Data Processing Agreement

1. The short version

The rest of this page is the agreement itself. It is written to meet Article 28(3) of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), and words defined there — controller, processor, personal data, processing, data subject, personal data breach, supervisory authority — carry those meanings here.

2. Who this is between

This agreement is between you, the agenthost customer named on the account (the controller), and Bernskiold Media AB, company registration number 556893-1652, Box 190, 101 23 Stockholm, Sweden (the processor, “agenthost”, “we” or “us”). It covers personal data we process on your behalf, and nothing else.

If you are deploying on behalf of someone else — an agency running an app for its client, say — then you enter into this agreement as that client’s processor, you confirm you are authorized to do so, and our obligations here run to you so that you can pass them on. We do not enter into a separate agreement with your client, and we take our instructions only from you.

3. Where our two roles divide

agenthost handles personal data in two different capacities, and only one of them is governed by this agreement.

• Your account is ours to control. Your email address, your name, your organization, sign-in records, billing details, support correspondence and our server logs are processed by us as the controller, for our own purposes: running the service, invoicing it and keeping it secure. What we do with those is set out in the Privacy Policy, not here.
• What you deploy is yours to control. The files, code, databases and uploads that make up your apps and sites, and any personal data inside them, are processed by us only as your processor, on your instructions. That is what this agreement covers.

Where the two overlap — a server log line that records a request to your app, for instance — we treat it under whichever role we are acting in for that purpose, and we do not use data processed for you as processor for our own purposes.

4. How this comes into force, and what it overrides

This agreement is incorporated into the Terms of Service by section 15 of those terms. It takes effect when the terms do — when you create your account — and it needs no signature, no purchase order and no separate acceptance. It applies for as long as we process personal data on your behalf.

For anything to do with the processing of personal data on your behalf, this agreement prevails over the terms; for everything else the terms govern. Where the GDPR requires something this agreement does not say, the GDPR wins and this agreement is read to include it.

We may change this agreement. We will post the new version here with a new version number and date and give you at least 30 days’ notice by email before it takes effect. No change will reduce the level of protection you have under this agreement or the security measures in section 7 below the standard the GDPR requires. If you do not accept a change, terminate before it takes effect; continuing to use agenthost afterwards means you accept it.

5. What we process for you

These are the Article 28(3) particulars of the processing. Because agenthost is generic hosting, most of them are decided by you rather than by us: we run whatever you deploy, and we do not choose what goes into it.

You decide what goes in, and you answer for it. You confirm that you have a lawful basis for the processing you instruct, that you have given data subjects the information they are owed, and that you are entitled to have us process the data. Nothing here stops you from deploying special categories of personal data under Article 9, or data about criminal convictions under Article 10 — but if you do, it is for you to satisfy yourself first that the measures in section 7 are appropriate to it, and to put in place whatever additional protection your own risk assessment calls for inside your app.

6. We act only on your instructions

We process personal data on your behalf only on your documented instructions, including as to transfers, unless EU or Swedish law requires otherwise. Your documented instructions are:

• this agreement and the terms;
• what you tell us through the service — the MCP tools, the API and the control panel, in other words the ordinary act of deploying, configuring, sharing, exporting or deleting something; and
• anything else you ask us in writing, by email to our support address.

We do not sell your data, disclose it for anyone else’s purposes, mine it, profile anyone in it, or use it to train or evaluate machine-learning models — ours or anyone else’s. It exists on our systems to run your app, and for no other reason.

If we consider that an instruction infringes the GDPR or other EU or member-state data protection law, we will tell you, and we may decline to act on that instruction until it is resolved. If a law we are subject to requires us to process your data in some other way, we will inform you before we do so unless that law forbids us from telling you on important grounds of public interest.

7. Security

We implement appropriate technical and organisational measures under Article 32, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects. These are the measures in place today; the security page describes the same ones at more length, and the EU hosting page does the same for section 9.

Where and how it runs

• Everything you deploy — code, files, databases and backups — is stored and run on servers in France, operated for us by a French company with no parent outside the EU.
• Each application runs in its own container, with its own database and its own credentials. One customer’s app has no route to another’s.
• In the control plane, every credential — OAuth grant, API token, browser session — is bound to exactly one customer, and the membership behind it is re-checked on every single request, so access removed is access gone at once.

Confidentiality and integrity

• Traffic to us, to your app and between our own components runs over TLS; certificates are issued and renewed automatically.
• There is no password to steal: people sign in with a one-time code, and every credential we store — sign-in codes, session identifiers, access, refresh and API tokens — is kept only as a salted hash. A copy of our database opens no account.
• Access to production systems is limited to the people who need it to run the service, granted individually and removed when it is no longer needed.
• Everyone with access — employees and contractors alike — is bound by a written duty of confidentiality that survives the end of their engagement, and is instructed on handling customer data.
• Every change to your account is written to an append-only audit log, as are sign-ins, refusals, and the admissions and refusals at a private app’s door: what was done, who did it, from which client and address, and how it ended. Secrets are stripped before the row is written and the contents of your app are never recorded, so the log says what happened without holding what it happened to.

Availability and resilience

• Backups are taken for operational recovery and are held in the EU.
• Server and application logs are retained for 90 days and are monitored so that faults and abuse are noticed.
• Changes to the service go through version control and review, and deployments are automated and reproducible, so a change can be traced and reversed.
• Deletion is a routine, not an improvisation: deleting an app removes its container, its volumes and its database, and closing an account triggers the timetable in section 13.

What we do not claim

agenthost is in active development and, as section 3 of the terms says, is sold without a service level agreement. We do not hold an ISO 27001 or SOC 2 certification, and we will not pretend otherwise on a questionnaire. Restoring from backup is a best effort — keep your own copies of anything you cannot afford to lose. We review these measures as the service changes and may replace them with equivalent or better ones; we will not materially reduce the level of security.

8. Sub-processors

You give us general written authorisation to engage sub-processors. Each one is bound by a written contract imposing data protection obligations no less protective than those in this agreement, and we remain fully liable to you for their performance.

These are the sub-processors for personal data we process on your behalf:

Two things are deliberately not on that list. Our payment provider is not a sub-processor under this agreement: it processes your billing details, for which we are the controller, and it never touches what you deploy — see the Privacy Policy. Neither are the services you connect, such as a code repository you link or an API your app calls: those are your own providers, and when we fetch from them we do so on your instruction.

If we intend to add or replace a sub-processor for the processing covered by this agreement, we will update this page and email you at least 30 days beforehand. You may object within those 30 days on reasonable data protection grounds, by writing to support@agenthost.eu. We will try to resolve your objection; if we cannot, you may terminate the affected part of the service before the change takes effect, and we will refund prepaid fees for what you have not received. Where a change is urgent — a sub-processor fails or has to be replaced for security reasons — we may make it immediately and tell you as soon as we can, and the same right to object applies afterwards.

9. Transfers outside the EU/EEA

Your apps, your databases, your files and your backups are stored on servers in the EU and they stay there. The company operating those servers is French and has no parent outside the EU, so the hosting itself involves no transfer out of the EU at all.

There is one exception, and we would rather state it plainly than bury it. Our email provider is established in the United States, so when agenthost sends an invitation or a one-time access code to somebody you have shared a private app with, that person’s email address is transferred there. That transfer rests on the European Commission’s standard contractual clauses, together with a transfer impact assessment, and on the EU–US Data Privacy Framework where the provider is certified under it. You authorize that transfer by using the sharing feature; you may ask us for a copy of the safeguards at any time.

Support is provided from Sweden. We will not move the hosting of what you deploy outside the EU/EEA, and we will not begin any other transfer of personal data we process for you, without treating it as a sub-processor change under section 8 — which means notice, and your right to object.

10. Helping you answer data subjects

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests under Chapter III of the GDPR — access, rectification, erasure, restriction, portability and objection.

In practice the service itself is that assistance: you hold the keys to your own app and its database, so you can read, correct, export and delete the data in it directly, through your agent or the API, without asking us. That is normally the whole of what is needed, and it is faster than any ticket we could answer.

If a data subject approaches us directly about data inside your app, we will not answer for you. We will tell them to contact you, pass the request on where we can identify you, and not disclose anything without your instruction — unless EU or Swedish law requires us to. Where you need help that the service cannot give you itself, ask us, and we will provide reasonable assistance; we may charge for it at our then-current rates if the effort is more than modest.

11. Personal data breaches

If we become aware of a personal data breach affecting personal data we process on your behalf, we will notify you without undue delay, and in any event within 48 hours of becoming aware of it, at the account’s registered email address. The notification will describe, to the extent known to us at that point:

• the nature of the breach and, where possible, the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures we have taken or propose to take, including to mitigate the effects; and
• a contact point for further information.

Where we do not yet know everything, we will send what we have and follow up as the picture becomes clearer rather than waiting. We will assist you in meeting your own obligations under Articles 33 and 34, and we will document the breach on our side. We will not notify a supervisory authority or your data subjects on your behalf unless you ask us to — that call is yours as the controller. A breach caused by your own application, its code, its configuration or its credentials is likewise yours to assess and report, but we will tell you what we can see from our side.

12. Impact assessments

We assist you, taking into account the nature of the processing and the information available to us, with data protection impact assessments under Article 35 and prior consultation under Article 36. For most customers this page, the Privacy Policy and the measures in section 7 are the input that is actually needed. If you need more, ask; substantial assistance may be chargeable at our then-current rates.

13. Deleting and returning your data

You can export what you have deployed at any time while your account is open, using the service itself — which is the “return” limb of Article 28(3)(g). At the end of the service, you choose deletion or return by telling us; if you tell us nothing, we delete.

• When you delete an app or a database — its container, volumes and stored data are removed as part of the deletion.
• When your account closes — your projects and everything you deployed are deleted 30 days later, as section 11 of the terms says. Export what you want to keep before then.
• Server and application logs — deleted after 90 days on their own cycle.
• The audit log in section 7 — kept for five years and then deleted, on its own cycle and independently of the account it describes. It records who did what, including who was let into a private app; it does not hold what your app holds.
• Backups — copies of deleted data can persist in backups after deletion, because a backup cannot have single records picked out of it. They are not restored into service, they remain protected by everything in section 7, and they age out with the backup rotation within 90 days.

After that, we delete existing copies unless EU or Swedish law requires us to keep them — for instance the Swedish Accounting Act, which governs invoices rather than the contents of your app. Anything we must keep stays subject to this agreement for as long as we hold it. We will confirm deletion in writing if you ask.

14. Showing you that we comply

We make available to you the information necessary to demonstrate compliance with Article 28 and to allow for audits. In the first instance that information is this page, the Privacy Policy, the measures in section 7, and our written answers to reasonable questions from you — write to support@agenthost.eu and we will answer within 30 days. We would rather answer a specific question well than fill in a 300-row spreadsheet badly, so send us the questions that matter to you.

Beyond that, you may audit our processing, or have an independent auditor do it, on these terms: once in any twelve months, unless a supervisory authority requires more or we have notified you of a breach; on at least 30 days’ written notice; during Swedish business hours; without disrupting the service; under confidentiality; at your own cost, including our reasonable time at our then-current rates. The auditor must not be a competitor of ours. An audit may not extend to another customer’s data, or to anything that would compromise the security of other customers or of the shared infrastructure, and we may provide evidence about shared components rather than access to them.

15. Liability, duration and what survives

The limitations and exclusions of liability in section 13 of the terms apply to this agreement and to any claim arising out of it, to the extent Swedish law permits. Nothing here limits a data subject’s rights or either party’s liability under Article 82 of the GDPR, and nothing here limits liability that cannot be limited under Swedish law.

This agreement runs from the creation of your account until we have stopped processing personal data on your behalf and completed the deletion described in section 13. Sections 7, 11, 13, 14 and 15 survive its end for as long as we hold any of the data.

16. Law, disputes and contact

Swedish law governs this agreement, and disputes are heard by Stockholms tingsrätt as first instance, as in section 17 of the terms. Our lead supervisory authority is the Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm.

Everything under this agreement — questions, instructions, objections to a sub-processor, audit requests, requests for a copy of the transfer safeguards — goes to support@agenthost.eu, which reaches the people who decide these things. We are not required to appoint a data protection officer and have not appointed one.