CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
DPA.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| febd4f0 | 1 | # Gluecron Data Processing Agreement (Template) |
| 2 | ||
| 3 | **Last updated: April 21, 2026** | |
| 4 | ||
| 5 | > **Disclaimer:** This template is a starting point and not legal advice. Have | |
| 6 | > your counsel review and sign before relying on it. Square-bracketed fields | |
| 7 | > (`[LIKE THIS]`) must be filled in by the parties. | |
| 8 | ||
| 9 | ## 1. Parties | |
| 10 | ||
| 11 | This Data Processing Agreement ("DPA") is entered into between: | |
| 12 | ||
| 13 | - **Controller:** `[CUSTOMER LEGAL ENTITY NAME]` ("Customer"), the party that | |
| 14 | determines the purposes and means of processing personal data. | |
| 15 | - **Processor:** `[GLUECRON LEGAL ENTITY NAME]` ("Gluecron"), the party that | |
| 16 | processes personal data on the Customer's behalf. | |
| 17 | ||
| 18 | It supplements the Gluecron Terms of Service and takes effect on the date of | |
| 19 | the last signature below. | |
| 20 | ||
| 21 | ## 2. Subject Matter and Duration | |
| 22 | ||
| 23 | Gluecron processes personal data in order to provide git hosting, code | |
| 24 | intelligence, continuous integration, and related developer tools to the | |
| 25 | Customer ("Services"). Processing continues for the term of the underlying | |
| 26 | subscription and for up to thirty (30) days after termination, during which | |
| 27 | Customer may export data. After that, Gluecron deletes Customer data per the | |
| 28 | Privacy Policy's retention schedule. | |
| 29 | ||
| 30 | ## 3. Nature and Purpose of Processing | |
| 31 | ||
| 32 | Gluecron processes personal data solely to: | |
| 33 | ||
| 34 | - Host, store, transmit, and display Customer repositories and related content. | |
| 35 | - Authenticate users and maintain sessions. | |
| 36 | - Run code intelligence features (analysis, auto-repair, push risk review) | |
| 37 | where the Customer has enabled them. | |
| 38 | - Send transactional email (account, security, and activity notifications). | |
| 39 | - Diagnose abuse, fraud, and operational issues. | |
| 40 | ||
| 41 | Gluecron will not process personal data for its own marketing, advertising, or | |
| 42 | model-training purposes. | |
| 43 | ||
| 44 | ## 4. Types of Personal Data | |
| 45 | ||
| 46 | - **Account information:** username, email address, display name, bio. | |
| 47 | - **Authentication data:** hashed passwords, session tokens, SSH public keys, | |
| 48 | API tokens (hashed). | |
| 49 | - **Commit metadata:** author name and email, commit timestamps, refs. | |
| 50 | - **Git content:** any personal data embedded in source code, commit messages, | |
| 51 | issues, pull requests, or comments that Customer chooses to upload. | |
| 52 | - **Operational logs:** IP address, user agent, request timestamps (retained | |
| 53 | 90 days). | |
| 54 | ||
| 55 | ## 5. Categories of Data Subjects | |
| 56 | ||
| 57 | - Customer employees and contractors with Gluecron accounts. | |
| 58 | - External contributors who interact with Customer repositories (issues, | |
| 59 | pull requests, comments). | |
| 60 | - Individuals named in commit history or repository content. | |
| 61 | ||
| 62 | ## 6. Sub-processors | |
| 63 | ||
| 64 | Customer authorises the following sub-processors. Gluecron will give at least | |
| 65 | 30 days' notice of any additions or replacements. | |
| 66 | ||
| 67 | | Sub-processor | Purpose | DPA | | |
| 68 | | --- | --- | --- | | |
| 69 | | Neon (Databricks) | Managed PostgreSQL hosting | https://neon.tech/dpa | | |
| 70 | | Fly.io | Application hosting and container compute | https://fly.io/legal/dpa | | |
| 71 | | Anthropic | Code intelligence and AI review features | https://www.anthropic.com/legal/commercial-terms | | |
| 72 | | Voyage AI | Embeddings for semantic code search | https://www.voyageai.com/terms-of-service | | |
| 73 | | Resend | Transactional email delivery | https://resend.com/legal/dpa | | |
| 74 | ||
| 75 | ## 7. Security Measures | |
| 76 | ||
| 77 | - **In transit:** all client and sub-processor traffic is encrypted with TLS. | |
| 78 | - **At rest:** database storage is encrypted by Neon; bare git repositories | |
| 79 | reside on encrypted host volumes. | |
| 80 | - **Secrets:** passwords are hashed with bcrypt; API tokens and callback | |
| 81 | secrets are hashed with SHA-256; webhook payloads are signed with | |
| 82 | HMAC-SHA256. | |
| 83 | - **Access control:** production access is limited to named personnel, scoped | |
| 84 | to least privilege, and logged. | |
| 85 | - **Audit logging:** authentication, repository access, and administrative | |
| 86 | actions are logged and retained alongside operational logs. | |
| 87 | - **Backups:** routine encrypted backups with documented restore procedures. | |
| 88 | ||
| 89 | ## 8. Personal Data Breach Notification | |
| 90 | ||
| 91 | Gluecron will notify the Customer without undue delay and in any case within | |
| 92 | **72 hours** of becoming aware of a personal data breach affecting Customer | |
| 93 | data. Notice will include the nature of the breach, categories and approximate | |
| 94 | number of data subjects affected, likely consequences, and mitigation taken or | |
| 95 | proposed. | |
| 96 | ||
| 97 | ## 9. Data Subject Rights Requests | |
| 98 | ||
| 99 | Gluecron will assist Customer in responding to access, rectification, erasure, | |
| 100 | restriction, portability, and objection requests from data subjects. Customers | |
| 101 | should route requests to `privacy@[CUSTOMER DOMAIN]`; Gluecron staff contacted | |
| 102 | directly by a data subject will refer the individual to the Customer. | |
| 103 | ||
| 104 | ## 10. International Transfers | |
| 105 | ||
| 106 | Where personal data is transferred outside the EEA, UK, or Switzerland to a | |
| 107 | jurisdiction without an adequacy decision, the parties rely on the European | |
| 108 | Commission's Standard Contractual Clauses (2021/914), with the UK Addendum | |
| 109 | where applicable, which are incorporated into this DPA by reference. | |
| 110 | ||
| 111 | ## 11. Return or Deletion | |
| 112 | ||
| 113 | On termination of the Services, Gluecron will, at Customer's election, return | |
| 114 | or delete Customer personal data within 30 days, except where retention is | |
| 115 | required by law. | |
| 116 | ||
| 117 | ## 12. Sign-off | |
| 118 | ||
| 119 | **Customer (Controller):** | |
| 120 | ||
| 121 | - Entity: `[CUSTOMER LEGAL ENTITY NAME]` | |
| 122 | - Signatory: ______________________________ | |
| 123 | - Title: __________________________________ | |
| 124 | - Date: ___________________________________ | |
| 125 | ||
| 126 | **Gluecron (Processor):** | |
| 127 | ||
| 128 | - Entity: `[GLUECRON LEGAL ENTITY NAME]` | |
| 129 | - Signatory: ______________________________ | |
| 130 | - Title: __________________________________ | |
| 131 | - Date: ___________________________________ |