Contractual Addendum

Enterprise Data Handling Addendum

Effective April 18, 2026

Purpose

This addendum is a contractual companion to the Provara Privacy Policy. It codifies the data-handling commitments CoreLumen, LLC makes to Provara Enterprise customers regarding the adaptive routing signal. Where this addendum and the Privacy Policy overlap, this addendum governs for Enterprise customers.

Scope

This addendum governs the tenant-scoped storage, use, and isolation of quality signal derived from your traffic — specifically the model_scores, regression_events, and cost_migrations tables, and any derived in-memory state used by the router. It does not modify the Privacy Policy's treatment of prompts, responses, API keys, or account data.

Isolation defaults

For Enterprise tenants, the following are the default, contractually-bound settings. They remain in force unless explicitly opted out through the dashboard toggles or a written request from an authorized representative of the customer.

  • Isolated reads. The router consults only your tenant's routing matrix when picking a model. It does not fall back to the shared pool.
  • Isolated writes. Quality scores derived from your traffic update only your tenant's routing matrix. Your ratings do not contribute to the shared pool.
  • Isolated regression and cost-migration cycles. Silent-regression detection and cost-migration cycles scoped to your tenant's history; their outputs do not leak across tenant boundaries.

Opt-in pool interactions

Two per-tenant toggles are available in the dashboard Routing settings. Both default to off for Enterprise tenants.

Use pooled routing signal (read)

When on, the router consults the shared pool as a fallback for cells where your tenant's matrix is empty or sparse. Pool data is consulted at decision time only and is never copied into your tenant's matrix. Turning the toggle off is instant: subsequent routing decisions use only your tenant's data.

Contribute ratings to pooled signal (write)

When on, your ratings update the shared pool in addition to your tenant's matrix.

Irreversibility. Contributions to the shared pool merge into an exponentially-weighted moving average and cannot be retroactively removed. Turning this toggle off stops future contributions; past contributions remain in the pool. For Enterprise customers with compliance or data-lineage requirements, we recommend leaving this toggle off from day one.

Audit log

Every change to your routing isolation toggles is recorded in an append-only audit log with a timestamp, the actor who made the change, the previous value, and the new value. Upon written request to [email protected], we will provide a report of toggle changes for your tenant within ten business days.

Deletion on termination

On termination of an Enterprise agreement, and upon written confirmation from an authorized representative, CoreLumen will delete your tenant's routing data — the tenant-scoped rows in model_scores, regression_events, and cost_migrations, along with any in-memory derivatives — within thirty days.

If your tenant was opted in to pool contributions at any time during the agreement, contributions made during that window cannot be individually extracted from the shared pool, as described above.

Data residency

The Provara managed service and its adaptive-routing data are hosted in the United States. Additional region commitments are available under separate written arrangement.

Subprocessors

Adaptive routing data is processed only by the Provara gateway and database infrastructure operated by CoreLumen. It is not disclosed to, or made available to, any third party for any purpose.

Contact

For questions about this addendum or to exercise any right described above, contact [email protected].

Changes

Material changes to this addendum will be communicated to Enterprise customers at least thirty days before taking effect. Prior versions remain in force for contracts executed under them until the customer opts in to the new version.