Data Processing Addendum

Scope and roles

This addendum is part of our Terms of Service between Webscale Oy ("we") and the organization that uses AssetHermit ("you"). It applies to the personal data we process on your behalf in providing AssetHermit ("customer personal data"): you're its controller, and we're your processor. Words such aspersonal data, processing and personal data breach mean what they mean in the GDPR.

Account data, such as who signs in and who pays, and statistics of how AssetHermit's apps are used, counted without naming anyone, are ours as controller, and our Privacy Policy covers them.

The processing

Subject matter	Providing AssetHermit to the customer, as the Terms of Service describe.
Duration	As long as the agreement, and until the data is deleted as this addendum describes.
Nature and purpose	Collecting the configuration and cost data of the customer's clouds through access the customer grants, storing it, and making it searchable, with its history, findings, cost reports, notifications and, when the customer turns it on, the AI assistant. Support and troubleshooting: when the customer allows it on a support case, reading the logs of the customer's AssetHermit services to find and fix a problem.
Personal data	Whatever personal data the customer's cloud resources and cost exports hold, such as names or email addresses in resource names, tags and settings; the names and email addresses of the customer's people as they appear in notifications, findings and assistant conversations.
Data subjects	The customer's employees and contractors, and anyone the customer's cloud data names.
Special categories	None intended. The customer doesn't put them in its cloud metadata.

Instructions

We process customer personal data only on your documented instructions: these terms, and what your organization's people do in AssetHermit, such as connecting a cloud, setting how long history is kept, turning on the assistant, or letting our staff read your logs on a support case. We tell you if we believe an instruction breaks data protection law. We never use customer personal data for our own purposes, and never to train AI models.

Confidentiality

Everyone at Webscale Oy who may process customer personal data is bound to confidentiality.

Security

We keep technical and organizational measures that protect customer personal data, including:

Each organization and each workspace has its own infrastructure and its own encryption key. Data is encrypted at rest with that key, and in transit with TLS.
Cloud access is read-only and keyless: roles, federated identities and principal sets the customer grants and can revoke. We store no cloud credentials.
Each workspace's collectors and backend run with roles of their own, which reach only that workspace's data.
Everyone signs in with two-step verification, or through Google or Microsoft as the organization allows.
Our staff work from a control plane that holds no customer cloud data. They read your logs only when you allow it on a support case, through a recorded tool, and you see every read. In an emergency they may use recorded break-glass access to the account that hosts you, and we tell you when they did.
Error reports hold our own IDs and messages with personal data removed, never request data or payloads.
Tables keep point-in-time recovery copies for disaster recovery.

Staff access to your data

Your AssetHermit services' logs record what they did with your requests and runs: errors, timings, request routes, and the names of cloud resources as your clouds returned them. Some problems can only be fixed by reading them.

Our staff read your logs only with your permission, given on a support case by your organization's owner or an admin, or by a workspace's admins for that workspace's logs. A permission names which logs, lasts up to 7 days, reaches logs from up to 7 days before it was given, and ends early when you revoke it or the case is resolved or closed.
Staff read through a recorded tool that runs one limited query at a time, never through their own access to the account. Client IP addresses and email addresses are masked. The lines are shown only on the staff member's screen and are stored nowhere.
You see every read: who read, when, which logs, the time window and how many lines, on the case and in your organization's settings, kept for 1 year. Whoever gave the permission is emailed when it's first used.
In an emergency, such as a service that's down, a failed deployment, a restore or a security incident, a staff administrator may use temporary break-glass access to the AWS account that hosts your organization. It's given to one person for at most an hour and recorded, and afterwards they write down what they did and whose data, if any, they read.
If a break-glass session read your data, we email your organization's owner within 2 business days of that record, and the session appears in your organization's settings. We may wait while telling you would hinder the investigation of a security incident, and tell you as soon as it no longer would. A personal data breach is notified as Personal data breaches says.

Subprocessors

You authorize the subprocessors on our subprocessors page. Each is bound by a contract that protects the data as this addendum does, and we remain responsible for them. We email your organization's owner 30 days before adding or replacing one. If you object on reasonable data protection grounds, you may end the agreement before the change takes effect.

Transfers outside the EEA

Your organization's and each workspace's data stays in the region you chose for it. When our staff read your logs on a support case, the lines pass through our control plane in Stockholm on their way to the staff member's screen, and are stored nowhere. Where customer personal data goes to a subprocessor outside the EEA, the transfer relies on the EU–US Data Privacy Framework when the subprocessor is certified under it, and on the European Commission's standard contractual clauses (Decision 2021/914) otherwise.

Helping you meet your obligations

If a person asks us about their data in your clouds, we refer them to you. AssetHermit lets you find and export what it holds; where you need more, we help.
We give you the information you need for a data protection impact assessment or a prior consultation.

Personal data breaches

We notify your organization's owner without undue delay after becoming aware of a personal data breach affecting customer personal data, with what we know of it, its likely consequences and what we're doing about it, and update you as we learn more.

Deletion at the end

History is kept for each workspace's own setting (30 days unless you change it or your plan keeps less), and assistant conversations for 30 days.
A deleted workspace is destroyed 30 days after it's deleted. A deleted organization is destroyed at once.
Each organization's and workspace's key is deleted 30 days after it, and recovery copies end 35 days after it, so no customer personal data left can be read after 30 days.

Information and audits

We make available the information needed to show we meet this addendum. If that isn't enough, you may audit us once a year, at your own cost, with 30 days' notice, through an auditor bound to confidentiality, in a way that doesn't disclose other customers' data. Write to privacy@assethermit.com.

Liability and precedence

Liability under this addendum follows the Terms of Service. If this addendum and the terms differ on customer personal data, this addendum takes precedence.