Data processing agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of service between Stack Forward LLC (Stack Forward合同会社) (“Haarness”, the processor) and the customer that uses Haarness Cloud for a business purpose (the customer, the controller). It applies when Haarness processes personal data contained in Customer Content — the files, repositories, prompts, conversations, agent outputs and other data the customer puts into or creates with the Service — on the customer's behalf, and that processing is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. It is accepted by using the Service for business purposes; a signed copy is available from [email protected].

Personal data about the customer's own users of the Service as account holders (their accounts, sign-ins and billing) is processed by Haarness as a controller under the Privacy policy.

1. Details of the processing

2. Instructions

Haarness processes Customer Content only on the customer's documented instructions, which are these terms and the customer's use and configuration of the Service, unless the law requires otherwise — in which case Haarness informs the customer first unless the law prohibits it. Haarness informs the customer if it believes an instruction infringes data-protection law.

Haarness does not sell Customer Content, does not use it to train AI models, and does not combine it with other data except as needed to provide the Service.

3. Confidentiality

Everyone at Haarness authorised to process Customer Content is bound by confidentiality, and access is limited to what is needed to operate, support and secure the Service.

4. Security

Haarness implements the technical and organisational measures in the Annex and keeps them at a level appropriate to the risk. It may update them if the protection is not reduced.

5. Subprocessors

The customer authorises Haarness to engage the subprocessors listed on Subprocessors. Haarness gives at least 30 days' notice of a new subprocessor by updating that page and, on request, by email. The customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the customer may terminate the affected Service and receive a refund of prepaid, unused fees. Haarness imposes data-protection obligations on each subprocessor equivalent to this DPA and remains responsible for its subprocessors.

6. International transfers

Where Customer Content is transferred to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision 2021/914, module two or three as applicable), the UK International Data Transfer Addendum, or another valid transfer mechanism, which are incorporated by reference.

7. Assistance

Taking into account the nature of the processing, Haarness assists the customer with:

• data-subject requests — mostly through the Service itself (the customer can read, export and delete Customer Content); Haarness forwards any request it receives directly;
• security, breach notification, impact assessments and prior consultation, with the information available to it.

8. Personal data breaches

Haarness notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Content, with the information the customer needs to meet its own obligations, and keeps it informed as the investigation progresses.

9. Deletion and return

The customer can export and delete Customer Content at any time through the Service. When the customer's account is closed, Haarness deletes the remaining Customer Content — workspace volumes, backups and exports — within 30 days, unless the law requires it to be kept.

10. Audits

Haarness makes available the information necessary to demonstrate compliance with this DPA, and answers reasonable security questionnaires. Where that is not sufficient, the customer may conduct an audit — itself or through an independent auditor bound by confidentiality — once a year on 30 days' notice, at its own cost, in a way that does not compromise other customers' data.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of service, to the extent the law allows. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Content; the Standard Contractual Clauses prevail over both.

Annex — Technical and organisational measures

• Isolation. Each workspace runs on its own virtual machine with its own volume; the attach gateway connects a client only to the workspace named in its short-lived, signed ticket.
• Encryption. TLS for all traffic to the Service. Workspace volumes are encrypted at rest. Secrets supplied to agents (SSH identities, environment values) are encrypted at the application level.
• Authentication. Passwords are hashed with Argon2. Session tokens, API keys, router keys and attach tickets are stored as hashes. Browser sessions use HttpOnly, Secure cookies with CSRF protection; native clients use short-lived access tokens with rotating refresh-token families and reuse detection.
• Access control. Tenant scoping on every account, project and workspace query; least-privilege access for staff; administrative actions and billing adjustments are recorded in an append-only audit trail.
• Data minimisation. Metering records never contain prompt content; request logs record the route pattern rather than the path and contain no IP addresses, query strings, headers, request bodies or credentials; provider error messages are stripped of email addresses and credentials before they are logged.
• Resilience. Workspace backups (the 7 most recent are kept) and on-demand exports.
• Vulnerability management. Pinned, reviewed dependencies; a public vulnerability-disclosure policy at Security.