Data Processing Agreement
For business customers. This is the template; to sign it, write to us.
01
Parties and roles
This agreement is between you, the customer, and Support Rapid SRL, IDNO 1013600009516, Vadul lui Vodă, 60, MD-2023, Chișinău, Republic of Moldova. You are the controller of the personal data you bring into EdgeOwl, and we process it for you as your processor.
[TODO legal: roles when the customer is itself a processor for its own clients, as an MSP is]
02
What we process and why
We process this data only to run EdgeOwl for you: backups, updates, checks and alerts, for as long as your account exists.
- Data: account contacts, router records and job logs, and encrypted backups, whose contents we cannot read.
- People: your staff who use the dashboard, and anyone who appears in the configuration of your routers.
03
Our obligations
[TODO legal: documented instructions, confidentiality, help with data subject requests, audits]
04
Security measures
- Backups are encrypted with your age key before upload. We keep the public half only, so we have no way to open them.
- Router passwords are encrypted at rest in our database; the key lives only in the app's environment, not in the database.
- On each router we use a dedicated user with only the policies backups and updates need, and the router's firewall limits where it can be reached from. You can revoke it at any time.
The full description is on the Security page.
05
Sub-processors
| Sub-processor | Purpose and location |
|---|---|
| Railway | App hosting and database: accounts, router records, job logs. EU West, Amsterdam. |
| Cloudflare | DNS and proxy for app.edgeowl.org. Global network. |
| Resend | Account mail and email alerts. EU region, Ireland. |
| Paddle | Payments, invoices and taxes as merchant of record. United Kingdom. |
| Amazon S3 | Your backups, encrypted with your key before upload. eu-central-1, Frankfurt, Germany. |
| Hetzner | Hub for Relay tunnels, for routers without a public IP. Germany. |
| Telegram | Alerts to the chat you connect. |
[TODO legal: how we notify you of a change and how you can object]
06
Locations and transfers
Backups and the database stay in the EU: Amsterdam (Railway) and Frankfurt (Amazon S3). Payments go through Paddle (UK), DNS and proxy through Cloudflare's global network.
EdgeOwl is operated by Support Rapid SRL in the Republic of Moldova.
[TODO legal: transfer mechanism for Moldova, Paddle in the UK and Cloudflare]
07
Personal data breaches
[TODO legal: when and how we notify you of a breach]
08
When the service ends
You can download your encrypted backups from the dashboard at any time. Backups are kept for 90 days, and each router always keeps at least its last 10 runs. If you delete your account, encrypted backups are deleted after 30 days.
09
Signing
To sign, write to [email protected].
[TODO legal: the final text, the signature process, governing law]