Data Processing Agreement
Data Processing Agreement
Last updated 2026-07-16.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Controller”) and Robin Frehner – Protet, Switzerland (the “Processor”, “we”) and applies where we process personal data on your behalf as part of the cloud-hosted tier. By using the cloud-hosted tier you accept this DPA. A countersigned copy is available on request at admin@protet.io.
1. Roles
You are the controller of the personal data processed through the service; we act as your processor and process that data only to provide the service and on your documented instructions (these terms and your configuration being such instructions). For on-prem deployments we do not receive your telemetry and are not your processor of it; see the EULA.
2. Subject matter, nature and purpose
Real-time detection of malicious or compromised behavior on your CI/CD build runners, and operation of your account. Processing lasts for the duration of your use of the service.
3. Categories of personal data
- Build-session telemetry: process-execution (execve) events — commands, arguments, and process/pod identifiers. These may incidentally contain usernames, file paths, IP addresses, hostnames, or secrets embedded in command lines.
- Account data: names and email addresses of your users, and billing details.
4. Categories of data subjects
Your developers, operators, and service accounts whose build activity is processed, and your account users.
5. Our obligations
- Process personal data only on your documented instructions, including for transfers, unless required otherwise by law (in which case we inform you where legally permitted).
- Ensure persons authorized to process the data are bound by confidentiality.
- Implement appropriate technical and organizational measures (see section 7).
- Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations.
- Delete or return the data at the end of the service, subject to section 8.
- Make available information necessary to demonstrate compliance and allow for and contribute to audits, on reasonable notice and subject to confidentiality.
6. Data minimization
Build-session telemetry is processed transiently to produce findings and is not persisted: findings are delivered in real time and not stored. We retain only aggregate usage counters for billing.
7. Security
We maintain appropriate technical and organizational measures, including: encryption in transit and at rest for sensitive fields; Argon2 password hashing; role-based access control and tenant isolation; short-lived access tokens; signed licenses and model bundles; audit logging; secrets management; and separation of environments. Details are available on request.
8. Sub-processors
You authorize us to engage the following sub-processors:
- Infomaniak (Switzerland) — hosting and transactional email.
- Stripe (Ireland / USA) — payment and subscription processing.
We will inform you of any intended addition or replacement of a sub-processor and give you the opportunity to object on reasonable data-protection grounds. Each sub-processor is bound by data-protection obligations no less protective than this DPA.
9. International transfers
Personal data is hosted in Switzerland. Where a sub-processor is located outside Switzerland or the EEA, transfers are safeguarded by standard contractual clauses and applicable data-transfer frameworks.
10. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations.
11. Deletion and return
Telemetry is not retained. Account and billing data are deleted or returned on termination as described in our Privacy Policy, except where retention is required by law (e.g. accounting records).
12. Governing law
This DPA is governed by Swiss law and follows the governing-law and jurisdiction provisions of the Terms of Service.