Data Processing Addendum
How AssetHermit processes the personal data in your cloud data on your behalf, under Article 28 of the GDPR.
In effect from until
This is an earlier version, kept so you can read what you agreed to. Read the current version.
Scope and roles
This addendum is part of our Terms of Service between Webscale Oy ("we") and the organization that uses AssetHermit ("you"). It applies to the personal data we process on your behalf in providing AssetHermit ("customer personal data"): you're its controller, and we're your processor. Words such aspersonal data, processing and personal data breach mean what they mean in the GDPR.
Account data, such as who signs in and who pays, and statistics of how AssetHermit's apps are used, counted without naming anyone, are ours as controller, and our Privacy Policy covers them.
The processing
| Subject matter | Providing AssetHermit to the customer, as the Terms of Service describe. |
|---|---|
| Duration | As long as the agreement, and until the data is deleted as this addendum describes. |
| Nature and purpose | Collecting the configuration and cost data of the customer's clouds through access the customer grants, storing it, and making it searchable, with its history, findings, cost reports, notifications and, when the customer turns it on, the AI assistant. |
| Personal data | Whatever personal data the customer's cloud resources and cost exports hold, such as names or email addresses in resource names, tags and settings; the names and email addresses of the customer's people as they appear in notifications, findings and assistant conversations. |
| Data subjects | The customer's employees and contractors, and anyone the customer's cloud data names. |
| Special categories | None intended. The customer doesn't put them in its cloud metadata. |
Instructions
We process customer personal data only on your documented instructions: these terms, and what your organization's people do in AssetHermit, such as connecting a cloud, setting how long history is kept, or turning on the assistant. We tell you if we believe an instruction breaks data protection law. We never use customer personal data for our own purposes, and never to train AI models.
Confidentiality
Everyone at Webscale Oy who may process customer personal data is bound to confidentiality.
Security
We keep technical and organizational measures that protect customer personal data, including:
- Each organization and each workspace has its own infrastructure and its own encryption key. Data is encrypted at rest with that key, and in transit with TLS.
- Cloud access is read-only and keyless: roles, federated identities and principal sets the customer grants and can revoke. We store no cloud credentials.
- Each workspace's collectors and backend run with roles of their own, which reach only that workspace's data.
- Everyone signs in with two-step verification, or through Google or Microsoft as the organization allows.
- Our staff work from a control plane that holds no customer cloud data, and don't read it.
- Error reports hold our own IDs and messages with personal data removed, never request data or payloads.
- Tables keep point-in-time recovery copies for disaster recovery.
Subprocessors
You authorize the subprocessors on our subprocessors page. Each is bound by a contract that protects the data as this addendum does, and we remain responsible for them. We email your organization's owner 30 days before adding or replacing one. If you object on reasonable data protection grounds, you may end the agreement before the change takes effect.
Transfers outside the EEA
Your organization's and each workspace's data stays in the region you chose for it. Where customer personal data goes to a subprocessor outside the EEA, the transfer relies on the EU–US Data Privacy Framework when the subprocessor is certified under it, and on the European Commission's standard contractual clauses (Decision 2021/914) otherwise.
Helping you meet your obligations
- If a person asks us about their data in your clouds, we refer them to you. AssetHermit lets you find and export what it holds; where you need more, we help.
- We give you the information you need for a data protection impact assessment or a prior consultation.
Personal data breaches
We notify your organization's owner without undue delay after becoming aware of a personal data breach affecting customer personal data, with what we know of it, its likely consequences and what we're doing about it, and update you as we learn more.
Deletion at the end
- History is kept for each workspace's own setting (30 days unless you change it or your plan keeps less), and assistant conversations for 30 days.
- A deleted workspace is destroyed 30 days after it's deleted. A deleted organization is destroyed at once.
- Each organization's and workspace's key is deleted 30 days after it, and recovery copies end 35 days after it, so no customer personal data left can be read after 30 days.
Information and audits
We make available the information needed to show we meet this addendum. If that isn't enough, you may audit us once a year, at your own cost, with 30 days' notice, through an auditor bound to confidentiality, in a way that doesn't disclose other customers' data. Write to privacy@assethermit.com.
Liability and precedence
Liability under this addendum follows the Terms of Service. If this addendum and the terms differ on customer personal data, this addendum takes precedence.