Data Processing Addendum

• You are the controller of the personal data in your Organization's Projects: data your apps hold, your logs, your environment variables and the details of your Members.
• Octabyte is your processor. We process that data only to run the hosted Cloudgate console for you.
• For your account and billing details, Octabyte is a controller in its own right, as our Privacy Policy explains.

We process personal data only as you instruct: through the console, the API, the command-line tool, your Agents, the Terms of Service and the signed addendum. If the law makes us do something else, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

Everyone at Octabyte who can reach your personal data is bound to keep it confidential. Our staff see an Organization's account details, not what is inside its Projects, unless you invite them in as a Member.

• HTTPS for every connection to the console, and session cookies sent only over HTTPS.
• Secrets, keys, tokens and credentials encrypted at rest with AES-256-GCM, and never shown back in full.
• Secrets masked out of every result an Agent receives.
• Roles and grants that limit each Member and Agent to what they need.
• An audit log of every change and every Agent call.
• Separation between Organizations on every request.

The signed addendum lists these measures in full.

You allow us to use the subprocessors on our subprocessors page. Each one is bound by terms that protect data at least as well as this addendum. We tell you before adding or replacing one, and you may object on reasonable data protection grounds. If we cannot resolve the objection, you may end the affected service.

We help you answer requests from people exercising their data protection rights, and, where needed, with data protection impact assessments and consulting a supervisory authority. Much of this you can do yourself in the console. If a request reaches us directly, we pass it to you.

If we become aware of a breach affecting personal data we process for you, we tell you without undue delay. We give you what we know about it, what we are doing about it, and what you need to meet your own duty to notify. We keep you updated as we learn more.

When your Organization is deleted, or 30 days after its plan lapses, we delete its secrets, keys, cloud credentials, configs and logs from the console. Before that you can take your settings with you, and the data on your own Servers and in your own cloud accounts is never touched.

We keep only what the law requires us to keep, such as billing records, and the audit log as our Privacy Policy describes.

On request, we give you the information you reasonably need to show that we meet this addendum. Where that is not enough, we allow a reasonable audit, on reasonable notice, at most once a year unless a regulator requires more or after a breach, and under confidentiality.

Where personal data leaves the UK or the European Economic Area, the signed addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, unless another lawful safeguard applies.

The signed addendum is available to customers on Business and Enterprise. If you are on Starter and need one, ask anyway. Email support@octabyte.io with your Organization's name and the legal name of your company, and we will send it for signature.