Every control in the technical register carries a build-status label. Legal commitments remain as published: a missing test or an unavailable implementation status does not suspend a contractual commitment.
Data Processing Agreement
Where session contents are personal data, you are the controller and we are the processor. This document is the instruction set, and it is the one your reviewer will actually read.
We process session contents only to run the sessions you asked for. We use approved subprocessors, keep data in the stated service region (one European region is offered; region selection is planned), notify you of a breach within 24 hours, and hold everything else to the retention and deletion matrix in section 7.
A summary is not the agreement. Where the two disagree, the clauses below govern.
1 Roles and scope
Roles and scope
You determine what your agents do and what data they touch, which makes you the controller. We host, checkpoint, and restore, which makes us the processor. Our instructions come from your use of the product: a checkpoint happens because you set a cadence, not because we decided to keep a copy.
2 Processing instructions
Processing instructions
We process session contents for exactly four purposes and no others.
Running the session: executing the workload inside the micro-VM you requested.
Durability: writing, storing, and restoring checkpoints under the retention and deletion policy in section 7.
Metering: counting session-minutes, storage after dedup, and tokens brokered through the gateway.
Support: only when you open a ticket and only through the break-glass path, which notifies your Owners and writes to your audit log.
3 Security measures
Security measures
Technical measures and their real build status are listed in the control status register below; nothing in this section promises a control the register marks unbuilt. The load-bearing ones will be: hardware-virtualized single-tenant guests, encryption at rest with per-organization keys, provider credentials held outside the isolation boundary, and credential scanning on checkpoint write.
Organizational measures, planned and not yet in force: least-privilege access, mandatory review for production changes, an audit trail of every staff action against customer data, and annual security training that is not a slideshow.
4 Subprocessors
Subprocessors
The current list is published and versioned. We remain liable for our subprocessors’ processing. You get 30 days notice before we add one that handles session contents, and if you object on reasonable grounds you may terminate the affected service without penalty.
5 Breach notification
Breach notification
We will notify you within 24 hours of becoming aware of a personal data breach affecting your session contents, with what we know at that point rather than waiting for a complete picture. Subsequent updates follow as the investigation proceeds, and the write-up is published in the findings archive once affected customers have been told.
6 International transfers
International transfers
Where a transfer outside the UK or EEA is necessary, it relies on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, with a transfer impact assessment available on request. Region pinning avoids the question entirely for most customers, and we recommend it.
7 Deletion and return
Deletion and return
On termination you may export everything through the API. What happens to the data afterwards is the matrix below and nothing else in this agreement: no post-termination window, no category and no exception is stated here that the approved policy does not carry. Deletion of an account is the trigger the matrix names.
Retention and deletion policy v1.0 · approved 2026-09-09. Published exactly as ruled. The same matrix is rendered on the Privacy Policy and on the Security page from one source, so this agreement cannot drift from them. Legal holds are not currently supported; retention proceeds as stated unless law requires otherwise.
A cell reading "not stated in v1.0" is a question this version does not answer. It is printed rather than filled, because filling it would be inventing policy; it is answered in a versioned reissue, never in place.
| category | retained | deletion | backups | evidence |
|---|---|---|---|---|
| Checkpoint content | while the account exists; no automatic expiry | deletable by the customer, per session; the key is destroyed on account deletion | encrypted, and unreadable once the key is destroyed; backup retention 30 days | account deletion: er-1c-green, er-1c-prod-green; per-session deletion: er-1s-green (bench); served in production since 2026-10-06 (docs/deploy-2026-10-06.md) |
| Provider credentials | same as checkpoint content | same as checkpoint content | same as checkpoint content | account deletion: er-1d-green, er-1d-prod-green |
| Ledgers and billing aggregates | 7 years, under legal obligation | the identity is tombstoned on deletion | not stated in v1.0 | tombstone: er-1c-prod-green |
| Service logs | 30 days | not stated in v1.0 | not stated in v1.0 | no gate yet |
| Support tickets | 2 years | not stated in v1.0 | not stated in v1.0 | no gate yet |
| Console audit log | 2 years | the identity is tombstoned on account deletion | not stated in v1.0 | tombstone: er-1c-prod-green |
| Account data | while the account exists | deleted on account deletion, except the tombstone id and the billing aggregates already covered above | not stated in v1.0 | account deletion: er-1c-prod-green |
| Telemetry | 13 months, then deleted | first-party, cookieless, and carries no identifiers, so there is nothing to tombstone | not stated in v1.0 | no gate yet |
8 Audits
Audits
You may audit our compliance once a year, or more often after a breach affecting you. In practice most reviewers start from the Proof page and the content-hashed evidence archive, and review dated public summaries; a penetration test has not yet been commissioned, and we say so here rather than staging one on paper.
Control status register
reg Control status register
technical register, not part of the agreement
Every control this document names, with the deployment state derived from the same capability source /security and /proof render. Implementation evidence is dated separately from the legal commitments above. Missing evidence does not amend those commitments; gaps require remediation and communication of customer impact.
| control | status | evidence |
|---|---|---|
| Hardware-virtualized single-tenant guests Hardware virtualization isolates each session guest. Historical lifecycle tests cover the tested runtime and architecture; they do not constitute a penetration test or proof against shared-host attacks. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | /proof#gate-1 |
| Provider credentials held outside the isolation boundary Gateway-managed provider credentials stay outside the guest. Secrets written into guest memory or workspace can be captured by a checkpoint. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | /proof#gate-3 |
| Encryption at rest with per-organization keys Historical production checks report per-account checkpoint encryption and account deletion that made the tested saved content unreadable. Continued protection depends on key custody; this is not evidence of per-session deletion. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | none · plan, not proof |
| Credential scanning on checkpoint write Checkpoint secret scanning is not built and is not offered as a guarantee. Keep secrets out of guest memory and workspace. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | none · plan, not proof |
| Break-glass access path with Owner notification and audit write Built and running in production: opening a customer's session content needs a typed reason, lasts an hour, lands in the customer's own audit trail and sends a security email, and the admin console's gates (ad-1 to ad-4, under ADR-022) proved it on the bench, sabotage runs included. Outside such a window the content is refused. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | /evidence/phase-ad |
| Audit trail of staff actions against customer data Built and running in production: every write a staff member makes through the admin console is logged with who, what and why, and the admin console's gates (ad-1 to ad-4, under ADR-022) proved it on the bench, sabotage runs included. No dedicated public gate covers staff access outside the admin console. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | /evidence/phase-ad |
| Least-privilege access and mandatory production review Built and running in production: staff hold roles, and a support role cannot reach owner actions, as the admin console's gates (ad-1 to ad-4, under ADR-022) proved on the bench, sabotage runs included. Mandatory review of production changes is a process with no dedicated public gate. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | /evidence/phase-ad |
| 24-hour breach notification The published 24-hour breach-notification commitment remains as written. Current implementation evidence for the response process is not available; missing evidence does not suspend the commitment. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | none · plan, not proof |
| Published, versioned subprocessor list The versioned subprocessor list and its stated notice periods remain binding. The register is an editorial policy record, not a technical test. Evidence register dated 2026-10-23; current implementation not independently verified. The published commitment remains. | production state unavailable | none · plan, not proof |
Version history begins at v1.0, effective 2026-09-03; no earlier version exists. Material changes are announced 30 days before they take effect, by email to Owners and in the changelog.
v1.0 · effective 2026-09-03 · no prior versions