Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Terms between Auterim and the customer that holds an Auterim workspace. It applies when Auterim processes personal data on the customer's behalf in providing the service, and data protection law such as the EU or UK GDPR applies to that processing.

It takes effect when the customer accepts the Terms. A countersigned copy is available on request from support@auterim.com.

The customer is the controller of personal data in its workspace, and Auterim is its processor. Auterim is a controller only for the account, billing, security and support information described in the Privacy Policy.

Auterim processes customer personal data only on the customer's documented instructions. The Terms, this DPA and the customer's configuration of the service, such as the services it connects, are those instructions. Auterim will tell the customer if it believes an instruction breaks data protection law, and will not use customer personal data for any other purpose, including training models.

• Subject matter and purpose. Monitoring the external services a customer depends on, assessing changes for impact, and preparing fixes and alerts for review.
• Duration. For as long as the customer uses the service, then until deletion as set out in Deletion and return.
• Data subjects. The customer's workspace members, and people whose names or handles appear in sources the customer connects, such as commit authors.
• Categories of data. Names, email addresses, workspace roles, connection metadata, and limited personal data contained in connected repositories or tools.
• Special categories. None are required, and customers should not send them.

Everyone at Auterim with access to customer personal data is bound by confidentiality and has access only as far as their work requires.

Auterim keeps technical and organisational measures appropriate to the risk, including:

• Encryption in transit, and at rest at our hosting providers.
• Server-side authorization of every request and database access restricted per workspace.
• Connection credentials encrypted with keys held only by the application.
• Repository code tested only in an isolated runner that receives no credentials, from a bounded snapshot scanned for secrets.
• Least-privilege access for staff, and logs kept for security.

The Security page describes these measures in more detail.

The customer authorises Auterim to use the subprocessors listed on the Subprocessors page. Auterim binds each one to data protection terms that are at least as protective as this DPA, and stays responsible for their work.

Auterim tells workspace owners by email at least 30 days before a new subprocessor starts processing customer personal data. The customer may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the customer may end the affected service and receive a refund of prepaid fees for the remaining period.

Workspace data is stored in the European Union. Where a subprocessor processes personal data outside the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism.

Auterim helps the customer, taking into account the nature of the processing, to answer requests from data subjects, and with data protection impact assessments and consultations with supervisory authorities. Much of this is self-service: members can be removed, services disconnected and accounts deleted in Settings.

Auterim notifies the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting customer personal data. The notice describes what happened, the data and people likely affected, and the steps taken, and we keep the customer informed as we learn more.

The customer can export or delete its data while its workspace is active. When a workspace has had no active plan for 90 days, Auterim deletes its workspace data, as described in the Privacy Policy, unless the law requires us to keep it. Deletion from backups follows on the providers' normal backup cycle.

Auterim makes available the information needed to show compliance with this DPA. Where that is not enough, the customer may audit once a year, on 30 days' written notice, during business hours, under confidentiality and at its own cost, or through an independent auditor bound by confidentiality.

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.

For questions about this DPA or a countersigned copy, write to support@auterim.com.