Data processing agreement

Last updated 2026-10-12 · Article 28 GDPR

This agreement is part of the terms of service. It applies when [Company name]("processor") processes personal data on behalf of the customer ("controller") through Tramontane.

1. Subject and duration

Hosting, building and serving the controller's applications, for as long as the controller uses the service.

2. Data and people concerned

Whatever the controller's applications process (chosen by the controller), and request and CDN logs of their visitors (path, status, timing; IP addresses anonymized), kept 30 days.

3. Processor's obligations

• Process only on the controller's documented instructions: these terms and the controller's use of the service.
• People with access are bound to confidentiality.
• Security: encryption in transit, secrets encrypted at rest, isolation between customers' sites, access limited to what is needed, backups.
• Notify the controller of a personal data breach without undue delay, and within 48 hours of becoming aware of it.
• Help the controller answer data subjects' requests and with impact assessments, as far as the service allows.
• At the end of the service, delete the data (backups expire within 14 days), unless the law requires keeping it.
• Make available the information needed to show compliance, and allow audits with reasonable notice.

4. Subprocessors

The controller authorizes the listed subprocessors. Changes are announced 30 days ahead; the controller can object and end the service. Each subprocessor is bound by equivalent obligations.

5. Location

Data is processed in the European Union. No transfer outside it, except to GitHub when the controller connects it.