Data Processing Agreement
Last updated 24 October 2026 · Incorporated into the Terms of Service
This DPA applies where AccessProof ([LEGAL ENTITY NAME — TO BE PROVIDED], [REGISTERED ADDRESS — TO BE PROVIDED]) processes personal data on behalf of Customer under GDPR, UK GDPR, Swiss FADP or the CCPA/CPRA. Customer is the controller (or "business"); AccessProof is the processor (or "service provider").
1. Details of processing (Annex I)
- Subject matter and purpose: performing user access reviews and producing audit evidence for Customer.
- Duration: term of the agreement plus deletion period below.
- Data subjects: Customer's employees, contractors, guests and reviewers.
- Categories: names, usernames, email addresses/UPNs, group and role memberships, last-activity data, application credential metadata (owners, expiry — never secret values), review decisions and comments.
- Special categories: none intended.
2. Processor obligations (Art. 28(3))
- Process only on Customer's documented instructions (the service configuration and these terms), and inform Customer if an instruction appears unlawful.
- Ensure personnel are bound by confidentiality.
- Implement the technical and organisational measures in Annex II.
- Engage subprocessors only under written terms with equivalent protections; current list below; 30 days' notice of changes, during which Customer may object and terminate.
- Assist Customer with data subject requests (self-service export and deletion are provided), DPIAs and prior consultations.
- Notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach.
- On termination or account deletion, delete Customer personal data immediately from the live database; residual copies in logs or backups expire within 30 days. Customer can export beforehand.
- Make available information necessary to demonstrate compliance and allow audits (reasonable notice, once per year, or as required by a supervisory authority).
3. CCPA service-provider terms
AccessProof will not sell or share Customer personal information, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, or combine it with personal information from other sources except as permitted by the CCPA. AccessProof will comply with the CCPA and notify Customer if it can no longer meet its obligations.
4. International transfers
For transfers of EEA personal data to countries without an adequacy decision, the parties incorporate the Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where applicable, Module Three, with the UK International Data Transfer Addendum and Swiss amendments. Clause 7 docking applies; Clause 9 option 2 (general authorisation, 30 days' notice); Clause 11 optional language omitted; Clauses 17 and 18: [MEMBER STATE LAW AND COURTS — TO BE PROVIDED].
5. Subprocessors (Annex III)
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, database (Workers + Durable Objects), CDN, DDoS protection, inbound email routing, request logs, cookieless aggregate web analytics (public pages only) | Global edge network; data at rest in Cloudflare region(s) chosen automatically | EU–US Data Privacy Framework + SCCs |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (sign-in and reviewer links) | United States | SCCs |
| GitHub, Inc. (Microsoft) | Source of org membership / collaborator data; executes revocations the customer approves | United States | EU–US Data Privacy Framework + SCCs |
| Microsoft Corporation (Entra ID / Microsoft Graph) | Source of directory users, guests, roles and app credentials | Customer tenant region / United States | EU–US Data Privacy Framework + SCCs |
| Stripe, Inc. | Payments, subscriptions, invoices, refunds | United States | EU–US Data Privacy Framework + SCCs |
6. Technical and organisational measures (Annex II)
- Encryption in transit (TLS 1.2+, HSTS); data at rest encrypted by Cloudflare.
- Least-privilege, read-only GitHub App permissions; write actions only on explicit reviewer approval.
- Passwordless sign-in with single-use 15-minute links; signed HttpOnly/Secure/SameSite cookies; strict CSP and anti-framing headers.
- Tenant isolation by account; webhook signatures verified (HMAC-SHA256).
- Tamper-evident hash-chained evidence; internal security audit log; structured logs with PII minimisation and short retention.
- Automated retention jobs deleting expired tokens and aged records.
To sign a countersigned copy, email support@tryaccessproof.com.