Data processing agreement

This agreement governs the processing of personal data by Vesprr LLC (“processor”) on behalf of the customer (“controller”) in the course of providing DevBench under the terms of service. It applies to the personal data the controller and its members put into the service.

• For account data (users, organizations, memberships, billing) Vesprr LLC is the controller, and the privacy policy applies.
• For workspace data on DevBench compute (repositories, chat, notes, recordings, docs, media, previews, deployments) the customer is the controller and Vesprr LLC is the processor. This agreement applies.
• For workspace data on a host the customer runs, Vesprr LLC does not process it and this agreement does not apply, except to support the customer explicitly asks for and grants access for.

The processor processes personal data only on the controller's documented instructions. The terms, the product's settings as the controller configures them, and the actions the controller's members take in the product are the instructions. The processor tells the controller if an instruction, in its view, breaks the law. Staff with access are bound to confidentiality.

The processor maintains at least these measures (Art. 32 GDPR):

• Each workspace runs in its own container with its own volume; boxes cannot reach each other or the host network beyond what the runtime allows.
• Provider tokens, cloud credentials and secrets are encrypted at rest and never returned by the API.
• Access to production is limited to named staff, with keys, and logged.
• Every action in a workspace is written to an audit log the controller can read.
• Transport is TLS everywhere. Host keys of deploy targets are verified, not accepted.
• Organization backups are encrypted, and never contain repository code.
• The hosting providers' physical and environmental controls, as set out in their own certifications.

The full description is on the security page and is updated as the measures change.

The controller authorises the subprocessors listed in the privacy policy. The processor tells the controller of an intended addition or replacement by mail at least 30 days before it takes effect. The controller may object on reasonable data protection grounds within that period; if no solution is found, the controller may terminate the affected service. The processor binds every subprocessor to obligations no weaker than these.

• The processor helps the controller answer data subject requests, with the export and deletion the product offers and by hand where it does not.
• The processor helps with data protection impact assessments and consultations with a supervisory authority, as far as the processing here is concerned.
• Once a year, and after a breach, the controller may audit compliance with this agreement: first by written answers and existing reports, and if those do not suffice, by an on-site inspection with 30 days' notice, during working hours, at the controller's cost.

The processor tells the controller of a personal data breach affecting the controller's data without undue delay and at the latest within 48 hours of becoming aware of it, by mail to the organization's owners, with what is known: the nature of the breach, the data and subjects concerned, the likely consequences and the measures taken. Further findings follow as they are made.

At the end of the contract the controller may export its organization's data for 30 days. After that the processor deletes it, backups included within 90 days, unless EU or member state law requires it to be kept. On request the processor confirms the deletion in writing.

Processing takes place in the European Union. A transfer to a third country happens only through a subprocessor listed in the privacy policy, on the standard contractual clauses or an adequacy decision, and the processor provides the mechanism on request.

This agreement lasts as long as the terms of service, and beyond them for as long as the processor holds personal data under section 9. The laws of the State of New Mexico, USA, apply, as in the terms, except where the GDPR or the law of an EU member state governs this agreement by its own force. Where this agreement and the terms conflict on the processing of personal data, this agreement prevails.

To sign: mail hello@devbench.sh with your organization's legal name, address and signatory. We return a countersigned copy.