Data processing addendum

This Data Processing Addendum ("DPA") forms part of the agreement between DevPulse and the customer, and applies when we process personal data in Customer Data on the customer's behalf. The customer is the controller and we are the processor. Where the customer is itself a processor, we are its subprocessor.

Subject matter and duration: providing the service for the term of the agreement.

Nature and purpose: hosting, storage, analysis and display of Customer Data as directed through the service.

Data subjects: the customer's end users, employees and contacts.

Categories of data: identifiers, contact details, device and usage data, and any other data the customer sends.

We process personal data only on the customer's documented instructions, which are the agreement, this DPA and the customer's use of the service. We'll tell the customer if we believe an instruction breaks data protection law.

Everyone at DevPulse with access to personal data is bound by confidentiality.

We help the customer respond to data subject requests, mainly through the service's export and deletion features, and with impact assessments and consultations with regulators, where reasonable.

Encryption: TLS for data in transit; AES-256-GCM field encryption at rest for secrets, credentials and contact data, with key rotation.

Access control: role-based access with least privilege; optional organization-wide 2FA, SSO, SCIM, session limits and IP allowlists; scoped, short-lived API tokens.

Isolation: every request is authorized against the organization and project it touches; user-authored content is served sandboxed; outbound requests are protected against SSRF.

Monitoring: audit logging of security-relevant actions, with export and SIEM streaming; rate limiting on sign-in and public endpoints.

Resilience: managed database with automated backups; documented incident response.

The customer authorizes the subprocessors listed below. We impose data protection terms on each that are at least as protective as this DPA, and remain responsible for their performance.

We'll give at least 30 days' notice of a new subprocessor by updating this page and emailing account owners. The customer may object on reasonable data protection grounds; if we can't resolve the objection, the customer may terminate the affected service and receive a prorated refund.

We'll notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the breach, its likely consequences and the measures taken, as far as that information is available.

Where Customer Data subject to EU, EEA, Swiss or UK data protection law is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, or Module 3 where the customer is a processor) and the UK Addendum are incorporated by reference.

On request, once a year, we'll provide information reasonably needed to show compliance with this DPA, such as security documentation and third-party reports when available. Where that isn't enough, the customer may audit at its own cost, with 30 days' notice, during business hours and under confidentiality.

During the term, the customer can export and delete Customer Data through the service. Within 30 days after the agreement ends we delete Customer Data, except where the law requires us to keep it. Backups expire within a further 30 days.

This DPA applies automatically as part of the terms. If you need a countersigned copy, email [email protected].