Data processing agreement

This agreement is between {{PLACEHOLDER:LEGAL_ENTITY_NAME}} ("Porticol", "we") and the customer identified in the signature block ("the customer").

It takes effect on 21 Oct 2026.

It applies to personal data in Porticol Cloud, and to personal data in a Porticol Team Server where we operate the installation for you. It does not cover the desktop application used on its own, which stores nothing with us, or this website.

1. Roles

The customer is the controller of personal data in Porticol. Porticol is the processor of that data, and processes it only on the customer's documented instructions, including as those instructions are given in this agreement, in the terms of service and through the product itself.

The customer is the controller of the personal data of its own users. Where Porticol determines the purposes of processing, it is a controller in its own right, and the privacy policy applies to that processing.

2. What is processed

Subject matter. The customer's use of Porticol: accounts and identities, organisations, workspaces, collections, environments and their variables, runs, monitors, mock servers, audit entries, sign-in records, sessions, devices, entitlements, and billing records.

Duration. For as long as the customer's account or installation exists, and for the periods in section 8.

Nature of the processing. Collection, receipt, recording, storage, organisation, structuring, retrieval, consultation, use, encryption and decryption of names and values on the customer's devices, restriction of access, export, aggregation, analysis, deletion and destruction. It includes sending personal data to the suppliers in subprocessors.md.

Purposes. Providing, securing, supporting and billing for the service; synchronising the customer's workspaces; running monitors and mock servers the customer has configured; sending service, security and billing notices; and complying with the customer's enforceable legal obligations.

Categories of personal data. Names, email addresses, business contact details, display names chosen by users, identifiers of accounts, sessions and devices, authentication factors and their state, role and group membership, IP addresses and device names, audit entries naming an actor and an action, organisation content the customer has chosen to share between its users, and support conversations the customer sends us.

Categories of data subject. The customer's users, its members, and its own staff.

Porticol does not knowingly process special categories of personal data, or data about criminal convictions and offences, and a customer must not put such data into a collection, an environment or a variable. Data a customer sends to a third-party API it addresses does not pass through Porticol, except where a scheduled monitor sends it on the customer's behalf.

3. Instructions

We process personal data only on the customer's instructions, unless law requires otherwise. If law requires it we tell the customer before processing unless the law forbids the notice. We tell the customer if an instruction infringes data protection law.

We may use aggregated and anonymised information to operate and improve the service, where it can no longer identify a person.

4. Confidentiality

Every person we authorise to process personal data is bound by confidentiality obligations no less protective than this agreement. We tell our personnel to observe it and we remain responsible for their breaches.

5. Security

We apply the technical and organisational measures in sections 3 to 7 of the security policy, in force on 21 Oct 2026, and any later version of it that applies while the agreement runs. In summary: TLS for everything, encryption at rest for the database and its backups, row-level security that separates each organisation, sealed columns for sensitive values, keys held outside the database, and a tamper-evident audit log.

Customer data is kept in the Amazon Web Services us-east-1 region, in the United States, and its backups are replicated to the us-west-2 region, also in the United States.

The keys that protect customer data at rest are held in AWS Key Management Service, whose hardware security modules are validated under FIPS 140. Each data store has a key of its own, rotated automatically. We use no dedicated hardware security module of our own.

6. Subprocessors

The customer authorises us to use the suppliers listed in subprocessors.md.

We give 30 days' written notice before adding or replacing a supplier, and publish the change on that page. The customer may object, with its reasons, within 30 days of the notice. If we cannot resolve the objection, the customer may end the service the new supplier affects by written notice, and we refund the prepaid fees for that service, pro rata, for the part of the period after it ends.

We bind each supplier to confidentiality and to obligations no less protective than this agreement's security obligations, and we remain fully liable to the customer for a supplier's performance of those obligations.

7. Data subject rights and assistance

Taking account of the nature of the processing, we assist the customer by appropriate measures, insofar as we can, to answer a request to exercise a right. Where a request reaches us directly, we tell the customer and pass it on without undue delay.

We assist the customer with:

• a request to access, correct, delete, restrict or export personal data;
• an objection to processing based on legitimate interests; and
• the customer's obligation to answer a supervisory authority.

We make the account export and the deletion an organisation's owners can perform without us. Where the customer passes a request on to us for help, we answer within 10 business days.

8. Retention and deletion

Retention periods for each kind of data are set in section 9 of the privacy policy. On deletion of an account or an organisation, we delete the data in every table, including its audit log, and end the sessions and devices that used it.

On termination of this agreement we return or delete the customer's personal data within 30 days, at the customer's choice, and confirm in writing when it is done. Copies in backups age out within 35 days after that. Records the law requires us to keep, such as invoices and tax records for 7 years, are kept under the confidentiality obligations in section 4 and used for nothing else.

An export the customer asks for is kept for seven days and downloaded once.

9. Security incidents

We notify the customer without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting the customer's data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact for follow-up.

We document the breach, its effects and the remediation. This notice does not replace a notice a law requires, which we give without undue delay.

10. Assessments and prior consultation

Taking account of the nature of the processing and the information available to us, we assist the customer with a data protection impact assessment and any prior consultation, and answer its request for that help within 10 business days.

11. International transfers

Transfers of customer personal data from the United Kingdom or the European Economic Area to a country without an adequacy decision are made under the European Commission's standard contractual clauses of 4 June 2021, module 2 where the customer is a controller and module 3 where it is a processor, and, for data from the United Kingdom, under the UK International Data Transfer Addendum to those clauses. The customer may ask us for a copy and for information about the transfer.

12. Records and audit

We make the information needed to demonstrate compliance with this agreement available on request, including the threat model, data-flow description and incident response plan in the security/ folder of the project's repository.

The customer may audit our compliance once a year, on 30 days' written notice. We meet an audit first with written answers to the customer's questions and with the evidence pack. An on-site audit takes place only where a supervisory authority requires it, and is then conducted by the customer or an auditor it appoints, under the customer's confidentiality obligations, subject to our reasonable security and confidentiality requirements and at the customer's cost.

13. Liability and precedence

This agreement and the terms of service form the whole agreement between us about processing personal data. Where they conflict on the protection of personal data, this agreement prevails.

Our liability under this agreement is subject to the limits in section 11 of the terms of service, including the higher limit there for a breach of this agreement.

Nothing in this agreement limits a data subject's rights, or a right or obligation that cannot be limited by law.

14. Annexes

Annex 1, the processing. The subject matter, nature, purpose, duration and categories are in section 2. Contact details for the customer's data protection contact are on their account or given to us in writing.

Annex 2, the technical and organisational measures. Sections 3 to 7 of the security policy as in force on 21 Oct 2026.

Annex 3, the subprocessors. subprocessors.md.

15. Signatures

The customer's fields, and the date of each signature, are completed when the agreement is signed.