This DPA forms part of your master agreement with Caldyr. We act as Processor for personal data your company uses Caldyr to process.
Sub-processors
UK Dedicated Servers Limited, Coventry, United Kingdom, for hosting: our own hosts with that provider, including the database and its backups. Encrypted copies of the database backups are also kept on a separate host that we operate outside that provider; they cannot be read there, because the key is not stored on that host. Cloudflare, Inc., United States, for domain registration, authoritative DNS, and inbound email routing for @caldyr.ai. Stripe for billing. Plausible Insights OÜ, Estonia, for cookieless analytics: our site supports it, but it is switched off in production today and receives nothing. Outbound email is sent by a mail server we operate ourselves on our own hosts with that same provider, so no third-party email provider is involved. Destinations you configure yourself, such as your SIEM, your object storage, your identity provider or your model provider, are your vendors and not our sub-processors. Notice of new sub-processors at least 30 days in advance.
Processing location and transfers
All processing for the managed service happens on our own hosts with one hosting provider in the United Kingdom. The United Kingdom is outside the EEA, so sending personal data to us from the EEA is an international transfer and you should assess it as one. Cloudflare, Inc. is established in the United States and processes the DNS queries and inbound email described above. We hold no EU-only or EEA-only hosting commitment. Self-hosted deployments process data wherever you run them, and for those we are not a processor.
Security measures
End-to-end encryption covers your personal note vault and every Solo session, including its transcript, agent output and replay frames: the vault key is derived from your passphrase with Argon2id on your device, wrapped to you alone and never escrowed to us, and a Solo session is encrypted on the enrolled host under a key derived from that vault key, so our servers store and relay only ciphertext and your browser decrypts it after you unlock the vault with your passkey or passphrase. We therefore cannot read your personal notes or your Solo sessions, which is also why Solo sessions cannot be searched in the product and we can export them only as ciphertext. For company accounts, secrets, team knowledge, saved agent output and session metadata are encrypted at rest under a per-team key our custody service holds and can unwrap on its own, so that it can index, search, stream and replay them; we can therefore read those classes. Typed commands and session lifecycle records are stored unencrypted; terminal-screen snapshots of company sessions are encrypted at rest under the per-team key. Row-level security isolates tenant rows across more than forty tenant tables; a small number are not yet covered — most are internal audit, billing, and administrative tables, but one holds personal data submitted through the public signup form. A per-company Ed25519-signed, hash-chained audit log makes tampering detectable, not impossible. Traffic between you and the service is TLS, and the disks of our hosts are encrypted at rest. Enrolled hosts can be required to present a client certificate, which is off unless you turn it on; traffic between our own internal services runs over a private container network authenticated by a shared secret, not by mutual TLS.
Return and deletion of data
While your agreement is in force, the company Owner, or the holder of a Solo account, can export the account's data from the product. The export covers the account, hosts, sessions and transcripts, replay frames, knowledge notes, vault notes, the audit log with its signatures, the cost ledger, and configuration and webhooks; an Owner's export contains every member's transcripts and all audit rows of the company. Secret names are included; secret values, key material and derived search indexes (embeddings and chunks) are not. Vault notes and Solo sessions are encrypted for you, so they are exported as ciphertext and decrypted in your browser in the product. Each export needs a TOTP confirmation, is limited to 3 per day, and the archive is kept for 7 days.
The Owner, or the holder of a Solo account, can request erasure of the company or the Solo account from the product. Erasure takes effect after a 30-day grace period, during which the request can be cancelled from the product. At that moment we remove the data from our live systems, from our backups within 30 days, and from our logs within 30 days. The paid period runs out without a refund (the subscription is cancelled at period end), and the Stripe customer is deleted afterwards. If the agreement is terminated and nobody has requested erasure, the Owner or the holder of the Solo account can still export the data and request erasure for 30 days after termination; if nobody does, erasure starts automatically on day 30 and then follows the same rules: live systems at once, backups within 30 days, logs within 30 days, and the Stripe customer deleted. Copies already delivered to your own SIEM destination are yours and erasure does not touch them.
After erasure we keep only: the revoked licence record (tier and identifiers, no personal data); audit accountability rows, which hold identifiers, counts and a hash of the e-mail address, are pseudonymised, not erased, and are kept for 365 days; audit outbox rows; and invoices, which Stripe holds. A member removed from a company stays as a pseudonymised tombstone (no e-mail address, no credentials) while the company exists.
This section implements the GDPR rights of access (Article 15), erasure (Article 17) and data portability (Article 20), and our duty as processor to delete or return customer data at the end of the services (Article 28(3)(g)).