Skip to main content

Lambda DPA

Vendor: Lambda, Inc. ("Lambda Labs"), 2510 Zanker Rd, San Jose, CA 95131, US. Controller (us): Anilata AB (org.nr 559357-2281), Gothenburg, Sweden — trading as AceSense. Role: GPU inference — the live processor. Every uploaded video is processed on Lambda hardware. Status: 🔴 Draft request ready — not sent. Highest-priority compliance gap. One field left to populate: the Lambda account ID (Console → Settings; not exposed by the API). Owner: Ops / DPO.

:::danger This is the one that matters Lambda is not a peripheral vendor. Every single user upload is transferred to Lambda hardware in the United States and decoded there. There is currently no Art. 28 processing agreement and no Art. 46 transfer mechanism on file for it. See EU data residency below — the contractual position is materially worse than the technical one. :::

What Lambda's own terms already say​

These are quoted from Lambda's published documents and are the starting point for the request. They matter because two of them help us and one hurts.

SourceSaysEffect for us
ToS §5(c)"Where the Parties execute a Data Processing Agreement ("DPA"), the DPA shall be hereby incorporated by reference herein and become a part of this Agreement."A DPA is contemplated and slots into the existing agreement. But until one is executed, no Art. 28 terms apply at all.
Privacy policy"We rely primarily on the European Commission's Standard Contractual Clauses to facilitate the international and onward transfer of personal information collected in the European Economic Area"SCCs are Lambda's own stated mechanism. Art. 46 is therefore a request, not a negotiation.
Privacy policy"In providing our Services to subscribers of our Cloud … Lambda is a data processor as we process personal information on behalf and at the direction of the Clients."Lambda already self-describes as processor, so the controller/processor framing is agreed.
ToS §5(a)"Customer consents to the hosting of Customer Property in, and transfer of Customer Property into, the United States" — and, unless the Order Form says otherwise, Lambda "may transfer and store Customer Property in other geographic regions or jurisdictions at its sole discretion."🔴 The problem. Our current contract lets Lambda move uploaded video to any jurisdiction at will.

The residency problem​

The "sole discretion" wording in §5(a) is sharper than the missing DPA, because it defeats any statement we make to users about where their video is processed. Technically we pin work to three named US regions; contractually Lambda is free to move it anywhere.

The ToS itself supplies the lever — the clause is prefixed "Unless otherwise agreed in writing between the Parties in the Order Form". So the fix is an Order Form region restriction, requested in the same thread as the DPA, not a separate negotiation.

Lambda also publishes no sub-processor list (colocation providers, DC operators), which is an Art. 28(2)/(4) gap we must close by asking.

Processing we ask them to cover​

  • Receipt of a signed download URL pointing at user-uploaded video held in Firebase Storage (europe-west1).
  • Download of the video onto Lambda instance-local disk (src/io/video_reader.py::download_video_from_url).
  • GPU processing — decode, pose estimation, court/ball/player detection, stroke classification.
  • Upload of the resulting analysis JSON and derived media back to Firebase Storage.
  • Persistent region filesystem (acesense-worker) in each region, which holds our code, python venv, model weights and our own worker service-account credential at mode 0600.

Retention — state this accurately​

Two different lifetimes, and the request must not blur them:

  • User video and derived artifacts: written to instance-local temp (tempfile.mkdtemp(prefix="acesense_output_")), then deleted in a finally block — os.remove(video_path) and shutil.rmtree(temp_output) (src/serverless/job_runner.py:385-404). Deletion is best-effort: a failure logs a warning rather than raising. Instances are terminated when idle, destroying local disk.
  • Region filesystem: persists across instances, but by design carries no user personal data — only code, venv, weights and our worker credential.

So the honest position is "no intended persistence of personal data beyond the job, on ephemeral instance-local storage, with a persistent filesystem that holds our credentials but not user content." Do not claim RunPod-style statelessness — Lambda instances and their filesystems are not stateless.

Data categories​

  • Raw sport video — includes the user's face and body, and potentially bystanders in frame.
  • Derived pose keypoints, ball/shuttle trajectory, court geometry, shot labels and timings.
  • Job and session identifiers.
  • Data subjects: our end users (≥16) globally, plus incidental third parties captured in frame.

Required clauses​

  1. Standard Contractual Clauses — EU Decision 2021/914, Module 2 (Controller → Processor), plus the UK International Data Transfer Addendum and the Swiss amendments (we market in Sweden and the EEA).
  2. Order Form region restriction overriding ToS §5(a) discretion — processing confined to the regions we name, with prior written notice before any change.
  3. Sub-processor list, including colocation and datacenter operators, plus 30-day notice of changes and a right to object.
  4. Encryption in transit and at rest, including instance-local scratch.
  5. Breach notification to us within 24 hours of discovery.
  6. Deletion or return of all personal data at end of services, with written attestation — explicitly covering instance-local disk and any snapshots or backups of the region filesystems.
  7. Confidentiality obligations for personnel with access, and a description of access controls for Lambda staff who can reach customer instances.
  8. Assistance with data-subject requests and with Art. 32–36 obligations.
  9. Audit rights, or an acceptable substitute (SOC 2 Type II / ISO 27001 under NDA).

Outbound request (ready to send)​

To: legal@lambda.ai
Cc: privacy@lambda.ai, dpo@acesense.io
Subject: Data Processing Agreement + SCCs and Order Form region restriction — AceSense (account <ACCOUNT_ID>)

Hello,

AceSense (operated by Anilata AB, org.nr 559357-2281, Gothenburg,
Sweden) operates an AI racket-sport coaching product. We use Lambda
Cloud GPU instances for inference on user-uploaded video, and we are
the controller for that personal data. Your privacy policy already
states that Lambda acts as a data processor for Cloud subscribers, so
we would like to put the corresponding paperwork in place.

Under GDPR Art. 28 (and UK-GDPR, Swiss FADP, and equivalent regimes) we
need an executed Data Processing Agreement. Per your Terms of Service
§5(c), an executed DPA is incorporated by reference into our
Agreement — we would like to do exactly that.

Processing detail:

- Lambda account ID: <ACCOUNT_ID>
- Regions in use: us-east-1, us-south-2, us-southeast-1
- Persistent filesystems: "acesense-worker" in each region above
- Categories of personal data: user-uploaded sport video (which may
  include facial images of the user and of incidental third parties),
  and derived pose keypoints, ball trajectory and shot metadata.
- Data subjects: our end users (aged 16+), globally, including in the
  EEA, UK and Switzerland.
- Data flow: video is stored in the EU (Google Cloud europe-west1),
  downloaded to a Lambda instance in the US for GPU processing, and
  the resulting analysis is written back to EU storage.
- Retention on your infrastructure: user video is written to
  instance-local temporary storage and deleted by our code at the end
  of each job; instances are terminated when idle. Our persistent
  region filesystems hold only our own code, environment and
  credentials — not user content.

Could you please provide:

1. Your standard DPA, or confirm you will execute ours.

2. EU Standard Contractual Clauses (Decision 2021/914), Module 2
   (Controller to Processor), together with the UK International Data
   Transfer Addendum and the Swiss amendments. Your privacy policy
   states you rely primarily on the SCCs, so we expect this is
   straightforward — please confirm they are incorporated into the DPA
   rather than only applying to your own controller-side processing.

3. An Order Form amendment restricting hosting and processing of our
   Customer Property to the three US regions listed above, with prior
   written notice before any change. We ask because ToS §5(a)
   currently permits transfer to other jurisdictions at Lambda's sole
   discretion "unless otherwise agreed in writing between the Parties
   in the Order Form" — we would like to make that written agreement.
   If EEA-region GPU capacity is available to us, we would also like a
   quote for it.

4. Your current list of sub-processors, including colocation and
   datacenter operators, and your notice period for changes.

5. Your latest SOC 2 Type II or ISO 27001 attestation under NDA, and a
   summary of the access controls governing Lambda personnel access to
   customer instances and attached filesystems.

6. Confirmation of your breach-notification commitment and target
   timeline.

Happy to work from your paper. Please treat this as time-sensitive: we
have EEA users today and this is our highest-priority open compliance
item.

Thanks,
— DPO, AceSense
On behalf of Anilata AB (org.nr 559357-2281), Gothenburg, Sweden
dpo@acesense.io

DPA signature block (for whichever paper is executed)​

Controller:  Anilata AB (org.nr 559357-2281)
             [registered address], Gothenburg, Sweden
             Trading as: AceSense
Signatory:   Akshay Sarode, Founder & CEO
Contact:     dpo@acesense.io

Processor:   Lambda, Inc.
             2510 Zanker Rd, San Jose, CA 95131, US

Fill the registered street address from the Bolagsverket record before countersigning; everything else in this block is confirmed.

Inbound response (to fill in once received)​

FieldValue
Date sent—
Date received—
Vendor DPA version—
SCC module confirmed—
UK Addendum / Swiss amendment—
Order Form region restriction agreed—
Sub-processor list received—
Countersigned by AceSense—
PDF pointercompliance/dpas/signed/lambda-dpa-YYYY-MM-DD.pdf (private drive)
Notable deviations from our asks—

Fallback​

If Lambda declines to execute a DPA, refuses SCC Module 2, or will not restrict regions in the Order Form:

  • Do not publish any EEA-residency or region-guarantee claim. The public copy was corrected on 2026-08-16 for exactly this reason; keep it corrected.
  • Assess whether continued EEA user onboarding is defensible without an Art. 46 mechanism, and take legal advice before scaling EEA marketing.
  • Evaluate alternatives with EU regions and an existing DPA — Google Cloud GPU (already covered by the Firebase/Google DPA), Scaleway, OVHcloud, or CUDO. Note the migration cost is real: the pull-worker pool is Lambda-shaped (region filesystems, fleet_sync, the scaler ladder).

Next action (Ops)​

  • Populate <ACCOUNT_ID> — Lambda Console → Settings (the API does not expose it; verified 2026-08-18).
  • Confirm the AceSense contracting entity — Anilata AB (org.nr 559357-2281), Gothenburg (done 2026-08-18; registered street address still to be pasted into the signature block from the Bolagsverket record).
  • Send the email to legal@lambda.ai.
  • Log the date sent in the inbound table.
  • On response: complete the table, file the PDF, flip status: to signed, and update README.md, ../dpa-requests.md, ../overview.md and ../dpia.md.