Draft. These terms are written from our counsel's outline and are awaiting sign-off; we will publish the reviewed version before the public launch and record the version you accepted.
Data Processing Addendum
For customers who need us to process personal data on their behalf.
Version 2026-01-01
Roles
You are the controller of the personal data you put into the service; we are the processor. For end-to-end secrets our processing is of ciphertext we cannot read.
Instructions and confidentiality
We process only on your documented instructions. Everyone with access is bound by confidentiality, and staff access to production is logged with a reason.
Security
The measures described on the Security page, including encryption in the browser, encryption in transit and at rest, and destruction of ciphertext at the moment a secret is consumed.
Sub-processors and transfers
The published list, with notice before changes. Standard Contractual Clauses apply to transfers out of the EEA for workspaces in the United States region.
Where your data is
A Team workspace chooses its region when it is created: United States or European Union. A region is a separate deployment with its own database and its own object storage, and a workspace does not move between them. Nothing a workspace holds is copied to the other region, and a request that reaches the wrong region is answered with the address of the right one rather than with data.
Assistance and deletion
We help with data subject requests and with breach notification, and we delete or return your data at the end of the contract.