Data Processing Agreement

Revised · policies/DPA.md ↗ · 26b0eea33e1b ↗

This DPA covers personal data isotope13 LLC ("we") processes on behalf of a customer ("you"). It joins your agreement once both of us sign. Where they conflict on personal data, this DPA wins.

Scope

  • Subject and purpose: providing the service in your order
  • Duration: your agreement's term, plus deletion below
  • Data: OAuth account ID, GitHub username or Google email; IP addresses; packages, URLs, and hashes you ask about
  • Whose: your team members and API callers
  • Not covered: uploads and verdicts. They are public, and we control them under our Privacy Policy. Don't upload personal data.

Our Commitments

  • We process only on your documented instructions: this agreement and your use of the service. We tell you if an instruction breaks the law.
  • Everyone with access is bound to confidentiality.
  • Security follows our Corporate Policies.
  • You authorize our Approved Subprocessors. We notify you 30 days before adding one. Object, and if we can't resolve it, you may terminate for a refund of prepaid fees. Our subprocessors are bound to equivalent terms, and we remain liable for them.
  • We notify you of a breach within 24 hours of discovery, and help with your obligations.
  • We help with data subject requests, impact assessments, and regulator consultations.
  • We tell you about any government request for your data, unless the law forbids it.
  • Under the CCPA, we are your service provider: we won't sell or share your personal data, or use it outside our agreement.
  • When the agreement ends, we delete your personal data within 30 days, unless law requires otherwise, and confirm on request.
  • For audits, we provide our SOC 2 report once available, or answer a reasonable security questionnaire. If that isn't enough, you or your auditor may audit us once a year, at your cost, with 30 days' notice.

Transfers

We process data in the US under the EU–US Data Privacy Framework. Where it doesn't apply, the EU Standard Contractual Clauses (Module 2) are incorporated by reference, with the UK Addendum and Swiss amendments as needed: general subprocessor authorization with 30 days' notice, Irish law and courts. Their annexes are the Scope above, our Corporate Policies, and our Approved Subprocessors.

Liability

As limited by your agreement.

Questions? privacy(@)isotope13.io