Data Processing Addendum

1. Processing details

• Subject matter and purpose: providing the Service under the Terms: importing, storing, analyzing and displaying Terraform state and sending notifications and reports.
• Duration: the term of the Terms, plus the deletion periods in section 7.
• Nature: collection, storage, encryption, parsing, comparison, display, transmission by email, backup and deletion.
• Data subjects: Customer's personnel and any other people whose data Customer includes in the state it connects.
• Categories of data: identifiers and contact details that appear in state (for example names, email addresses, user names, IP addresses) and any other data Customer chooses to include. Customer will not include special categories of data or data about criminal convictions.

2. Instructions

OpsFort processes personal data only on Customer's documented instructions, which are the Terms, this DPA and Customer's configuration of the Service, unless the law requires otherwise (in which case OpsFort will inform Customer first unless the law forbids it). OpsFort will tell Customer if it believes an instruction breaches data protection law.

3. Confidentiality and security

Anyone authorized by OpsFort to process the data is bound by confidentiality. OpsFort implements the measures in Annex A and may update them provided the overall level of protection is not reduced.

4. Sub-processors

Customer gives general authorization for the sub-processors listed in section 3 of the Privacy Policy (Amazon Web Services, Cloudflare, Stripe). OpsFort will give at least 15 days' notice by email or in the Service before adding or replacing a sub-processor that processes Customer Data. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period. OpsFort imposes data protection obligations on each sub-processor equivalent in substance to this DPA and remains responsible for them.

5. Assistance

Taking into account the nature of the processing, OpsFort will reasonably help Customer respond to data subject requests, carry out data protection impact assessments and consult supervisory authorities. Much of this is available self-service (deleting sources, workspaces and accounts). OpsFort may charge reasonable costs for assistance beyond what the Service provides.

6. Personal data breaches

OpsFort will notify Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information Customer reasonably needs to meet its own obligations, and will take reasonable steps to contain it.

7. Deletion

Customer can delete sources, workspaces and accounts in the Service at any time; the data is then removed from active systems promptly and from backups as they expire, within 90 days. At the end of the Service OpsFort deletes remaining Customer Data the same way, unless the law requires it to be kept. Customer is responsible for keeping its own copies of its Terraform state.

8. Audits

OpsFort will make available the information reasonably necessary to demonstrate compliance with this DPA. Where that is not sufficient, Customer may, at its own cost and no more than once a year, carry out an audit with 30 days' written notice, during business hours, under confidentiality, and without access to other customers' data.

9. International transfers

To the extent the processing involves a transfer of personal data from the EEA, Switzerland or the United Kingdom to OpsFort in the United States, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated by reference, with Customer as data exporter and OpsFort as data importer; option 2 of clause 9 (general written authorization, with the notice period in section 4 of this DPA) applies; the optional clause 7 and the option in clause 11 do not apply; clause 17 is governed by the law of Ireland and clause 18 designates the courts of Ireland; the annexes are completed by section 1 and Annex A of this DPA. For the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner applies in addition. For Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection.

10. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them to apply.

Annex A: Security measures

• Access to Customer storage only through an IAM role created and controlled by Customer, protected by a unique external ID; read-only permissions are recommended and documented.
• Terraform state and source credentials encrypted by the application (Fernet: AES-128-CBC with HMAC-SHA256) before they are stored; the key is kept outside the database.
• Secret attributes recognized in state are withheld from the interface and from emails; raw state never leaves the backend.
• TLS for data in transit; HTTP-only, same-site session cookies; sessions expire after 7 days and can be revoked by the user.
• Passwords hashed with a modern algorithm (Argon2); rate limits and bot protection on authentication.
• Workspace isolation enforced on every request; role-based access (owner, member, viewer).
• Daily encrypted database backups with automatic rotation and regular restore tests.
• Production access restricted to the operator of the Service; security updates applied regularly.