Data Processing Agreement
Incomplete DPA draft for business customers. Not an executed agreement and not a statement of regulatory compliance.
Parties and scope
TODO: customer (controller) and operator (processor) identities, signatories, effective date, and governing terms.
Processing described: hosting the customer’s status page and its history; receiving monitoring signals (checks, heartbeats, webhooks, API and agent updates); sending notifications to destinations the customer configures; storing team member emails. Data subjects: the customer’s team members, people whose addresses the customer adds to alert emails, and anyone the customer names in page content.
Security measures (as built)
Every private request is authorized against the customer’s own account, with automated cross-account tests for every endpoint. Secrets are stored as hashes or, where they must be used to send (Slack and webhook URLs, signing secrets), kept server-side and never returned. Public pages are served from published snapshots, never from the database. Outbound requests refuse private networks. Backups are logical exports that the operations runbook requires to be stored encrypted and deleted after 30 days. A security and failure review is recorded in the repository.
TODO: counsel-reviewed terms for documented instructions, confidentiality, breach notice timing, deletion or return, audits, and assistance with data-subject requests.
Subprocessors and transfers
The Subprocessor List names each provider and its purpose. TODO: processing regions, change-notice and objection mechanism, flow-down obligations, and transfer safeguards.
Attachments
TODO: processing description annex, security annex, retention schedule (proposed: purge 30 days after deletion, backups expire within 35), transfer annexes, precedence and signature records.