# Data Processing Agreement (Template)

> **Disclaimer.** This is DeployMeter's standard Data Processing Agreement template, made available for procurement review and for execution as-is. It is a standard template and does not constitute legal advice; each party should obtain its own legal counsel before signing. Where a customer requires a negotiated DPA, contact security@deploymeter.com.

**Version 1.0 — 2026-07-04**

This Data Processing Agreement ("**DPA**") forms part of the agreement for the use of the DeployMeter service (the "**Service**") between:

- **The Customer** (the organization identified in the applicable order or subscription) — the "**Controller**"; and
- **DeployMeter** (the provider of the Service) — the "**Processor**".

Together the "**Parties**". This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("**GDPR**").

## 1. Subject matter and duration

1.1 The Processor processes Personal Data on behalf of the Controller as necessary to provide the Service: analysis of software-delivery activity (pull requests, commits, pipelines, deployments) to produce engineering-productivity metrics and insights.

1.2 This DPA applies for the duration of the Service agreement and until all Personal Data has been deleted or returned in accordance with Section 9.

## 2. Nature and purpose of processing

Collection, structuring, storage, analysis (including AI-assisted analysis of pull-request diffs), aggregation, display to authorized users of the Controller, and deletion — solely for the purpose of providing the Service's engineering-metrics functionality to the Controller.

## 3. Categories of data and data subjects

3.1 **Data subjects**: the Controller's employees, contractors and other contributors to the Controller's source-code repositories; the Controller's administrative and billing contacts.

3.2 **Categories of Personal Data**:

- Developer identifiers: names, email addresses, source-control handles (e.g. GitHub username), avatar URLs.
- Software-delivery metadata: pull-request and commit metadata (titles, descriptions, timestamps, review activity), pipeline and deployment records, issue-tracker references.
- Account data: user names, emails, roles, authentication identifiers.
- Billing metadata: billing contact details, subscription state (payment card data is processed directly by Stripe and never touches the Processor's systems).

3.3 **What is expressly out of scope**: the Processor does not persist the Controller's source code. Pull-request diffs are fetched transiently for analysis and are not stored as source code; only derived metadata and metrics are retained. No special categories of data (Art. 9 GDPR) are intentionally processed, and the Service is not designed to receive them.

## 4. Obligations of the Processor

The Processor shall:

(a) process Personal Data only on documented instructions from the Controller (including this DPA and the Controller's configuration of the Service), unless required otherwise by Union or Member State law, in which case the Processor informs the Controller before processing unless the law prohibits it;

(b) ensure that persons authorized to process Personal Data are bound by confidentiality obligations;

(c) implement the technical and organizational measures described in **Annex II**, taking into account the state of the art, and ensure a level of security appropriate to the risk (Art. 32 GDPR);

(d) respect the conditions for engaging Sub-processors set out in Section 6;

(e) taking into account the nature of the processing, assist the Controller with appropriate technical and organizational measures in fulfilling data-subject requests (access, rectification, erasure, restriction, portability) — including through the Service's self-service export, anonymization and deletion workflows;

(f) assist the Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs), taking into account the information available to the Processor;

(g) notify the Controller **without undue delay and in any event within 72 hours** after becoming aware of a Personal Data breach affecting the Controller's data, providing the information required by Article 33(3) GDPR as it becomes available;

(h) at the Controller's choice, delete or return all Personal Data at the end of the provision of the Service, in accordance with Section 9;

(i) make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits conducted in accordance with Section 8.

## 5. Obligations of the Controller

The Controller warrants that it has a lawful basis for the processing instructed under this DPA, that its instructions comply with applicable law, and that it has provided any required notices to data subjects. The Controller is responsible for the accuracy of the data it connects to the Service and for its own configuration of access roles and visibility policies within the Service.

## 6. Sub-processors

6.1 The Controller grants a **general written authorization** for the engagement of the Sub-processors listed in **Annex III**.

6.2 The Processor shall inform the Controller of any intended addition or replacement of Sub-processors **at least 30 days** in advance. The Controller may object on reasonable data-protection grounds within that period; if the Parties cannot resolve the objection in good faith, the Controller may terminate the affected Service with pro-rata refund of prepaid fees.

6.3 The Processor imposes on each Sub-processor, by contract, data-protection obligations materially equivalent to this DPA, and remains fully liable to the Controller for the Sub-processor's performance.

## 7. International transfers

7.1 Production data is hosted in Germany (EU). Where a Sub-processor processes Personal Data outside the EU/EEA (see Annex III), the transfer is governed by the **Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914** (Module Two or Module Three, as applicable), which are **incorporated by reference** into the Processor's agreement with that Sub-processor, together with any supplementary measures identified in transfer impact assessments.

7.2 The Processor shall not transfer Personal Data outside the EU/EEA other than as described in Annex III without ensuring an Art. 46 GDPR transfer mechanism is in place.

## 8. Audits

8.1 The Processor makes available: this DPA, its published security policies, its trust center, and summaries of any third-party audit reports it obtains (e.g. SOC 2, once available).

8.2 Where the Controller reasonably requires more, the Controller (or a mandated auditor not being a competitor of the Processor) may audit the Processor's compliance with this DPA — at most once per 12 months, on 30 days' notice, during business hours, without disrupting operations, and subject to confidentiality. The Parties first attempt to satisfy the audit through written responses and documentation.

## 9. Deletion and return

9.1 The Controller may export its data at any time through the Service's self-service export.

9.2 Upon termination of the Service, the Processor deletes the Controller's organization data following a **30-day grace period** (during which the Controller can reactivate or export), after which data is permanently deleted from production systems; backup copies expire through the normal backup rotation within a further 35 days. Earlier deletion is available on written request.

9.3 The Processor may retain data only where and for as long as Union or Member State law requires, and only for that purpose.

## 10. Liability, precedence, law

10.1 Liability under this DPA is subject to the limitations of liability in the Service agreement, except where GDPR mandates otherwise.

10.2 In case of conflict between this DPA and the Service agreement regarding the processing of Personal Data, this DPA prevails.

10.3 This DPA is governed by the law governing the Service agreement; mandatory GDPR provisions remain unaffected.

---

## Annex I — Details of processing

| Item | Description |
|---|---|
| Subject matter | Engineering-productivity analytics over the Controller's software-delivery data |
| Duration | Term of the Service agreement + deletion period (Section 9) |
| Nature and purpose | See Section 2 |
| Categories of data subjects | See Section 3.1 |
| Categories of Personal Data | See Section 3.2 |
| Special categories | None intentionally processed |
| Frequency | Continuous, while integrations remain connected |
| Retention | Configurable by the Controller within the Service; defaults per plan documentation |

## Annex II — Technical and organizational measures (summary)

- **Encryption at rest**: integration tokens and credentials encrypted with AES-256-GCM before storage; encryption keys held only in the production environment.
- **Encryption in transit**: TLS for all external connections; signature verification on inbound webhooks.
- **Tenant isolation**: all data access scoped to the Controller's organization identifier at the query layer; no cross-tenant access paths.
- **Access control**: deny-by-default role-based access (Owner / Lead / Member) with subtree scoping for leads and a configurable multi-level visibility layer; authentication and MFA via a managed identity provider (Clerk).
- **Audit logging**: append-only audit log of permission changes and sensitive-data access, exportable by the Controller.
- **Data residency**: production hosting in Germany (EU).
- **Operations security**: production changes only via version-controlled, reviewed deployments (CI/CD); SSH key-based access limited to authorized operators; automated database backups with documented restore procedure.
- **Personnel**: all persons with production access bound by confidentiality; quarterly access reviews documented.
- **Incident response**: documented incident response process with 72-hour customer breach notification.
- **Data minimization**: source code not persisted; AI analysis receives diffs and metadata only — never stored credentials or secrets.

## Annex III — Authorized Sub-processors

| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting of production systems | Germany (EU) | n/a (EU processing) |
| Clerk | Authentication and organization management | United States | SCCs (2021/914) |
| Stripe | Billing and payments | United States | SCCs (2021/914) |
| Anthropic | AI analysis of pull-request diffs (transient; no training on API data) | United States | SCCs (2021/914) |
| Slack | Notifications (only if enabled by the Controller) | United States | SCCs (2021/914) |
| GitHub / GitLab | Source-data retrieval per the Controller's own installation | United States / EU | SCCs (2021/914) where applicable |

The current list is also published at the Processor's trust center (`/security`).

---

**Signatures**

| | Controller | Processor |
|---|---|---|
| Name | ____________________ | ____________________ |
| Title | ____________________ | ____________________ |
| Date | ____________________ | ____________________ |
| Signature | ____________________ | ____________________ |