DRAFT — requires lawyer review. Not legal advice.

Dropwarden Data Processing Addendum

Effective date: TBD

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement ("Agreement") between TBD, TBD ("Processor", "we") and the customer named in the Agreement ("Customer"). It applies automatically when the Customer accepts the Agreement. Customers that need a countersigned copy can request one at [email protected].

1. Definitions

"Data Protection Law" means all laws on the processing of personal data that apply to a party's processing under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in UK law with the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

"Customer Personal Data" means personal data that we process on behalf of the Customer in providing the Service, as described in Annex I. "Personal data", "controller", "processor", "data subject", "processing", "personal data breach" and "supervisory authority" have the meanings in the GDPR.

"EU SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022), as amended from time to time.

"Subprocessor" means a third party we engage that processes Customer Personal Data.

2. Roles and scope

2.1 The Customer is the controller (or a processor acting for its own customers) of Customer Personal Data. We are its processor (or sub-processor). Under the CCPA, we are the Customer's service provider.

2.2 This DPA does not cover personal data for which we are a controller (for example the Customer's account and billing data). Our Privacy Policy covers that.

2.3 Annex I describes the subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects.

3. Customer instructions

3.1 We process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case we will inform the Customer before processing unless the law prohibits it. The Agreement, this DPA and the Customer's configuration of the Service (users, permissions, notification rules, automations, integrations, retention settings, exports and deletions) are the Customer's complete instructions.

3.2 We will tell the Customer if we believe an instruction breaches Data Protection Law.

3.3 The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis and giving the required notices for Customer Personal Data, and for any destination it configures (for example Slack, Microsoft Teams, webhook endpoints, external SFTP or S3 targets, its own bucket or identity provider). Those destinations are not our Subprocessors.

4. Our obligations

4.1 Confidentiality. Everyone we authorize to process Customer Personal Data is bound by confidentiality obligations.

4.2 Security. We implement the technical and organizational measures in Annex II (Art. 32 GDPR). We may update them, but will not materially lower the overall protection.

4.3 Data minimization in our own systems. We never log file contents. Audit events record metadata only (actor, event, time, IP address, protocol, path, size). Our staff do not access file contents unless an owner of the Customer's organization grants a time-boxed support session, which is recorded in the Customer's audit log.

4.4 Assistance with data subject requests. The Service lets the Customer export, correct and delete Customer Personal Data (organization export, per-person erasure within an organization, full organization deletion). If we receive a request directly from a data subject about Customer Personal Data, we will pass it to the Customer without responding ourselves, except to confirm we have forwarded it.

4.5 Assistance with compliance. Taking into account the nature of processing and the information available to us, we will reasonably help the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

4.6 Personal data breaches. We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the organization's owners by email and will include, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will add information as it becomes available. Notification is not an admission of fault.

4.7 CCPA service-provider terms. We will not sell or share Customer Personal Data (as "sell" and "share" are defined in the CCPA); retain, use or disclose it for any purpose other than the business purposes in the Agreement; retain, use or disclose it outside the direct business relationship with the Customer; or combine it with personal data we receive from others, except as the CCPA permits. We will comply with the CCPA's obligations that apply to service providers, provide the same level of protection, and notify the Customer if we can no longer meet them. The Customer may take reasonable steps to stop and remediate unauthorized use. We certify that we understand these restrictions.

5. Subprocessors

5.1 The Customer gives a general authorization for us to engage Subprocessors. Our current Subprocessors are listed in Annex III and on the Subprocessors page.

5.2 We will notify the Customer's owners by email at least 30 days before a new Subprocessor begins processing Customer Personal Data, or before a change in an existing Subprocessor's processing location or purpose. The Customer may object in writing on reasonable data protection grounds within that period. We will then try in good faith to resolve the objection, for example by offering a configuration that avoids the Subprocessor. If we cannot, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused term.

5.3 In an emergency (for example a Subprocessor's sudden failure or a security threat), we may replace a Subprocessor with shorter notice. We will notify the Customer as soon as possible and the objection right in 5.2 still applies.

5.4 We impose data protection obligations on each Subprocessor that are no less protective than this DPA, and remain liable for its performance.

6. International transfers

6.1 We host the Service in Oracle Cloud Infrastructure region us-sanjose-1 and use the Subprocessors in Annex III, some of which process data in the United States. Customers can choose storage of files in a Cloudflare R2 bucket in the EU jurisdiction (see Annex I).

6.2 EU SCCs. To the extent the Customer's transfer of Customer Personal Data to us is a restricted transfer under the GDPR, the EU SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization), with the notice period in section 5.2.
• Clause 11(a): the optional independent dispute resolution language does not apply.
• Clause 13: the competent supervisory authority is the one identified in Annex I.C.
• Clause 17 (Option 1): the EU SCCs are governed by the law of TBD.
• Clause 18(b): disputes are resolved by the courts of TBD.
• Annexes I, II and III of the EU SCCs are completed by Annexes I, II and III of this DPA.

6.3 UK. To the extent the transfer is a restricted transfer under the UK GDPR, the UK Addendum is incorporated by reference and completed as follows: Table 1, the parties' details are in Annex I.A; Table 2, the selected modules and clauses are those in section 6.2; Table 3, the Appendix information is in Annexes I to III; Table 4, either party may end the UK Addendum as set out in its Section 19.

6.4 Switzerland. For transfers subject to the FADP, the EU SCCs apply with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority; and "Member State" includes Switzerland so that Swiss data subjects can bring claims in their place of habitual residence.

6.5 If the EU SCCs, the UK Addendum or another transfer mechanism we rely on is invalidated or replaced, we will work with the Customer to adopt an alternative lawful mechanism.

6.6 If the EU SCCs conflict with this DPA or the Agreement, the EU SCCs prevail.

7. Audits

7.1 We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our Security Overview, our completed answers to a standard security questionnaire and summaries of our policies.

7.2 If that information is not enough to meet the Customer's obligations, or a supervisory authority requires it, the Customer may audit our compliance once per year on at least 30 days' written notice, during business hours, at its own cost, under confidentiality terms, and in a way that does not expose other customers' data or disrupt the Service. Audits of our Subprocessors are carried out through the reports and terms those Subprocessors make available.

8. Return and deletion

8.1 During the subscription, and while an organization is locked, the Customer can export its data through the portal and API.

8.2 When the Agreement ends, the organization is locked and Customer Personal Data is deleted after 90 days (for trial organizations, after 90 days), unless the Customer deletes it earlier or the law requires us to keep it. The Customer may ask for earlier deletion at [email protected].

8.3 Deletion removes the organization's files (including versions and quarantined files), users, credentials, notification configuration and audit log. Encrypted database backups that may contain Customer Personal Data are not altered but expire on their own within 35 days and are used only for disaster recovery. If a backup is ever restored, we re-apply deletions before the restored data is used. We send the owners a confirmation when deletion is complete and keep a deletion record that contains no personal data.

9. General

9.1 This DPA lasts as long as we process Customer Personal Data.

9.2 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law or the EU SCCs do not allow it.

9.3 If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data.

Annex I: Description of the processing

A. List of parties

Data exporter: the Customer, as identified in the Agreement and its account. Contact: the organization's owners. Role: controller (or processor). Activities: use of the Service. Signature and date: by accepting the Agreement.

Data importer: TBD, TBD. Contact: [email protected]. Role: processor (or sub-processor). Activities: providing the Service. Signature and date: by accepting the Agreement.

B. Description of the transfer and processing

Categories of data subjects: the Customer's owners, admins, members and viewers; external partners and other end users the Customer invites; people whose personal data appears in files, file names or folder names the Customer uploads; recipients of notifications the Customer configures.

Categories of personal data:

• Identity and contact: names, email addresses, usernames, organization role;
• Authentication: password hashes, SSH public keys, TOTP secrets (encrypted), API key hashes, federated identity identifiers, IP allowlists;
• Activity metadata: audit events (event type, actor, time, IP address, protocol, file path, target path, file size, result), login history, notification delivery logs;
• Configuration: notification rules, recipient email addresses, webhook URLs (encrypted), branding;
• File contents and file and folder names: whatever the Customer chooses to upload. We do not inspect it except for automated malware scanning.

Sensitive data: none intended. The Acceptable Use Policy prohibits payment cardholder data and protected health information. If the Customer uploads special categories of data in files, it is responsible for that decision, and the safeguards in Annex II apply (encryption, access control, audit log, filename redaction in notifications).

Frequency of the transfer: continuous, while the Service is used.

Nature of the processing: hosting and storage; transfer over SFTP, FTPS, HTTPS and API; access control and authentication; recording audit events; sending notifications by email, chat and webhook as the Customer configures; running Customer-configured automations; automated malware scanning of uploads; versioning and replication where the Customer's Plan includes them; export and deletion.

Purpose: providing, securing and supporting the Service under the Agreement.

Retention: for the term of the Agreement and then as in section 8. Audit events are kept for the audit retention period of the Customer's Plan (30 (Starter) / 180 (Team) / 365 (Business) days on the current Plan) and then deleted automatically. Encrypted database backups expire within 35 days.

Transfers to Subprocessors: as listed in Annex III, for the purposes stated there and for the duration of the Agreement.

Processing location: compute in Oracle Cloud Infrastructure region us-sanjose-1; file storage in Cloudflare R2 (default location, or the EU jurisdiction for organizations configured for EU storage); other Subprocessors as in Annex III.

C. Competent supervisory authority

Where the data exporter is established in the EU, the supervisory authority of its Member State of establishment. Where it is not established in the EU but has appointed a representative under Art. 27 GDPR, the authority of the Member State where the representative is established. Otherwise, the authority of the Member State where the relevant data subjects are located, as determined by Clause 13 of the EU SCCs. For the UK, the Information Commissioner's Office.

Annex II: Technical and organizational measures

Encryption

• In transit: TLS 1.2 or later for HTTPS; SSH with modern key exchange and ciphers only, and ed25519 or RSA keys of 3072 bits or more; FTPS with explicit TLS only (plain FTP disabled).
• At rest: provider-side encryption of all stored objects; encrypted block volumes; application-level envelope encryption for secrets in our database (for example TOTP secrets, webhook URLs and signing secrets, third-party credentials); secrets held in Oracle Cloud Infrastructure Vault; database backups encrypted before upload, with the decryption key kept offline.

Tenant isolation

• Every organization's files sit under a dedicated storage prefix (or a dedicated bucket). Every user is confined to their organization's root and to the folders they are granted.
• Every permission check is done by our control plane and enforced again by the file server.
• Automated cross-tenant isolation tests over SFTP, FTPS, web and API must pass before every release.

Access control and authentication

• Roles per organization (owner, admin, member, partner, viewer) and per-folder permissions.
• SSH keys preferred; passwords optional per organization; TOTP two-factor authentication with an organization-wide enforcement switch; single sign-on where the Plan includes it.
• API keys are scoped, revocable and stored as hashes.
• IP allowlists per organization and user where the Plan includes them; brute-force protection with automatic IP bans and rate limits.
• Platform staff: multi-factor authentication required; least privilege; support staff see metadata only and access file contents only in a support session granted by the organization, limited to at most 7 days and revocable; quarterly access reviews.

Logging and data minimization

• Append-only audit log of file, login and administrative events (no file contents), exportable as CSV, retained per Plan.
• No file contents in any application log. Organizations can redact file names in notifications.

Network and infrastructure

• Only the SFTP, FTPS and HTTPS ports are public. Administrative access goes through a managed bastion. Internal services and the file server's admin interface are never exposed.
• Outbound webhooks are HMAC-signed and protected against server-side request forgery (HTTPS only, private and metadata address ranges blocked, no redirects).

Availability and recovery

• Nightly encrypted database backups to a separate storage bucket with a separate credential; restore drills; a documented rebuild procedure with a target of under one hour.
• 99.5% uptime target (no high availability): the Service runs on a single compute instance.

Vulnerability and change management

• Every change goes through a reviewed pull request with automated checks (including secret scanning). Changes touching authentication, storage paths, billing or deletion get an additional security review.
• Weekly dependency and container image scans; a monthly operating-system patching window, with urgent patches applied sooner; a published responsible-disclosure policy.

Abuse prevention

• Automated malware scanning of uploads with quarantine; ability to freeze an organization.

Incident response

• Documented incident response plan with customer notification as in section 4.6.

Subprocessor management

• Data processing agreements with each Subprocessor; 30 days' notice of changes.

Annex III: Subprocessors

The current list, with purpose, data categories and location, is maintained on the Subprocessors page and is incorporated into this Annex. At the effective date it is: