Data Processing Agreement

1Parties and scope

This Data Processing Agreement (“DPA”) is between the customer that accepts the Terms of Service for OffSeq Pulse and:

It applies whenever we process personal data on the customer’s behalf in Pulse, and meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). It is part of the Terms: accepting the Terms accepts this DPA, and no signature is needed. If you need a countersigned copy, write to privacy@offseq.com.

Terms such as controller, processor, personal data, data subject, processing and personal data breach have the meaning given in the GDPR.

2Roles

The customer is the controller, and SEQ SIA is the processor, of personal data that the customer’s enrolled devices, users and integrations send to Pulse (“customer personal data”). Where the customer is itself a processor for its own clients, for example a managed service provider, we act as its sub-processor and the customer passes on the commitments in this DPA as needed.

We are a controller, not a processor, for account administration, billing, our own security and legal obligations, as described in our Privacy Policy.

The customer is responsible for the lawfulness of the processing it instructs, including having a legal basis and informing device users about Pulse.

3Details of the processing

Subject matter

Providing Pulse: device security-posture checks, fleet administration and audit evidence.

Duration

For the term of the customer’s use of Pulse, and until deletion under section 12.

Nature

Collection through the agent, storage, organization, analysis against hardening controls, display, export, transmission of remote actions and their results, and deletion.

Purpose

To let the customer assess and improve the security of its devices, act on them remotely and document its work, and to secure and support the service.

Categories of data subjects

• The customer’s employees, contractors and other people who use enrolled devices.
• The customer’s users of the Pulse console.

Categories of personal data

• Device identifiers: hostname, hardware or system identifier, serial number, manufacturer and model, operating system details, agent version.
• Security state: hardening control results such as firewall, disk encryption, antivirus, Secure Boot, updates, USB storage policy, guest account, lockout and screen lock settings, local administrator status.
• Network data: public and local IP addresses, network provider and ASN, nearby Wi-Fi access point identifiers (BSSIDs).
• Location data: approximate location and, where the device’s location services provide it, precise coordinates with accuracy, including on-demand locate requests.
• Usage and health data: resource usage, uptime, battery and power state, idle and screen-lock state, a hash of the signed-in user name.
• Security events: USB storage, security settings, sign-in and privilege, session, power, network and tamper events.
• Remote actions and results, including commands run through the remote shell and their output, which may contain any data on the device that the command reads.
• Console user data: name, email, role, sign-in IP addresses and browser user agents, audit log entries.

Pulse is not designed to process special categories of personal data. The agent does not collect keystrokes, browsing history, screen contents or file contents; the customer decides what its users run in a remote shell.

Retention

The customer can choose shorter periods for posture history and device events in the console.

4Instructions

We process customer personal data only on the customer’s documented instructions. The Terms, this DPA and the customer’s configuration and use of Pulse, including the actions its users take in the console and through the API, are those instructions.

We may process data otherwise only where EU or Member State law requires it; we will tell the customer before we do, unless that law forbids it. We will tell the customer if we believe an instruction breaches data protection law.

5Confidentiality

We ensure that people authorised to process customer personal data are bound by confidentiality and access it only as needed to provide, secure and support Pulse or to follow the customer’s instructions. For Pulse Managed, OffSeq analysts work in the customer’s organization as the customer has agreed.

6Security of processing

We implement the technical and organizational measures in the annex to protect customer personal data, as required by Article 32 GDPR. We may improve these measures over time but will not reduce the overall level of protection. The customer is responsible for the security of its own accounts, devices, API tokens and configuration.

7Sub-processors

The customer authorises us to use the following sub-processors:

Error monitoring runs on a GlitchTip instance operated by OffSeq in the EU, not by a third party. Backups are kept in the EU. IP-address geolocation through ipinfo.io exists in Pulse but is switched off; we will not switch it on without the notice below.

We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for their performance. We will email the account owner at least 30 days before we add or replace a sub-processor. The customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the customer may stop using Pulse before the change takes effect.

8International transfers

Customer personal data is stored in the EU. Cloudflare, Resend and GitHub may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, where applicable, together with any additional measures needed. We will not transfer customer personal data outside the EEA on any other basis than Chapter V GDPR allows.

9Assistance

Taking into account the nature of the processing, we help the customer:

• respond to data subject requests. Much of this the customer can do itself through the console and its exports; if we receive a request directly, we forward it to the customer without undue delay and do not answer it ourselves unless instructed;
• meet its obligations on security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.

We may charge reasonable costs for assistance that goes beyond the features of Pulse.

10Personal data breaches

We will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We notify the account owner by email and, where useful, by phone.

The notice describes, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We provide further information as it becomes available and take reasonable steps to contain the breach.

11Information and audits

On request we make available the information needed to demonstrate compliance with Article 28 GDPR, such as descriptions of our security measures and answers to reasonable security questionnaires.

If that information is not enough, the customer, or an independent auditor bound by confidentiality, may audit our compliance with this DPA. The customer gives reasonable written notice and bears the cost of the audit, including our reasonable costs. Audits take place during business hours, without disrupting the service or revealing other customers’ data.

12Deletion and return

The customer can export its data from the console as CSV or PDF at any time. When the customer deletes an organization or its account, we delete the customer personal data within 30 days, and copies in backups are removed within a further 30 days, unless EU or Member State law requires us to keep it. Ending a paid subscription returns the organization to the free plan and does not delete data.

13Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Terms, except where the GDPR or other law does not allow it to be limited. Nothing in this DPA limits the rights of data subjects.

If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails. If Standard Contractual Clauses apply, they prevail over both. This DPA lasts as long as we process customer personal data. Latvian law governs it.

Notices under this DPA: privacy@offseq.com.

14Annex: technical and organizational measures

Hosting and transport

• Customer data is hosted in a Hetzner data centre in Falkenstein, Germany.
• The console, API and agent connections use TLS. Browsers are told to use HTTPS only (HSTS), and a strict Content Security Policy blocks framing and third-party scripts other than the analytics beacon.
• Cloudflare filters traffic and absorbs denial-of-service attacks before it reaches our servers.

Authentication and sessions

• Passwords are stored as bcrypt hashes.
• Signing in from a browser that is not yet trusted needs a one-time code sent by email. Codes expire after 10 minutes, are stored only as hashes and are locked after repeated failures.
• Session cookies are signed with HMAC-SHA256, HttpOnly, Secure and SameSite. Sessions are recorded server side, expire after 7 days and can be signed out individually.
• State-changing browser requests must come from the Pulse origin, which protects against cross-site request forgery.

Secrets

• Session identifiers, API tokens, enrollment tokens, trusted-browser tokens and device secrets are stored only as SHA-256 hashes.
• Secrets for alert webhooks are encrypted with AES-256-GCM; outgoing webhooks are signed with HMAC-SHA256.

Access control and accountability

• Role-based access with owner, admin, operator and viewer roles and granular permissions. The remote shell needs its own permission, held only by owners and admins by default.
• State-changing operator actions, including remote shell commands, are written to an audit log with the user, time, IP address and browser, and kept for 18 months.
• The application scopes data access to the user’s organization and, for parent organizations, its sub-organizations.

Agent and data handling

• The agent is signed and updates itself; customers roll out new versions in stages.
• Data from devices is validated on arrival: only known fields are kept, values are range-checked and size-limited.
• Requests from devices, users and API tokens are rate-limited.
• Retention is enforced automatically by database expiry and a scheduled sweep, using the periods in section 3.
• Error reports are collected without personal data by default, on monitoring operated by OffSeq in the EU.
• Backups are kept in the EU.

Organization

• Access to production systems is limited to SEQ SIA staff who need it.
• Staff with access are bound by confidentiality.