Data processing agreement (Art. 28 GDPR)

Subject

We process customer content (technical files, machine data, decisions) on behalf of the customer, for the duration of the contract, only to provide the service.

Instructions and confidentiality

We act only on documented instructions. Staff with access are bound by confidentiality.

Security (Art. 32)

Tenant isolation on every request with role checks covered by automated tests; append-only hash-chained audit trail with external anchoring; hashed portal tokens with mandatory expiry; rate limiting; strict content security policy; uploads validated by content and quarantined.

[Encryption at rest, backups, access management, incident response — to be completed by the operator.]

Subprocessors

Listed on the subprocessors page. We inform customers [30 days] before adding one; customers may object.

Assistance and breaches

We help with data-subject requests (self-service export/erasure) and notify personal data breaches without undue delay, at the latest within [48] hours.

End of processing

On termination the customer can export all data; we then delete it, including backups within [period].