Draft — to be reviewed by counsel before launch
Data Processing Agreement
Last updated 30 October 2026
This agreement forms part of the Terms of Service between Graphwake (the "processor") and the customer (the "controller"). It applies whenever Graphwake processes personal data on the customer's behalf, as Article 28 of the GDPR requires.
1. Subject matter and duration
The processor provides the service described in the Terms of Service. This agreement lasts as long as the processor holds personal data for the controller, including the 12 months after an account is closed.
2. Nature and purpose of the processing
Storing the controller's workspace, reading its API specifications, mapping which teams depend on which endpoints, and sending change alerts and service e-mails to the people the controller names.
3. Personal data and data subjects
- Data subjects: the controller's employees and contractors who use the service or receive its alerts, and people named in its specifications or CI metadata.
- Personal data: names, work e-mail addresses, roles and team memberships; pull request author names, pull request links and branch names reported by CI; chat channel identifiers; records of actions taken in the workspace. No special categories of data are needed, and the controller should not put any into the service.
4. The processor's obligations
- Process personal data only on the controller's documented instructions, which are these terms and the controller's use of the service.
- Ensure everyone with access to the data is bound by confidentiality.
- Apply the security measures in section 6.
- Help the controller answer data subjects' requests and meet its obligations on security, breach notification and impact assessments, taking into account the information available to the processor.
- Make available the information needed to show compliance with this agreement, and allow for and contribute to audits, with reasonable notice and at most once a year unless a breach or a regulator requires it.
5. Location and transfers
Personal data is stored in the European Union (AWS eu-central-1, Frankfurt). A transfer outside the European Economic Area happens only through a sub-processor listed below and is covered by the European Commission's Standard Contractual Clauses.
6. Security measures
- Encryption in transit (TLS) and at rest.
- Each workspace's data is isolated in the database by row-level security; background jobs use a separate role.
- Sign-in links, sessions, API keys and ingest keys are stored only as hashes; chat and identity-provider secrets are encrypted.
- Admin-only management of people, roles and settings, and an append-only audit log of those actions.
- Removing a person deletes their account, sessions and API keys; a sign-in token already issued expires within 15 minutes.
- Records the service no longer needs are deleted on a fixed schedule (section 9).
7. Sub-processors
The controller authorises the sub-processors below. The processor will tell the controller's Admins at least 30 days before adding or replacing one; the controller may object on reasonable grounds and, if no solution is found, end the agreement. The processor imposes the same data protection obligations on each sub-processor and remains responsible for them.
| Sub-processor | Purpose | Location | Used |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database and backups | EU (eu-central-1, Frankfurt) | Always |
| Stripe Payments Europe, Ltd. | Subscription billing and card payments | EU, with transfers to the US under Standard Contractual Clauses | When the workspace subscribes to a paid plan |
| Slack Technologies, LLC | Delivering change alerts to Slack channels | US, under Standard Contractual Clauses | Only when the workspace connects Slack |
| Microsoft Ireland Operations Limited | Delivering change alerts to Microsoft Teams channels | EU, with transfers under Standard Contractual Clauses | Only when the workspace connects Microsoft Teams |
| E-mail delivery provider (to be named before launch) | Sign-in links, invitations, alerts and billing e-mails | To be confirmed before launch | Always |
8. Personal data breaches
The processor will notify the controller without undue delay after becoming aware of a personal data breach affecting its data, with the information the controller needs to meet its own obligations, and will keep the controller informed as more becomes known.
9. Retention, return and deletion
| Data | Kept |
|---|---|
| Workspace content (specs, services, teams, subscriptions, change history, audit log) | While the workspace is open |
| A closed workspace's data | 12 months after the account is closed, then deleted by our team (not automatically); sooner on request |
| Sign-in links, sessions and API keys that have ended | 30 days |
| Records of delivered notifications | 90 days |
| Records of CI uploads | 180 days |
After an account is closed, the processor keeps the controller's data for 12 months so it can be reopened, then deletes it by hand (there is no automatic deletion job), unless the law requires it to be kept longer. On request the processor exports the controller's data or deletes it sooner.
10. Liability and order of precedence
Liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms of Service conflict on the protection of personal data, this agreement prevails.
Contact
Data protection questions: hello@graphwake.com. Processor: [legal entity name and registered address].