[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Flegal\u002Fdpa":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"dpa","Data Processing Agreement","Data Processing Agreement between Verestore and its customers (DRAFT under legal review).",true,"2026-11-04 (draft)","\u003Ch1>Data Processing Agreement\u003C\u002Fh1>\n\u003Cp>This Data Processing Agreement ("DPA") forms part of the \u003Ca href=\"\u002Flegal\u002Fterms\">Terms of Service\u003C\u002Fa> between \u003Cstrong>SerOps\u003C\u002Fstrong> ("Processor") and the customer ("Controller"). It applies where the Processor processes personal data on behalf of the Controller under the GDPR or equivalent laws.\u003C\u002Fp>\n\u003Ch2>1. Subject matter and duration\u003C\u002Fh2>\n\u003Cp>The Processor tests the restorability of the Controller's PostgreSQL backups. This processing lasts for the term of the agreement.\u003C\u002Fp>\n\u003Ch2>2. Nature and purpose\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Hosted runs:\u003C\u002Fstrong> the Processor downloads the newest backup from the Controller's storage, restores it into a temporary, isolated database, runs aggregate checks, and deletes the temporary environment at the end of the run.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Results:\u003C\u002Fstrong> results contain metadata (table names, row counts, checksums, timings), never row data.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>3. Categories of data and data subjects\u003C\u002Fh2>\n\u003Cp>Whatever personal data the Controller's backups contain (customers, users, employees). It is processed only \u003Cstrong>transiently\u003C\u002Fstrong>, inside a run, and never stored by the Processor beyond the run.\u003C\u002Fp>\n\u003Ch2>4. Processor obligations\u003C\u002Fh2>\n\u003Cp>The Processor shall:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>process personal data only on documented instructions (configuring a target and its checks is such an instruction);\u003C\u002Fli>\n\u003Cli>ensure its personnel are bound by confidentiality;\u003C\u002Fli>\n\u003Cli>implement the technical and organisational measures in Annex 1;\u003C\u002Fli>\n\u003Cli>assist with data-subject requests and with security and impact assessments, as far as possible given that it doesn't store backup contents;\u003C\u002Fli>\n\u003Cli>notify personal-data breaches without undue delay, and in any case within 48 hours of becoming aware;\u003C\u002Fli>\n\u003Cli>delete or return personal data at the end of the agreement.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>5. Sub-processors\u003C\u002Fh2>\n\u003Cp>The Controller authorises the \u003Ca href=\"\u002Flegal\u002Fsub-processors\">sub-processors listed here\u003C\u002Fa>. The Processor gives 30 days' notice of changes, during which the Controller may object. Sub-processors are bound by equivalent obligations.\u003C\u002Fp>\n\u003Ch2>6. International transfers\u003C\u002Fh2>\n\u003Cp>Backup contents are processed only in the EU (Scaleway, France). Any transfer of other personal data outside the EEA uses Standard Contractual Clauses.\u003C\u002Fp>\n\u003Ch2>7. Audits\u003C\u002Fh2>\n\u003Cp>The Processor makes available the information needed to demonstrate compliance: its security page, signed run evidence, and a summary of external security reviews. On-site audits may be agreed, with reasonable notice, at the Controller's expense.\u003C\u002Fp>\n\u003Ch2>Annex 1 — Technical and organisational measures\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A dedicated runner cluster, a namespace per run, the gVisor sandbox runtime enforced by an admission policy, the \u003Ccode>restricted\u003C\u002Fcode> Pod Security Standard, non-root read-only containers without capabilities.\u003C\u002Fli>\n\u003Cli>Deny-all network policies; egress only to DNS, the Controller's bucket hostname and the Processor's API.\u003C\u002Fli>\n\u003Cli>Temporary environments deleted at the end of every run; an orphan sweeper deletes anything older than its deadline plus 15 minutes.\u003C\u002Fli>\n\u003Cli>Read-only, prefix-scoped storage credentials, encrypted at rest with a key hierarchy whose master key is held in a secret manager. They are decryptable only by the orchestrator and never readable through the application.\u003C\u002Fli>\n\u003Cli>Results restricted by schema to metadata; secrets scrubbed from logs; result signatures and countersignatures.\u003C\u002Fli>\n\u003Cli>Encryption in transit (TLS) and at rest (database, object storage, Kubernetes Secrets).\u003C\u002Fli>\n\u003Cli>Least-privilege access, an audit log, and key rotation procedures.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Signature blocks:\u003C\u002Fstrong> [to be completed].\u003C\u002Fp>\n",1794290783586]