Blame · Line-by-line history

`DPA_TEMPLATE.md`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

DPA_TEMPLATE.mdBlame200 lines · 1 contributor

Normal view Raw

1e79799CC LABS App	1	# Data Processing Addendum (DPA)
	2
	3	> Status: TEMPLATE. This is a starting point for a Data Processing
	4	> Addendum to be entered into between gluecron (the "Processor") and an
	5	> enterprise customer (the "Controller"). It is structured around GDPR
	6	> Article 28 and references the gluecron Terms of Service and Privacy
	7	> Policy by incorporation.
	8	>
	9	> DO NOT SIGN THIS WITHOUT LAWYER REVIEW. This template aims to be
	10	> legally literate but is not legal advice. The first enterprise contract
	11	> must go through a qualified data protection lawyer in the relevant
	12	> jurisdiction(s).
	13
	14	---
	15
	16	## 1. Definitions
	17
	18	Terms used in this DPA have the meaning given in the GDPR (EU Regulation
	19	2016/679) and the UK GDPR. "Personal Data" means any information
	20	relating to an identified or identifiable natural person processed under
	21	the Service. "Processing" means any operation performed on Personal
	22	Data. "Customer Data" means Personal Data that the Controller
	23	uploads to or generates within the Service.
	24
	25	## 2. Scope and roles
	26
	27	- gluecron acts as a Processor with respect to Customer Data.
	28	- The Controller is the gluecron customer (a company, organisation, or
	29	individual) who determines the purposes and means of processing.
	30	- This DPA governs all Customer Data processed by gluecron under the
	31	Service Agreement.
	32
	33	## 3. Subject matter, duration, nature, and purpose of processing
	34
	35	- Subject matter. Provision of source-code hosting, code
	36	intelligence, CI/CD, project management, and related services
	37	(the "Service").
	38	- Duration. The term of the Service Agreement, plus any post-
	39	termination retention period set out in §10 below.
	40	- Nature. Storage, transmission, computation, indexing, AI-driven
	41	analysis, backup, and presentation of Customer Data.
	42	- Purpose. Delivery of the Service ordered by the Controller.
	43
	44	## 4. Types of personal data and categories of data subjects
	45
	46	- Categories of data subjects. The Controller's employees,
	47	contractors, end-users, and anyone whose data the Controller chooses
	48	to upload.
	49	- Types of personal data routinely processed:
	50	- Account identifiers (name, email, username)
	51	- Authentication metadata (hashed passwords, passkey public keys,
	52	TOTP secrets)
	53	- Source code content (which may incidentally include personal data
	54	embedded in comments, fixtures, or test data)
	55	- Commit metadata (author name, email, timestamps)
	56	- Audit / activity log entries (IP address truncated by SHA-256, user
	57	agent, action verb)
	58	- Email content for notifications sent through the Service
	59	- Special category data. None routinely. The Controller MUST NOT
	60	upload special-category data (Article 9 GDPR) or criminal-offence
	61	data (Article 10) without first executing a separate written
	62	amendment to this DPA.
	63
	64	## 5. Processor obligations
	65
	66	gluecron shall:
	67
	68	1. Process Customer Data only on documented instructions from the
	69	Controller. The Service Agreement and the configured product
	70	settings constitute such instructions.
	71	2. Ensure that persons authorised to process Customer Data have
	72	committed to confidentiality or are under statutory confidentiality
	73	obligations.
	74	3. Implement appropriate technical and organisational measures to
	75	protect Customer Data, as further described in Annex A.
	76	4. Engage sub-processors only as permitted under §8.
	77	5. Assist the Controller in responding to data-subject requests
	78	under Articles 12 – 22 GDPR via the Service's export, deletion, and
	79	audit-log APIs.
	80	6. Notify the Controller without undue delay (and in any case
	81	within 48 hours of becoming aware) of any Personal Data Breach,
	82	including the nature of the breach, categories and approximate
	83	number of data subjects and records affected, likely consequences,
	84	and measures taken or proposed.
	85	7. Assist the Controller with Data Protection Impact Assessments
	86	(Article 35) and prior consultations with supervisory authorities
	87	(Article 36), to the extent reasonably required and at the
	88	Controller's expense beyond commercially reasonable assistance.
	89	8. Delete or return all Personal Data at the end of the Service
	90	Agreement under §10.
	91	9. Make available all information necessary to demonstrate compliance
	92	with Article 28 GDPR and allow for and contribute to audits as set
	93	out in §9.
	94
	95	## 6. Controller obligations
	96
	97	The Controller represents and warrants that:
	98
	99	1. It has a lawful basis under Article 6 GDPR (and, where
	100	applicable, Article 9) for processing Personal Data using the
	101	Service;
	102	2. It has provided required privacy notices to data subjects;
	103	3. It will not upload data the Service is not designed for (e.g. unique
	104	patient health records, raw payment card numbers).
	105
	106	## 7. Security measures
	107
	108	gluecron shall maintain the technical and organisational measures
	109	described in Annex A (Security Measures). Without limiting Annex A,
	110	gluecron commits to:
	111
	112	- Encryption of Customer Data in transit (TLS 1.2 or higher)
	113	- Encryption of Customer Data at rest where the underlying storage
	114	layer supports it (Neon Postgres, S3-compatible object stores)
	115	- Bcrypt/Argon2 hashing of user passwords; never stored in cleartext
	116	- Sub-processor list maintained under §8 and Annex B
	117
	118	## 8. Sub-processors
	119
	120	The Controller grants gluecron general written authorisation to engage
	121	sub-processors. gluecron maintains the current sub-processor list at
	122	Annex B and shall notify the Controller of any intended changes
	123	giving the Controller the opportunity to object on reasonable grounds
	124	within 30 days. Sub-processor commitments shall be no less protective
	125	than those in this DPA.
	126
	127	## 9. Audit rights
	128
	129	Once per year, with at least 30 days' written notice, the Controller
	130	(or a mutually agreed independent auditor under NDA) may audit
	131	gluecron's compliance with this DPA. The Controller shall bear the
	132	cost of such audit except where it identifies material non-compliance.
	133
	134	## 10. Return or deletion of data
	135
	136	Upon termination of the Service Agreement, gluecron shall, at the
	137	Controller's election: (a) return all Customer Data, or (b) delete all
	138	Customer Data and certify deletion in writing. Backups containing
	139	Customer Data shall be deleted in the ordinary course no later than
	140	90 days after termination.
	141
	142	## 11. International transfers
	143
	144	Where Customer Data is transferred outside the EEA / UK, gluecron and
	145	the Controller shall enter into the EU Standard Contractual Clauses
	146	(Commission Decision (EU) 2021/914) and the UK International Data
	147	Transfer Addendum where applicable, which are hereby incorporated by
	148	reference.
	149
	150	## 12. Liability
	151
	152	Liability under this DPA is subject to the limitations of liability set
	153	out in the Service Agreement. Nothing in this DPA limits liability that
	154	cannot be limited by law.
	155
	156	## 13. Governing law
	157
	158	This DPA is governed by the law of the [CUSTOMER’S JURISDICTION].
	159	Disputes shall be resolved as set out in the Service Agreement.
	160
	161	---
	162
	163	## Annex A — Security Measures (summary)
	164
	165	gluecron implements, at minimum, the following measures:
	166
	167	- Access control — unique user IDs, password complexity, optional
	168	TOTP / passkeys, OIDC SSO; least-privilege RBAC enforced server-side
	169	- Network — TLS 1.2+ for all external traffic; HSTS; defence-in-
	170	depth at reverse proxy + application layers
	171	- Application — input validation, parameterised queries, CSP,
	172	CSRF protections, rate limiting, request-ID tracing
	173	- Storage — encrypted at rest by underlying provider (Neon, S3);
	174	separation of database and object-store credentials
	175	- Vulnerability management — dependency scanning, secret scanning,
	176	AI-assisted security review on every push, security advisories
	177	- Backups — daily Postgres dumps with monthly restore drills (per
	178	`docs/BACKUP_RESTORE_DRILL.md`); 90-day backup retention
	179	- Logging — audit log of write actions (user / action / target),
	180	application logs with request IDs, error tracking via
	181	`ERROR_WEBHOOK_URL` / `SENTRY_DSN`
	182	- Incident response — documented 48-hour notification commitment;
	183	AI-assisted incident responder opens an issue on deploy failure
	184
	185	## Annex B — Sub-processor list
	186
	187	_To be completed before signing. Current candidates:_
	188
	189	\| Sub-processor \| Purpose \| Location \| Safeguard \|
	190	\|---\|---\|---\|---\|
	191	\| Neon \| Primary Postgres database \| US / EU regions \| SCCs + DPA \|
	192	\| Anthropic \| AI model inference (Claude) \| US \| SCCs + DPA + zero-retention API \|
	193	\| Vultr \| Hosting (bare-metal VPS) \| Region selected per customer \| SCCs \|
	194	\| Resend \| Transactional email (optional) \| US / EU \| SCCs \|
	195	\| Sentry \| Error tracking (optional) \| US / EU \| SCCs \|
	196
	197	## Annex C — Contact
	198
	199	- Data Protection Officer / Privacy contact: privacy@gluecron.com
	200	- Security incident reporting: security@gluecron.com