Data Processing Addendum

1. Roles and subject matter

You (the customer) are the controller, or a processor acting for your own customers; StitchDB ([Owner: fill in legal entity name]) is your processor or sub-processor (Art. 28 GDPR). Subject matter: hosting and operating your projects. Duration: the term of your contract plus the deletion period below.

Nature and purpose: storage, replication, backup, transmission and deletion of Customer Data as needed to provide the Service. Data subjects and categories: determined by you; typically your end users' account data (e-mail, password hashes, sign-in data) and whatever your application stores. Special categories only if you choose to store them, and then you must apply appropriate safeguards.

2. Instructions

We process Customer Data only on your documented instructions: these terms, your configuration of the Service, and your use of the API, dashboard and CLI. We inform you if we believe an instruction infringes data protection law, and when the law obliges us to process data, unless the law prohibits that information.

3. Confidentiality

Everyone at StitchDB with access to Customer Data is bound to confidentiality. Access is limited to what is needed to operate, secure and support the Service.

4. Security measures

We implement the technical and organisational measures in Annex 1 and keep them up to date. We may improve them as long as the level of protection does not decrease.

5. Subprocessors

You authorize the subprocessors on the Subprocessors page. We announce new subprocessors on that page and by e-mail to account owners at least 30 days in advance; you may object on reasonable data-protection grounds, and if we cannot address the objection you may terminate the affected service. We impose equivalent data protection obligations on every subprocessor and remain responsible for them.

6. International transfers

Customer Data stays in the region you choose for a project. Where a subprocessor processes personal data outside the EU/EEA, we use an adequacy decision or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), modules 2 or 3 as applicable, which are incorporated by reference.

7. Assistance and rights of data subjects

The Service lets you access, correct, export and delete Customer Data yourself (SQL, API, Studio, dumps). If a data subject contacts us about your project we refer them to you. We assist with data protection impact assessments and consultations with authorities to a reasonable extent.

8. Personal data breaches

We notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your Customer Data, with the information available to us, and keep you updated.

9. Deletion and return

When you delete a project, or when the contract ends, we delete the project's Customer Data. Copies in backups are deleted when those backups expire at the end of their retention period. You can export your data before deletion at any time.

10. Audits

On request we provide the information necessary to demonstrate compliance with this addendum. Audits or inspections by you or an auditor you mandate are possible with reasonable notice, during business hours, at your cost, no more than once a year unless required by an authority or after a breach, and subject to confidentiality.

Annex 1: Technical and organisational measures

• Isolation: a separate Postgres database, roles, credentials, JWT secret and API keys per project; extensions that could cross project boundaries are blocked; outbound requests from databases and Edge Functions cannot reach internal networks.
• Encryption: TLS for all API and database connections; provider credentials and secrets encrypted at rest; access tokens stored as hashes; backups encrypted.
• Access control: administrative access to servers by SSH keys only; least-privilege roles for team members; two-factor authentication available for all accounts; audit and activity logs.
• Availability: backups according to plan, optional read replicas, monitoring with alerts, disk guards that prevent full disks, flood protection at network and HTTP level.
• Data centers: Hetzner data centers with physical access control, certified to ISO/IEC 27001.
• Incident handling: on-call alerting, documented restore procedures, breach notification as described above.