Data Processing Agreement

1. Customer as controller. For personal data contained in or arising from the Customer's servers, sites, databases, cloud and Git accounts, deployments, logs, tickets and organisation settings ("Customer Personal Data"), the Customer is the controller (or, where it acts for its own clients, a processor, and Spykra is then its sub-processor on the same terms).
2. Spykra as processor. Spykra processes Customer Personal Data only on the Customer's behalf and on its documented instructions, to provide SrvYard.
3. Spykra as controller. This DPA does not cover personal data for which Spykra is itself the controller: the data of the Customer's account holders and members that Spykra uses to run accounts, take payment (billing data held with Stripe), secure the service and communicate with them, and the data on the public website. That processing is described in the Privacy Policy.
4. Governing documents. This DPA is incorporated into the Terms of Service. If it conflicts with the Terms on the processing of personal data, this DPA prevails. Annexes I to III are part of it.
5. Applicable law. It applies to processing under the UK GDPR and the Data Protection Act 2018, and, where it applies to the Customer, the EU GDPR. "Data protection law" means those laws as amended. Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings those laws give them.

• Subject matter. Provision of SrvYard: a control panel that connects to the Customer's servers over SSH and to its cloud providers, Git hosts, DNS and storage providers, to install, deploy, configure, monitor and back up software on them, with a REST API, webhooks, notifications, support tickets and an assistant.
• Duration. From the date the Customer starts using the service until the agreement ends and Customer Personal Data has been deleted or returned under Return and deletion.
• Nature of the processing. Receiving, storing, transmitting, displaying, encrypting and deleting data; running commands and scripts on the Customer's servers and reading their output; generating logs, metrics and notifications; and, only when the Customer uses the optional AI features, sending limited text to AI providers.
• Purpose. To provide the service the Customer asked for, to support it, to keep it secure, and to meet the Customer's documented instructions. Spykra does not process Customer Personal Data for its own purposes, does not sell it, and does not use it to train AI models.

Annex I lists them in detail. In short:

• Data subjects: the Customer's members and invited people; the Customer's own clients and staff, and visitors and users of the Customer's sites, but only to the extent their personal data appears in what the service handles (for example in deployment logs, error output, ticket text or the output of commands); and people named in tickets or chat messages the Customer writes.
• Types of data: names, email addresses, IP addresses and technical identifiers; credentials and tokens the Customer provides (secrets, treated as confidential data); log and diagnostic output; and any personal data the Customer chooses to put in tickets, chat or attachments.

The Customer's site files and databases stay on its servers. SrvYard does not copy the content of the Customer's databases or files to its own systems: backups are made on the Customer's server and sent to storage the Customer supplies. The service is not designed for special category data or criminal-offence data, and the Customer should not send such data to Spykra in tickets or chat.

1. Spykra processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Documentation, and what the Customer configures or requests in the console and the API are its complete instructions at the start.
2. Further instructions need to be consistent with the service. If Spykra thinks an instruction infringes data protection law, it tells the Customer without delay and may suspend the instruction until the Customer confirms or changes it.
3. Spykra processes the data outside the instructions only where the law requires it, and then tells the Customer first unless the law forbids that.
4. The Customer is responsible for having a lawful basis for its processing, for the lawfulness of what it puts into the service, and for telling its own data subjects what they are entitled to be told.

Spykra ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality (by contract or by law), receives access only as far as their job needs, and can be identified in the audit trail. Staff access to a customer account is limited to named staff, is recorded with the staff member's name, and by default starts read-only (see Annex II).

Taking account of the state of the art, the costs, the nature, scope, context and purposes of the processing and the risk to individuals, Spykra implements the technical and organisational measures in Annex II and keeps them appropriate to the risk. Spykra may update them over time, as long as it does not materially reduce the overall level of protection.

1. General authorisation. The Customer authorises Spykra to use the sub-processors in Annex III.
2. Changes. Spykra will tell the Customer of any intended addition or replacement of a sub-processor at least 30 days before it starts processing Customer Personal Data, by email to the address on the account and by updating Annex III. The Customer may object on reasonable data protection grounds within that period. The parties will work in good faith to resolve the objection. If it cannot be resolved, the Customer may end the affected service on written notice, and Spykra will refund the unused part of any prepaid fee for it.
3. Flow-down. Spykra uses a written contract with each sub-processor that imposes data protection obligations no less protective than this DPA, and remains liable to the Customer for the sub-processor's performance as it is for its own.
4. Not sub-processors. The cloud, DNS, Git, storage and notification providers that the Customer connects are chosen by the Customer. SrvYard acts on them on the Customer's instruction, with the Customer's credentials, and they are not Spykra's sub-processors.

1. Spykra stores platform data in data centres in the UK and EU, and will not move it outside the UK and EEA except as this DPA allows.

2. The Customer's own data may be in any country the Customer chooses to provision servers in. That is the Customer's decision, not a transfer by Spykra.

3. Spykra's sub-processors for optional AI features, Anthropic and OpenAI, are in the United States. Stripe and Cloudflare operate globally. For a restricted transfer of Customer Personal Data to a sub-processor outside the UK and EEA, Spykra uses one of these mechanisms, as the law requires:

   • the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for transfers governed by the UK GDPR;
   • the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Three, processor to processor) for transfers governed by the EU GDPR; and
   • together with a transfer risk assessment and supplementary measures where needed (for example, the secrets removal and minimisation described in Annex II).

   The UK-US and EU-US data bridges under the Data Privacy Framework are available only as an additional mechanism and only where a sub-processor participates in them. Spykra does not state that any sub-processor participates unless it has checked.

4. Transfers from the Customer in the EEA to Spykra in the UK rely on the EU's adequacy decision for the UK. If it ceases to apply, the EU Standard Contractual Clauses, Module Two (controller to processor), are incorporated by reference, with the choices in the paragraph below, and the parties will sign them if asked.

5. Choices for the Standard Contractual Clauses. Clause 7 (docking) applies; in Clause 9, Option 2 (general authorisation) with a 30-day period; in Clause 11 the optional redress body does not apply; in Clause 17 and Clause 18 the law and courts of Ireland. The competent supervisory authority is that of the Customer's EU member state. Annex I to III of this DPA are the annexes of the Clauses.

1. Data subject requests. If a data subject writes to Spykra about Customer Personal Data, Spykra does not answer on its own behalf (unless the law requires) and forwards the request to the Customer without undue delay. Taking account of the nature of the processing, Spykra helps the Customer respond, by appropriate technical and organisational measures. The console and API already allow the Customer to export, correct and delete most data itself. Where it cannot, Spykra helps within a reasonable time, normally within 10 working days.
2. Security, DPIAs and consultation. Taking account of the nature of the processing and the information it has, Spykra assists the Customer with its obligations on security of processing, breach notification, data protection impact assessments and prior consultation of a regulator.
3. Costs. Assistance that the service provides as a feature is included. Spykra may charge reasonable costs for substantial extra assistance that goes beyond that, if it tells the Customer first.

1. Spykra notifies the Customer without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data, and aims to do so much sooner for a breach that is likely to put individuals at high risk.
2. The notice goes by email to the account owner and, for a serious incident, other contacts the Customer has given. It describes, as far as then known: the nature of the breach and the categories and approximate numbers of data subjects and records; the likely consequences; what Spykra has done and will do; and a contact for more information. Spykra may provide the information in phases.
3. Spykra takes reasonable steps to contain and investigate the breach, to limit harm and to prevent a repeat, and keeps a record of breaches. It does not notify a supervisory authority or data subjects of a breach affecting Customer Personal Data on the Customer's behalf unless the law or the Customer requires it; deciding whether and how to notify is the Customer's responsibility as controller.
4. A notice or a step taken under this clause is not an admission of fault or liability.

1. Spykra makes available to the Customer the information necessary to show that it complies with Article 28, including this DPA, the Security page, the Documentation and answers to reasonable written security questionnaires, no more than once a year.
2. If that does not satisfy the Customer, or a supervisory authority requires it, or a personal data breach has occurred, the Customer (or an independent auditor bound by confidentiality, that is not a competitor of Spykra) may audit Spykra's compliance on at least 30 days' written notice, during working hours, no more than once a year (except after a breach or where a regulator demands it), without interfering unreasonably with the business, and subject to Spykra's confidentiality and security rules. The scope is agreed beforehand. The Customer pays the cost of the audit.
3. Spykra has not been audited or certified against a security standard (such as ISO 27001 or SOC 2) and does not claim to be. The information provided under this clause describes how the service is built and run.

1. While the agreement lasts, the Customer can export and delete much of its data itself: a personal data export, organisation configuration exports (with or without secrets), the REST API, and deletion of servers, sites, organisations and its account.
2. When the agreement ends, Spykra stops connecting to the Customer's servers. Within 30 days of the Customer's written request after termination, Spykra deletes the Customer Personal Data it holds, or returns it in a structured, commonly used, machine-readable format if the Customer asks before deletion. If the Customer makes no request, Spykra deletes it when the organisation is deleted and in any case on the retention cycle in the Privacy Policy.
3. Copies in backups of the platform are removed on their normal rotation and are not used for any other purpose in the meantime.
4. Spykra may keep personal data where the law requires it (for example, accounting records), and only for as long, and then it protects it under this DPA.
5. The Customer must itself revoke tokens, keys and access it gave to SrvYard at its cloud, Git, DNS and storage providers and on its servers; Spykra cannot do this on the Customer's behalf once the agreement has ended.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, and amounts paid under this DPA count towards the same cap. Nothing in this DPA limits liability that cannot lawfully be limited, or a data subject's rights against either party under Article 82 of the UK GDPR or EU GDPR, or the rights of data subjects under the Standard Contractual Clauses.

1. This DPA lasts as long as Spykra processes Customer Personal Data for the Customer.
2. Spykra may update this DPA, and Annex III by the notice above, if the change is needed because of a change in the law or in the service. Material changes are notified with 30 days' notice as the Terms of Service describe. A new version number and effective date will appear at the top.
3. This DPA is governed by the law of England and Wales, and its courts have jurisdiction, except where the Standard Contractual Clauses require otherwise.
4. If part of it is unenforceable, the rest stays in force.

Each measure below is a feature of the software, as it behaves today. They are also explained, with links to the documentation, on the Security page.

Access control and authentication#

Encryption and secrets#

Network and application#

Logging, audit and staff access#

Organisational measures#

The measures protect the data held by SrvYard. Securing the Customer's servers, applications and data is the Customer's responsibility.

The Customer authorises these sub-processors of Customer Personal Data. The list is current as at the effective date at the top of this page.

Two other providers are not sub-processors of Customer Personal Data. Stripe processes the Customer's subscription payments; that data is Account and billing data for which Spykra is the controller, as the Privacy Policy explains. iDrive e2 (object storage) holds website and documentation images and receives no personal data from Customers. The hosting and email providers can be named, with the transfer safeguards in use, by writing to [email protected].

For the optional AI features, only Customers that use the chat, enable deployment explanations (Business plan, per organisation) or use documentation search cause data to be sent to Anthropic or OpenAI.