> ## Documentation Index > Fetch the complete documentation index at: https://docs.opper.ai/llms.txt > Use this file to discover all available pages before exploring further. # Data processing agreement (DPA) and project DPA terms > What your organization's Owner can sign in the platform, what it changes for a project, where the signed PDFs are, who is told, and what happens when you release a lock, delete a project, change plan or change your company details. > [!WARNING] > > Signing the DPA and project DPA terms in the platform is in **beta** and is > turned on for a few organizations. To try it, email > [support@opper.ai](mailto:support@opper.ai). This page is for your organization's Owner. Only the Owner can sign. ## In short * **The DPA already applies to you.** Opper's [Data Processing Agreement](https://opper.ai/data-processing-agreement) (DPA) is part of the [Terms of Service](https://opper.ai/terms-of-service) for pay-as-you-go customers, and of the customer agreement for enterprise customers. You do not have to sign anything for it to apply. * **What you can sign.** The Owner can sign the DPA with your company's details, together with **project DPA terms** for one project. Project DPA terms are a short add-on to the DPA. They list the AI provider routes one project may use. The list comes from the project's [Model access lock](https://docs.opper.ai/control-plane/rules/model-access-locks.md). * **One DPA, terms per project.** Your first signing signs the DPA and the first project's terms. Each later signing adds terms for one more project under that same DPA. * **What it changes.** A project with signed terms keeps its lock as it is: the lock cannot be replaced or updated, and only the Owner can release it or delete the project. If a provider changes a route in a way Opper classifies as material, Opper suspends that route for the project. See [What signing changes for a project](#what-signing-changes-for-a-project). * **Where to find it.** Each signing gives you one PDF. Find them under **Settings**, **Data processing**, **DPA documents**. ## Words on this page | Word | Meaning | | - | - | | **DPA** | Data Processing Agreement: the contract that says how Opper handles personal data for your organization. | | **Project DPA terms** | An add-on to the DPA for one project. They list the routes that project may use. The PDF calls them the "project addendum". An addendum is an add-on to an agreement. | | **Model access lock** | Holds one project to a fixed list of approved routes. Opper refuses calls to any other route. | | **Route** | One way to reach a model: the company that runs it and where inference runs. | | **In force** | A lock's status once every Opper server has confirmed it, usually under a minute after you lock a project. You can sign only against a lock that is In force. | | **Sub-processor** | A company Opper uses to process your data, such as an AI provider. | | **Notice contact** | The email address where Opper sends formal notices about your DPA. | | **Execution reference** | A line on the cover sheet of the PDF. "Executed" means signed. It is the reference of your DPA, which starts with `DPA-`. | | **Parties** | The two sides of the agreement: your company and Opper. | ## Do I need to sign? Not for the DPA to apply. Signing gives you: * a signed copy of the DPA that names your company, and * signed project DPA terms that list the routes one project may use. To sign, you need: * the Owner role; * the **Control Plane** or **Enterprise** plan. Control Plane includes signed terms for one project at a time. Enterprise includes them for any number of projects; * a project with a Model access lock that is **In force**. ## What signing changes for a project The lock refuses calls outside it whether or not terms are signed. Signing adds these rules: | | Locked, no signed terms | Locked, with signed terms | | - | - | - | | A call to a route outside the lock | Refused | Refused | | Replace or update the lock | Allowed | Not allowed. **Replace lock** and **Update lock** are unavailable. | | Release the lock, or delete the project | See [Model access locks](https://docs.opper.ai/control-plane/rules/model-access-locks.md) | Only the Owner. This ends the terms. | | A provider changes a route in the lock in a way Opper classifies as material | The organization's recipients of model access lock emails get an email: the Owners, unless they were changed under **Settings**, **Notifications**. Calls to the route still go through. | Opper suspends the route for this project. From the date in the notice, calls to it are refused. See [When a route is suspended](#when-a-route-is-suspended). | | A call made with an organization key and no project header | Not covered by the lock | Not covered by the lock or the terms | A change is material when a fact the lock recorded about a route is no longer true, or is less protective. For example, the provider starts training on content. A change that keeps every recorded fact true, or makes it more protective, is not material. ## Who can do what | Action | Who | | - | - | | Sign the DPA and project DPA terms | The Owner | | Release a signed lock, delete its project, or cancel the plan while terms are signed | The Owner | | Change the company details | The Owner | | Change the notice contact | The Owner and Admins | | See **DPA documents** and **Settings**, and open the signed PDFs | The Owner and Admins | Developers and custom roles cannot see **DPA documents** or **Settings**. Opened directly, the pages say "DPA documents are restricted" and "DPA settings are restricted". To lock a project, see [Who can lock a project](https://docs.opper.ai/control-plane/rules/model-access-locks.md#who-can-lock-a-project). ## Sign ### Before you sign 1. [Lock the project](https://docs.opper.ai/control-plane/rules/model-access-locks.md#lock-a-project) and wait until the lock reads **In force**. 2. On Control Plane, check that no other project has active signed terms. If one has, the lock reads "The Control Plane plan includes project DPA terms for one project, and this organization has signed them. Enterprise includes them for any number of projects." If signing is refused with a message that ends "Replace the lock to record the current facts, then sign.", a route's facts changed after the lock was taken, or a route of the lock is suspended. Replace the lock, wait until it is In force, then sign. ### Steps **1. Open the project's lock** Open **Settings**, then **Data processing**, then **Model access locks**, and select the project's lock. Select **Sign DPA** if your organization has no signed DPA in force. Otherwise select **Sign project DPA terms**. The dialog is titled **DPA terms for** and the project's name. **2. Enter the details** The first time, enter your company's **Legal entity**, **Registration number** and **Registered address**, and an **Email for notices**. Later signings show these and do not ask again. Then enter the **Signatory name**, **Signatory title** and **Signatory email**. Your own email is filled in. Tick the box to confirm that you are authorized to sign for the company, then select **Continue**. **3. Review and sign** The dialog shows the whole document as it will be signed, marked Draft. You can also open or download the draft. Read it, then select **Sign DPA** or **Sign project DPA terms**. The dialog then reads **DPA signed** or **Project DPA terms signed**, with **View PDF**, **Download PDF** and **View approved providers**. If the document changes while the dialog is open, the dialog shows the new version to review first. If the lock is released or replaced, or is not In force any more, nothing is signed. Close the dialog and sign from the lock again. Other members see why they cannot sign: * **An Admin** reads "Only the organization's Owner can sign project DPA terms." **Copy link** copies a link to the lock to send to the Owner. * **Where signing is not turned on** for your organization, the lock reads "Project DPA terms are available on request." with **Contact us**. ## What you get ### One DPA, and terms for each project * **First signing.** Signs your organization's DPA and the first project's terms together, in one PDF. Your DPA gets a reference that starts with `DPA-`. The project's terms get one that starts with `ADD-`. * **Each later signing.** Adds terms for one more project, with a new `ADD-` reference. It does not sign a second DPA. Its PDF names the same `DPA-` reference. * **A new DPA version.** If Opper publishes a new version of the DPA, your next signing signs that version, with a new `DPA-` reference. Terms you signed before stay under the earlier DPA. * **A change of company details** ends your signed DPA, and your next signing signs a new one. See [Change your company details](#change-your-company-details). ### The signed PDF Each signing gives one PDF, named after the terms' reference, such as `opper-ADD-7K3M-Q9TX.pdf`. The PDF of the signing that also signs your DPA is titled **DPA and project DPA terms**. Later PDFs are titled **Project DPA terms**. Every PDF holds the full DPA text, so each one can be read on its own. In order: 1. **Cover sheet.** The parties, what is signed, and the signatures. "Execution reference" is the `DPA-` reference of your DPA, and "Addendum reference" is the terms' `ADD-` reference. It names the DPA by the date it was last updated, with a link to that version. Göran Sandahl, CEO, signs for Opper. For your company it shows the signatory, the email for notices, the signing time and the IP address the signing came from. 2. **Part 1, the DPA**, at the version signed. 3. **Part 2, the project addendum**: the project DPA terms. 4. **Annex 1, Locked service routes**: the lock's routes, each with the company that runs it, its legal entity, where inference runs, and a short summary of its terms, such as "No training. No logging." The full facts of each route follow the table. Every page shows the document's hash and its page number. A hash is a fingerprint of the document: it lets you match each page to the document it came from. The signed PDF is the draft you reviewed, without the Draft mark, with the signing on the cover sheet. It is stored once, so every download is the same file. ### What the project DPA terms say Read the terms in Part 2 of the PDF. In plain words: | Section | What it says | | - | - | | 1 | Who the parties are, and the one project the terms cover. | | 2 | The project may use only the routes in Annex 1. Opper refuses calls to any other route. | | 3 | For this project, the terms take priority over section 4.2 of the DPA, the section about the AI providers you choose. The rest of the DPA applies as written. | | 4 | When the terms start and when they end. See [What happens when](#what-happens-when). | | 5 | What happens when a route's facts change. See [When a route is suspended](#when-a-route-is-suspended). | | 6 | Annex 1 is part of the terms. | Sections 4.2 and 5 mention amendments, changes signed to the terms themselves. The platform does not offer amendments. See [Change the providers for a signed project](#change-the-providers-for-a-signed-project). ## Find your documents **DPA documents** under **Settings**, **Data processing** lists every set of project DPA terms, newest first, with **Reference**, **Project**, **Status**, **Lock**, **Signed by**, **Legal entity** and **Signed**. Select a row to see its details: the DPA it is signed under, who signed it, any **Suspended route**, its **Notices**, and **View PDF**, **Download PDF** and **Open lock**. Your DPA has no row of its own. It is Part 1 of every PDF. Its `DPA-` reference shows in each row's details, and under **Settings**, **Company**. Both name your DPA by the date it was last updated, as the PDF does, such as "Last updated 2026-09-23". **Status** is **Active** or **Ended**. Ended terms show when they ended and why: **Lock released**, **Project deleted**, **Plan downgraded**, **Plan changed**, **Company details changed** or **Ended by Opper**. Their PDF can still be downloaded. The project's lock shows its terms too. Its **Project DPA terms** row reads, for example, "Signed · ADD-7K3M-Q9TX · Nov 11, 2026", with the PDF, **Open in DPA documents** and the notices. **Settings** under **Data processing** has three parts: * **Company**: the company your DPA names, and the reference of your DPA. Your first signing sets it. * **Sign again**: after a change of company details, each project whose terms ended, until it is signed again. * **Notice contact**: where notices go. Your first signing sets it from the **Email for notices**. The Owner or an Admin can change it and select **Save**. The change sends no email. PDFs already signed keep the address they printed. ## What happens when Each case says what ends, what stays and who is emailed. Opper gets a copy of every email. In every case the signed PDFs can still be downloaded. ### You release a signed lock Only the Owner can. The release dialog names the terms it ends. * **Ends:** the project's DPA terms. * **Afterwards:** the project has no lock. Its saved rules alone decide which models it can reach. * **Stays:** your DPA. * **Email:** **Project DPA terms ended** to your notice contact. ### You delete the project Only the Owner can, in the platform. The delete dialog names the terms it ends. The [Management API](https://docs.opper.ai/control-plane/management-api.md) refuses to delete such a project, with `409` and the code `model_access_lock_signed_addendum`. * **Ends:** the project's DPA terms, and its lock. The lock stays in the list, marked Project deleted. * **Stays:** your DPA. * **Email:** **Project DPA terms ended** to your notice contact. ### You cancel your plan **Cancel plan** under **Settings**, **Billing & Credits** moves your organization to Gateway, a plan without locks. While terms are signed, only the Owner can, and the dialog names the terms it ends. Opper can also move your organization to a plan without locks, with the same result. * **Ends:** every set of project DPA terms, and every lock. * **Afterwards:** your organization is on Gateway, with no rules and no Model access locks. * **Stays:** your DPA. * **Email:** one **Project DPA terms ended** for each set, to your notice contact. ### Opper moves you from Enterprise to Control Plane Only Opper makes this change. * **Ends:** every set of project DPA terms. * **Stays:** the locks, and your DPA. * **Afterwards:** the Owner can sign again for one project, against its lock. * **Email:** one **Project DPA terms ended** for each set, to your notice contact. ### You change your company details See [Change your company details](#change-your-company-details). * **Ends:** your signed DPA and every set of project DPA terms. * **Stays:** the locks. * **Email:** one **Company details changed** email to your notice contact. It lists everything that ended. ### Opper ends the terms or releases the lock Opper sends a notice with the date and the reason. The notice is the email. When Opper ends the terms without releasing the lock, the lock stays. ### Your organization is deleted Every set of project DPA terms ends. No email is sent. ## Change your company details Your DPA and every set of project DPA terms name your company. When the company details change, they end, and you sign new ones for the new details (section 4.2 of the project DPA terms). **1. Open Settings** Open **Settings**, then **Data processing**, then **Settings**, and select **Change company details**. Only the Owner sees the button. **2. Enter the new details** Enter the new **Legal entity**, **Registration number** and **Registered address**, then select **Continue**. **3. Confirm what ends** The dialog lists what ends when you save, by reference, and the notice contact the email goes to. Confirm that you are authorized to end these documents, then select **End DPAs and save**. After you save: * **DPA documents** lists the terms as **Ended**, with the reason **Company details changed**. The PDFs keep the company they printed. * The locks stay. Each project is still held to its lock, but has no signed terms until you sign again. * Until you sign again, the DPA keeps applying through the Terms of Service or your customer agreement, as it does for any customer that has not signed. * **Sign again** under **Settings** lists each project. Select **Sign DPA** on one. That signing signs a new DPA for the new company, together with that project's terms. After that, the other projects show **Sign project DPA terms**. You can sign against the same lock. If nothing is signed when you change the details, nothing ends, and your next signing names the new company. Before your first signing there are no company details to change. ## Change the providers for a signed project A lock with signed terms cannot be replaced or updated. The lock's **Signing details** read "To change the approved providers, end the current terms, then lock and sign again." 1. Change the project's [Model access](https://docs.opper.ai/control-plane/rules/model-access.md) rules and save them. 2. [Release the lock](https://docs.opper.ai/control-plane/rules/model-access-locks.md#release-a-lock). Only the Owner can. This ends the terms. 3. Lock the project again. The new lock is taken from the saved rules. 4. Once the new lock is **In force**, sign project DPA terms against it. If the new rules allow none of the routes in the current lock, saving them is refused while the lock holds. In that case, release the lock first, then change and save the rules, then lock the project and sign again. From the release until the new lock is **In force**, the project has no lock, and its saved rules alone decide which models it can reach. It has no signed terms until you sign again. ## When a route is suspended Section 5 of the project DPA terms covers a change to a route's facts. Opper decides whether the change is material. When it is: * Opper suspends the route for the project, and sends a **Route suspended** notice with the date. * From that date, calls from the project to that route are refused. The lock's other routes keep working. The terms and your DPA stay in force. * The lock's **Route changes** list the route as **Route suspended**. In **DPA documents**, the terms list each **Suspended route** with its date. Section 5 lets you amend the terms to accept the change or leave the route out. The platform does not offer amendments. To use the route with its new facts, sign again: see [Change the providers for a signed project](#change-the-providers-for-a-signed-project). If Opper lifts the suspension, you get a **Suspension lifted** notice, and calls to the route are allowed again from its date. ## Notices and emails Opper sends formal notices under your DPA. Each notice is listed under **Notices** in the details of the terms it concerns, in **DPA documents** and on the project's lock, and is emailed to your notice contact. | Notice | When | | - | - | | **Route suspended** | Opper classifies a change to a route of the lock as material. The notice gives each changed fact, as signed and as it is now, and the date from which calls are refused. | | **Suspension lifted** | Opper lifts a suspension. The notice gives the date calls are allowed again, and the reason. | | **Ended by Opper** | Opper ends a set of project DPA terms. The lock stays. The notice gives the date and the reason. | | **Lock released by Opper** | Opper releases a signed lock, which ends its terms. The notice gives the date and the reason. | | **Sub-processor added** or **Sub-processor replaced** | Opper adds or replaces a sub-processor of the platform (section 4.4 of the DPA). It takes effect at least 30 days after the notice. It is listed with every set of project DPA terms under the DPA. | | Email | When | Sent to | | - | - | - | | **Project DPA terms signed** (its subject starts "DPA signed for" when the signing also signed your DPA) | The Owner signs | The signatory and the notice contact. When they are the same address, it gets one email. | | **Project DPA terms ended** | Terms end, except when the company details change, when Opper ends them, and when the organization is deleted | The notice contact | | **Company details changed** | A change of company details ends your DPA | The notice contact | | **DPA notice** | Opper gives a notice | The notice contact | Opper gets a copy of every DPA email. None can be turned off. ## FAQ > [accordion] Do I have to sign the DPA in the platform? > > No. The DPA applies through the Terms of Service or your customer > agreement. Signing gives you a signed copy with your company's details, > and it is how you sign project DPA terms. > [accordion] Does signing change what my project can call? > > Calls outside the lock are refused with or without signed terms. With > signed terms, Opper suspends a route after a material change, and the > lock cannot be replaced or updated until the terms end. See > [What signing changes for a project](#what-signing-changes-for-a-project). > [accordion] Do I get a second DPA for each project? > > No. Your organization signs the DPA with its first project's terms. > Later signings add terms under that DPA. Every PDF repeats the full DPA > text so it can be read on its own, but it names the same `DPA-` > reference. You sign a new DPA only after a new DPA version or a change > of company details. > [accordion] Can I sign for several projects? > > On Enterprise, yes, one set of terms per project. On Control Plane, one > project at a time: end the active terms before you sign for another > project. > [accordion] Our company name or address changed. What do we do? > > The Owner changes the company details under **Settings**, **Data > processing**, **Settings**. This ends your signed DPA and every set of > project DPA terms. Then sign again for each project. See > [Change your company details](#change-your-company-details). > [accordion] Who can see the signed documents? > > The Owner and Admins. Developers and custom roles cannot. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.