Udio Data Processing and Security Schedule
Customer data handling security subprocessors incidents and data lifecycle
Udio WA Pty Ltd | ABN 38 166 661 945 | Version 1.1 | 27 October 2026
This Schedule forms part of the Agreement whenever Udio processes Customer Data to provide the Services. Capitalised terms not defined here have the meaning given in the Master SaaS Terms.
1. Scope priority and roles
1.1 This Schedule governs privacy, data protection and security matters. It prevails over an inconsistent provision in the Master SaaS Terms or another Service Schedule, unless an Order Form or special condition expressly states that it overrides this Schedule.
1.2 The Customer determines why Customer Data is collected and used and instructs Udio how it is processed through configuration and authorised use of the Services. Udio processes Customer Data to provide, secure and support the Services, follow authorised instructions, comply with law and investigate incidents.
1.3 Udio acts independently for its own account administration, billing, security logs, fraud prevention, legal compliance and defence of claims.
1.4 Each party must comply with privacy and data-protection laws applying to its activities. Udio will also apply the Australian Privacy Principles to Customer Personal Information processed under this Schedule, whether or not every principle would otherwise apply to Udio in a particular circumstance.
2. Data covered
2.1 This Schedule covers the following categories of Customer Data.
2.2 The Customer chooses which optional information it enters and must not collect more Personal Information than it reasonably needs. Full card numbers and card verification values are processed by the payment provider and must not be entered into Udio notes, support tickets, AI prompts or email.
3. Customer responsibilities
3.1 The Customer is responsible for:
- providing required privacy and collection notices and obtaining required consents or other lawful authority;
- ensuring that its instructions, communications and retention choices are lawful and appropriate, including for children and Sensitive Information;
- configuring roles and permissions, reviewing dormant accounts and promptly removing access no longer required;
- responding initially to requests from parents, participants, staff and other individuals and giving Udio information reasonably required to assist; and
- avoiding unnecessary Sensitive Information in ordinary email, support tickets and AI prompts.
4. Permitted processing
4.1 Udio will process Customer Data only to provide, operate, secure and support the Services; process authorised transactions and communications; use approved AI Functionality for the service purposes described in clause 11; follow authorised instructions; meet legal obligations; and investigate security, privacy, payment and operational incidents.
4.2 Udio will not use identifiable Customer Data for advertising, profiling, lead generation, market research or promotional communications without the Customer's written agreement and any required lawful authority.
4.3 Udio may create and use De-identified Data for service analytics, capacity planning, benchmarking, reporting and improvement, but must apply reasonable measures designed to prevent re-identification and must not attempt to re-identify it except to test those measures or where required by law.
4.4 If Udio reasonably believes an instruction would breach applicable law, Udio may decline or suspend the affected processing and will notify the Customer unless prohibited by law.
5. Personnel access and confidentiality
5.1 Udio restricts Customer Data access to authorised personnel and contractors with a legitimate operational need and access appropriate to their role.
5.2 People with access to Customer Data are subject to appropriate confidentiality, privacy and security obligations. Udio removes or changes access promptly when it is no longer required.
6. Security measures
6.1 Udio maintains technical and organisational measures proportionate to the Services and the nature of Customer Data, including:
- encryption in transit and at rest using provider-supported controls;
- named accounts, least-privilege access, multi-factor authentication for privileged access and controlled administrative connections;
- logical customer separation through account identifiers, authentication, authorisation and account-scoped application and API controls;
- logging, monitoring, security alerting and incident-response procedures;
- controlled development, change, release and vulnerability-management practices;
- protected and monitored backups, recovery procedures and restoration testing; and
- access review and prompt removal when access is no longer required.
6.2 Udio may change an individual control if it maintains a materially equivalent or stronger overall level of protection. Udio does not represent that it is ISO 27001 certified or that every incident can be prevented.
7. Hosting backups and recovery
7.1 Udio's Australian production environments are hosted in the AWS Sydney region. Its US production environment is hosted in AWS US East Northern Virginia (us-east-1). The Customer's account uses the applicable deployment, which Udio will identify on request. Snowflake and Udio's self-hosted analytics environment are hosted in Australia. Udio does not currently use cross-region replication for production backups. Other processing outside the primary application region is described in clauses 8 and 9.
7.2 Current backup controls include continuous database point-in-time recovery covering the preceding 28 days and daily protected copies of the production database and customer-uploaded files retained for 14 days in an AWS Backup Vault protected by Vault Lock. Udio monitors backup completion and failures.
7.3 Udio restores database point-in-time backups as part of operational recovery work and has performed broader infrastructure recovery exercises. Udio maintains and improves recovery procedures appropriate to its current architecture and tests material recovery processes at intervals proportionate to risk.
7.4 Udio's current internal recovery objectives are four hours for the production service and customer database and a 15-minute recovery point for the production database. They are planning objectives, not contractual guarantees or service levels unless expressly incorporated into an Order Form.
7.5 Customer Data is not maintained as a separately restorable tenant image. Where technically feasible, Udio may restore a recovery point into an isolated environment, identify affected records, extract and validate them, reintroduce them to production and reconcile later changes.
7.6 Reasonable recovery work is included where data loss is caused by Udio. Substantial recovery work caused by the Customer, an Authorised User or a customer-controlled integration may be charged at Udio's standard rates if Udio gives advance notice.
8. Subprocessors
8.1 The Customer authorises Udio to use the providers in the current subprocessor register for the stated purposes. Udio remains responsible for selecting and governing its subprocessors and requires contractual protections appropriate to the processing, including confidentiality, privacy, security, retention, deletion and incident-notification obligations.
8.2 Udio will maintain a current public subprocessor register and give at least 30 days' notice before a material new subprocessor begins processing Customer Data. The Customer may raise a reasonable data-protection objection before that period expires. Udio will work in good faith to resolve it.
8.3 If the parties cannot reasonably resolve an objection, the Customer may terminate the affected Service without future committed Fees. Where advance notice is not reasonably possible because of an urgent security or legal requirement, Udio may appoint the subprocessor and will give notice as soon as reasonably practicable.
9. Overseas processing and access
9.1 Customer Data is hosted in the applicable production deployment described in clause 7.1, including the United States for the US deployment. Approved providers may also process or access Customer Data outside Australia as described in the subprocessor register. Udio personnel ordinarily access work systems from Perth, Western Australia. Authorised access while travelling is subject to approved authentication and secure-access controls.
9.2 Udio limits information to what is reasonably required, applies contractual protections and need-to-know access, uses encryption where appropriate and reviews material provider changes. A provider's current disclosures are authoritative for its changing country and subprocessor footprint.
10. Security incident notification
10.1 A Qualifying Incident is an actual or reasonably suspected security incident, privacy breach, unauthorised access, disclosure or loss of Personal Information, data loss or material outage that materially affects Customer Data or use of the Services. Unsuccessful attacks and immaterial monitoring alerts are not Qualifying Incidents.
10.2 If Udio becomes aware of a Qualifying Incident during Business Hours, it will notify the Customer without undue delay and within four elapsed hours, even if that period ends after Business Hours. If Udio becomes aware outside Business Hours, it will notify the Customer by 7:00 am AWST on the next Business Day. Udio may notify earlier but is not contractually required to do so.
10.3 The notice will describe known facts, affected data or services, containment undertaken, action required from the Customer and the expected timing of the next update. Udio may provide information progressively and will not delay necessary containment or customer protection while investigating.
10.4 Each party remains responsible for legal notifications applying to it. Udio will reasonably assist with containment, evidence preservation, assessment of serious harm, remediation and legally required notifications. Where Udio has reasonable grounds to suspect an eligible data breach, it will conduct a reasonable and expeditious assessment and comply with the Notifiable Data Breaches scheme where applicable.
11. AI Functionality
11.1 At the date of this version, Udio's account-connected AI integration is available only to authorised Udio personnel through ChatGPT Work in Udio's business workspace. Udio uses it for customer support, account setup and administration, and analytics within the permitted purposes of providing the Services. It is not currently a customer-facing feature. The model used for a request may include an available Sol or Luna model. OpenAI is the approved AI provider; a model selection within ChatGPT Work is not a separate subprocessor.
11.2 Customer Data is retrieved through Udio's approved MCP integration when authorised Udio personnel invoke it for a permitted service purpose. Udio will limit retrieval and transmission to Customer Data reasonably required for that purpose. Udio does not continuously export, synchronise or create a separate general index of the Customer's account unless Udio first gives notice and obtains any required approval. Udio personnel must not paste or upload Customer Data separately into AI tools outside this approved workflow.
11.3 The integration must authenticate the invoking Udio staff member and enforce the access authorised for that person's role, task and applicable customer or facility scope. An approved shared or service connection must be limited to its documented purpose and audience. The current integration does not provide a connection for the Customer or arbitrary external AI tooling.
11.4 Prompts, retrieved Customer Data, tool inputs and results, outputs and execution records are Customer Data. Udio will not opt them into training of general or foundation models without the Customer's express written agreement and will require the approved provider not to use business data for such training by default. Those records remain subject to the applicable retention and deletion obligations in clause 13, including separate controls for copies held in AI conversations or files.
11.5 The current staff-only integration requires positive human confirmation before any write action. For a Material AI Action, Udio will present an appropriate preview or action summary and require positive confirmation. Any future exception for an approved automation requires the Customer's express configuration for that action category and is subject to clause 11.7. Udio will recheck permission at execution, keep an appropriate audit record and use controls designed to prevent duplicate execution. Udio may require additional approval or prohibit AI initiation for high-risk payment, refund, deletion, access-control or bulk-communication actions.
11.6 AI output may be inaccurate or incomplete and must be reviewed before material reliance. Udio remains responsible for secure integration, Udio-controlled permissions and accurate execution of a confirmed instruction. The Customer remains responsible for the lawfulness and substance of instructions given by its own Authorised Users. Udio remains responsible under the Agreement for instructions and actions of its own personnel.
11.7 Before introducing customer-facing account-connected AI or a material change to these processing purposes, Udio will provide appropriate prior information and obtain any required Customer agreement and individual consent or other lawful authority. Customer-facing AI, if introduced, must enforce the invoking Authorised User's customer, facility, role and permission scope. The Customer may disable customer-facing AI Functionality where Udio provides that control. This clause does not authorise unrestricted connection of external AI services.
12. Assistance and assurance
12.1 Udio will reasonably assist with privacy requests, correction, export, incident investigation and regulatory enquiries to the extent related to Udio's processing. Additional work outside standard functionality may be charged at Udio's standard rates if Udio gives advance notice.
12.2 Once annually, and after a material incident, the Customer may request Udio's then-current security policies, completed questionnaires, penetration-test summaries and other reasonable existing evidence. Udio need not disclose information that creates a security risk, breaches confidentiality or exposes another customer. An onsite audit or custom test requires separate agreement and may be charged unless required by law.
13. Export transition retention and deletion
13.1 During the Subscription Term and the 30-day transition period, the Customer may use available standard exports and APIs and may request a reasonable export of relevant Customer Data in a commonly usable machine-readable format. Udio does not promise that every category is exposed through every API endpoint.
13.2 At the end of the transition period, ordinary access is disabled. Udio will delete or robustly de-identify Customer Personal Information and content from active systems within the following 30 days unless legal retention applies.
13.3 Financial, invoice, transaction, security, audit, dispute and legal records may be retained for the applicable legal or operational period, with unnecessary Personal Information removed or de-identified where practicable. Genuinely De-identified Data and non-personal operational records may be retained.
13.4 Personal Information cannot ordinarily be selectively removed from immutable shared backups. After active-system deletion, daily protected copies expire through the 14-day cycle and database point-in-time recovery data through the 28-day cycle. Backups are inaccessible for ordinary use and may be accessed only for recovery, security investigation or legal compliance. If restored, applicable deletion and de-identification steps must be reapplied before ordinary use.
13.5 Where Udio provides participant-retention settings, the Customer may choose a shorter period for which an inactive person remains identifiable, subject to any maximum period or mandatory retention rule published by Udio. Until such functionality is available, the Customer may request deletion or de-identification through Udio support, subject to technical feasibility, legal retention and reasonable verification.
14. Liability and priority
14.1 Liability under this Schedule is subject to the Master SaaS Terms. An Order Form may provide a different or higher protection only if it expressly states that it overrides this clause.