation is insufficient, the Controller or an independent auditor bound by confidentiality may carry out an inspection at the Processor's premises during business hours, with at least four weeks' notice, limited to what is necessary and without disrupting the Processor's operations.

7.3 The Processor may charge reasonable costs for inspections beyond the first in a contract year, or where an inspection is not caused by the Processor's non-compliance.

8. Instructions

8.1 Instructions are given in writing or in text form. Verbal instructions are confirmed in text form without undue delay.

8.2 The Processor may suspend the execution of an instruction it believes to be unlawful until the Controller confirms or amends it.

9. Confidentiality

9.1 The Processor keeps all personal data and all information about the Controller's business and security measures confidential, and imposes the same obligation on its personnel and sub-processors.

9.2 This obligation continues after the end of the Agreement without time limit.

10. Return and deletion of data

10.1 On termination of the Agreement, or earlier on the Controller's instruction, the Processor deletes the Controller's personal data from active production systems and completes deletion from all systems under its control, including backups, within 90 days, unless retention is required by law.

10.2 Where the Controller requests it before deletion, the Processor provides an export of the Controller's data in a common machine-readable format within 30 days.

10.3 Individual users may delete their own transcripts and recordings during the contract, as described in Annex 2, Section F.

10.4 On request, the Processor confirms deletion in writing.

11. International data transfers

11.1 Where personal data is transferred to a country outside the EU or EEA that does not have an adequacy decision from the European Commission, the transfer is based on the EU Standard Contractual Clauses (Commission Decision 2021/914) with any supplementary measures identified in a transfer impact assessment, or, for eligible recipients in the United States, on the EU-U.S. Data Privacy Framework.

11.2 The sub-processors listed in Annex 3 whose processing takes place outside the EU are identified there with the transfer mechanism applied.

12. Liability and final provisions

12.1 Each party is liable in accordance with Article 82 GDPR. Any limitation of liability in the Agreement applies to this DPA, except where the GDPR provides otherwise.

12.2 Each party informs the other without undue delay of any claim, complaint or proceeding relating to the processing under this DPA.

12.3 This DPA takes precedence over conflicting provisions of the Agreement as far as the processing of personal data is concerned.

12.4 Amendments must be made in writing or in text form.

Annex 1: Data subjects and categories of personal data

Data subjects

• Users of Prism within the Controller's organisation.
• People who correspond with those users by email, calendar or messaging channels: colleagues, business partners, clients, suppliers and other third parties.
• Participants in meetings that users record or import into Prism.

Categories of personal data

Prism does not store full copies of emails or attachments. It does not access Microsoft Teams meetings, recordings or transcripts, SharePoint or OneDrive.

Special categories of personal data (Article 9 GDPR) are not required for the service. They may be processed incidentally where they appear in the user's correspondence.

Annex 2: Technical and organisational measures

A. Access to the Controller's systems

• Prism connects to Microsoft 365 and Google accounts using delegated permissions only, acting as the signed-in user and limited to that user's own mailbox and calendar.
• No application-level or organisation-wide permissions are requested, and no administrator role is required.
• The Controller's administrators can revoke Prism's access at any time and can restrict the application to assigned users.

B. Hosting and separation

• Application servers are hosted in Amsterdam, Netherlands. The database and file storage are hosted in Ireland. Conversations with the assistant are stored on the application servers in Amsterdam.
• Prism is operated as a single shared service. Each workspace's data is tagged with its workspace identifier and every request is checked against workspace membership. Row-level security blocks direct database access from user sessions.

C. Encryption

• All data in transit is protected by TLS. The application accepts HTTPS connections only.
• The database and file storage are encrypted at rest with AES-256. Application server disks use the hosting provider's default encryption at rest.
• Connection tokens for the Controller's accounts are stored only on the Processor's servers and cannot be read by users or client applications.

D. Access control within the Processor

• Access to production systems is restricted to the Processor's authorised personnel and contractors, using individual accounts.
• Personnel and contractors are bound by confidentiality.

E. Monitoring, logging and resilience

• Error reports are collected with secrets removed and personal-data collection disabled. AI quality records are collected with personal identifiers removed.
• The database and application server disks are backed up daily by the hosting providers.
• Security updates to the application and its dependencies are applied as part of regular releases.

F. Retention and deletion within the service

• Messages exchanged on chat channels are deleted automatically after 180 days.
• Individual transcripts and recordings can be deleted through the application interface or on request.
• Email summaries and assistant conversations are retained until the account is deleted. Transcripts are retained until deleted or until the account is deleted.
• When a user disconnects an account, Prism stops using it. Disconnecting does not revoke the application's consent at the provider; users and administrators can revoke it there at any time.
• Account deletion is carried out on request to the Processor and removes the user's records, including connection tokens.

G. AI processing

• AI processing is carried out through a model-routing service by model providers including DeepSeek, Tencent, Moonshot AI, Alibaba (Qwen), Z.ai, MiniMax, OpenAI, Anthropic and Google.
• The Processor does not use the Controller's data to train AI models. AI quality records, with personal identifiers removed, are used to evaluate and improve the service.
• Users can choose the model used for chat and daily briefs. Email analysis uses the Processor's standard models.
• AI processing is not limited to the European Union unless otherwise agreed with the Controller in the Agreement.

Annex 3: Sub-processors

This list is updated when a sub-processor is added or replaced, with notice to the Controller as set out in Section 6.