Data processing agreement
The terms on which we process personal data on a customer’s behalf in Two Weeks Cloud. This is a draft for legal review.
[LEGAL REVIEW REQUIRED] This is a skeleton that lists what GDPR Article 28(3) requires and the facts the product supports. A solicitor must draft the operative clauses. Do not offer it for signature as it stands.
Scope and roles
This agreement applies to personal data that a customer puts into Two Weeks Cloud (“customer data”). For that data the customer is the controller and [COMPANY NAME] is the processor. It does not apply to personal data we control ourselves, which the privacy policy covers.
Details of processing
| Subject matter | Hosting and operating Two Weeks Cloud for the customer. |
|---|---|
| Duration | For as long as the customer has a Cloud organisation, then until deletion (see Deletion and return). |
| Nature and purpose | Storing and displaying estimation sessions, tickets, votes and comments; authenticating members; importing tickets from and writing estimates back to Jira and GitLab at the customer’s request; sending service emails; billing. |
| Data subjects | The customer’s organisation members and administrators, session participants, and people named in imported tickets and comments. |
| Types of personal data | Email address, username and display name, password hash or linked sign-in identity, login session records, role and membership, participant display names, votes and comments, ticket titles and links, integration access tokens (encrypted), billing contact and subscription status. |
| Special categories | None are intended. Customers should not put special-category data into tickets or comments. [LAWFUL BASIS TO CONFIRM] |
Our obligations
As processor we will:
- process customer data only on the customer’s documented instructions, which are this agreement and the customer’s use of the product;
- make sure people who handle customer data are bound by confidentiality;
- apply the security measures below;
- engage sub-processors only as set out below;
- help the customer respond to data subjects, meet security and breach duties, and carry out impact assessments;
- delete or return customer data at the end of the agreement; and
- give the customer the information needed to show we comply, and allow audits.
[LEGAL REVIEW REQUIRED] Draft the operative clauses, including how we tell the customer if an instruction seems unlawful.
Security measures
Annex 2 describes measures that exist in the product today. The security page is the up-to-date list, with the work that implemented each measure, and also lists what is not done.
- Integration tokens are encrypted at rest with AES-256-GCM and never returned to the browser.
- Session, bearer and admin tokens are stored only as hashes.
- Passwords are hashed with bcrypt, with per-account login backoff and rate limits.
- Each organisation is an isolated tenant, enforced by an access policy and tested route by route.
- Requests and WebSocket messages are validated; outbound calls to Jira and GitLab go through an SSRF-safe fetch.
- Security headers are set on every response, and CodeQL, Dependabot, npm audit, gitleaks and image scanning run in CI.
Not done yet: no independent penetration test, no SOC 2 or ISO 27001 certification, backup schedule and hosting region not announced.
Sub-processors
The customer gives general authorisation for the sub-processors on the sub-processors page. We will tell customers before adding or replacing one: [SUB-PROCESSOR CHANGE NOTICE PERIOD]. We will put the same data protection duties on each sub-processor and remain responsible for them.
Helping with rights requests
If a data subject asks us for access, correction, deletion or another right over customer data, we will pass the request to the customer and help them answer it. Self-service export and deletion tools are planned and not built yet; until they ship we help by hand within [REQUEST RESPONSE TIME].
Personal data breaches
We will tell the customer without undue delay after becoming aware of a personal data breach affecting customer data, and within [BREACH NOTIFICATION WINDOW], with the information we have and what we are doing about it.
International transfers
Cloud data is stored in [HOSTING REGION] with [HOSTING PROVIDER]. Transfers outside the UK and EEA rely on [INTERNATIONAL TRANSFER MECHANISM].
Deletion and return
When the agreement ends we will delete customer data, or return it on request, within [END-OF-CONTRACT DELETION WINDOW], unless the law requires us to keep it. Backups age out after [BACKUP RETENTION PERIOD].
Audits
We will answer reasonable security and compliance questions and allow audits as the law requires. We do not hold independent certifications yet.
[LEGAL REVIEW REQUIRED] Define the audit process, frequency, cost and confidentiality terms.
Signing
How customers accept this agreement: [DPA SIGNING PROCESS]. Governing law: [GOVERNING LAW].