Data Processing Agreement

Last updated: July 2026

1. Purpose

This Data Processing Agreement ("DPA") governs the processing of personal data by vaultsuite.dev ("Processor") on behalf of the customer ("Controller") when using the vaultsuite.dev service.

This DPA is incorporated into and forms part of the Terms of Service between the Controller and Processor.

2. Definitions

Capitalized terms have the meanings given in the GDPR (Regulation (EU) 2016/679). Key definitions:

  • "Controller" — the customer who determines the purposes and means of processing
  • "Processor" — vaultsuite.dev, which processes personal data on behalf of the Controller
  • "Personal Data" — any information relating to an identified or identifiable natural person
  • "Processing" — any operation performed on personal data (collection, storage, use, deletion, etc.)
  • "GDPR" — the General Data Protection Regulation (EU) 2016/679

3. Scope

This DPA applies when the Controller uses the vaultsuite.dev service to store or process personal data. Due to the end-to-end encryption architecture, the Processor has minimal access to the content of documents — only encrypted ciphertext is stored.

4. Obligations of the Processor

The Processor shall:

  • Process personal data only on documented instructions from the Controller (via the Service's functionality)
  • Ensure that persons authorized to process personal data have committed themselves to confidentiality
  • Implement appropriate technical and organizational measures to ensure security (see Security page)
  • Not engage another subprocessor without prior authorization from the Controller (see subprocessor list)
  • Assist the Controller in responding to data subject requests (access, rectification, erasure, etc.)
  • Assist the Controller in ensuring compliance with GDPR obligations (security, breach notification, DPIAs)
  • Delete or return all personal data after the end of the provisioning period
  • Make available all information necessary to demonstrate compliance and allow for audits

5. Obligations of the Controller

The Controller shall:

  • Ensure that the processing of personal data has a lawful basis under GDPR
  • Provide clear instructions to the Processor (via the Service's functionality)
  • Be responsible for ensuring that the processing complies with GDPR
  • Notify the Processor if it believes an instruction infringes GDPR

6. Security measures

The Processor implements the following technical and organizational measures:

  • Pseudonymization and encryption: all documents are end-to-end encrypted; backups are encrypted at rest
  • Confidentiality: access controls, audit logging, staff confidentiality agreements
  • Integrity: daily encrypted volume snapshots (14-day retention)
  • Availability: redundant infrastructure, monitoring, incident response plan
  • Resilience: regular testing of security measures

7. Subprocessors

The Controller authorizes the Processor to engage the subprocessors listed at vaultsuite.dev/legal/subprocessors. The Processor will notify the Controller of any changes to the subprocessor list.

8. International transfers

All data is stored in the European Union. The Processor does not transfer personal data outside the EEA. Where subprocessors are outside the EEA (if any), the Processor will ensure appropriate safeguards are in place (e.g., EU Standard Contractual Clauses).

9. Data subject rights

The Processor will assist the Controller in responding to data subject requests under GDPR (access, rectification, erasure, portability, etc.). The Controller is responsible for determining the appropriate response; the Processor will provide technical assistance.

10. Breach notification

The Processor will notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a personal data breach. The notification will include:

  • Description of the nature of the breach
  • Categories and approximate number of data subjects affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach

11. Audits

The Controller may audit the Processor's compliance with this DPA. Audits must be scheduled in advance and conducted in a way that minimizes disruption to the Service. The Processor will cooperate reasonably with audits.

12. Duration and termination

This DPA remains in effect for as long as the Controller uses the Service. Upon termination, the Processor deletes all personal data immediately; residual encrypted backup snapshots age out automatically within 14 days (see the Terms of Service).

13. Governing law

This DPA is governed by the laws of the European Union. Any disputes will be resolved in the courts of the member state where the Processor is established.

14. Contact

For questions about this DPA, contact us at privacy@vaultsuite.dev.