Legal
Data Processing Agreement
A Data Processing Agreement is executed as part of contracting. It is not published as a click-through document, because its terms depend on the engagement scope, the data involved, and the customer's own regulatory obligations.
Requesting the DPA
Prospective and current customers can request the current Data Processing Agreement for review at any point during diligence, including before any data is shared. Requests are handled by the Corporate Secretary.
What a reviewer should know before the DPA
Two things are stated publicly and do not require a contract to verify. First, the certification boundary: Qtonic Quantum Corp does not claim company-held SOC 2, ISO 27001, FedRAMP, CMMC, or equivalent certification, and says so on its trust pages rather than implying otherwise. Second, the evidence model: engagement outputs are cryptographically signed so a customer can verify an artifact independently rather than relying on assurance alone.
Neither replaces a DPA. They are stated here so a reviewer can assess the certification and evidence posture before contracting, instead of discovering it afterwards.