Data processing agreement (DPA)

Version of TODO_LEGAL(DATE_VERSION). Agreement under article 28 of regulation (EU) 2016/679 (“GDPR”), template for business customers.

1. Parties and purpose

This agreement is between the Customer holding a NeverWiped account (the “Controller”) and YOOBOOST SAS, TODO_LEGAL(FORME_JURIDIQUE), SIREN TODO_LEGAL(SIREN), TODO_LEGAL(ADRESSE) (the “Processor”). It is part of the terms of service (https://neverwiped.com/legal/terms) and applies from the first backup.

It covers the processing, by the Processor, of the personal data the Customer may include in their backups and in the metadata of their backups. The Customer’s own account data (identity, billing, team members) is processed by YOOBOOST SAS as controller, under the privacy policy (https://neverwiped.com/legal/privacy).

2. Description of the processing

Key point. Backups are encrypted on the Customer’s server before they are sent, with a key that never leaves that server (restic encryption: AES-256 with Poly1305 authentication). The Processor holds no key: it keeps only a 32-bit check code of the recovery key, which can’t be used to rebuild it. It can’t read or decrypt the data; restores are decrypted on the Customer’s server. Its processing of the content is limited to keeping and deleting encrypted data.

3. The Customer’s instructions

The Processor processes the data only on the Customer’s documented instructions: the terms, this agreement, the backup plan confirmed by the Customer, the chosen plan (frequency, retention, storage), the retention setting chosen for each server (including pausing the pruning) and the actions of the Customer or of their team members in the dashboard or with the agent (backup, restore, deleting a server or the account). The Processor immediately tells the Customer if an instruction seems to breach the law.

4. Processor obligations (GDPR article 28(3))

The Processor agrees to:

• (a) process the data only on documented instructions, including for transfers, unless the law requires otherwise, in which case it informs the Customer first, unless the law forbids it;
• (b) bind the people allowed to access the infrastructure to confidentiality;
• (c) take the article 32 security measures of article 5;
• (d) use sub-processors only under article 6;
• (e) help the Customer answer data subject requests, as far as the nature of the processing allows (the Customer can restore, delete a server or delete the account; the Processor can’t read the data, so it can’t search for a specific item in a backup);
• (f) help the Customer with security, breach notification, impact assessments and prior consultation, as far as its information allows;
• (g) at the end of the service, delete the data under article 10, keeping no copies other than those that article describes, unless the law requires otherwise;
• (h) make available the information needed to show compliance and allow audits under article 9.

5. Security measures

• Client-side encryption of every backup before sending; no key at the Processor.
• The Customer’s server talks to the platform and to the storage over TLS (HTTPS) only; the platform administers the storage over a private encrypted link (WireGuard).
• Storage server disks encrypted at rest (LUKS2): this protects against a lost or replaced disk, not against someone on the running storage server.
• One repository per server, with its own access login limited to that repository; the Processor keeps only a fingerprint (hash) of that login and of the agent key.
• Append-only storage: outside a short pruning window (a login valid for one hour, issued at most once per server per week on the agent’s request), no backup can be deleted or overwritten from the Customer’s server. The platform deletes a repository only in the cases of article 10.
• One copy of the Customer’s backups, on RAID 6 disks: it survives two failed disks, not the loss of the whole storage server.
• Quotas per repository, rate limits on sign-in attempts and API calls.
• Signed agent updates (Ed25519); the signing key is not on the platform.
• Account passwords stored as derived hashes (scrypt); a second factor is available for customer accounts.
• Back office limited to authorised people, with a second factor; every page viewed and every action there is recorded in an audit log. It gives no access to backup content.
• Encrypted backup of the platform on a second site (TODO_LEGAL(SITE_SAUVEGARDE_PLATEFORME), country: TODO_LEGAL(PAYS_SAUVEGARDE_PLATEFORME)), with a written restore procedure.
• Availability monitoring and alerts.

The Processor holds no security certification and promises no availability figure. The security page (https://neverwiped.com/security) describes these measures and their limits; the Processor may change them without lowering the overall level.

6. Sub-processors

The Customer gives a general authorisation for these sub-processors:

The current list is on this page (https://neverwiped.com/legal/dpa). The Processor informs the Customer by email, at the account address, of any new or replaced sub-processor at least thirty (30) days in advance. The Customer may object on legitimate grounds and, failing agreement, cancel at no cost before the change takes effect. The Processor imposes, by contract, data protection obligations equivalent to this agreement on each sub-processor and remains liable for them.

7. Location and transfers

Backup content. Backups, encrypted on the Customer’s server, are sent by the agent straight to the storage server in France and restored straight from it. They don’t pass through the platform and are not transferred outside the European Union.

Backup metadata. The platform (website, dashboard, API, database) is hosted in the European Union by TODO_LEGAL(HEBERGEUR_PLATEFORME) (TODO_LEGAL(PAYS_HEBERGEUR_PLATEFORME)). Backup metadata is processed there; this hosting does not fall under chapter V of the GDPR.

Other sub-processors. The location of the email provider and possible transfers by Mollie’s own sub-processors are not checked yet: TODO_LEGAL(location and safeguards of the email and payment sub-processors). The Processor gives the Customer the current list and the applicable safeguards on request.

Platform backup. The encrypted backup of the platform database is kept on a second site (TODO_LEGAL(SITE_SAUVEGARDE_PLATEFORME), country: TODO_LEGAL(PAYS_SAUVEGARDE_PLATEFORME)); outside the EEA without an adequacy decision, it is covered by the standard contractual clauses on the same terms.

8. Personal data breaches

The Processor notifies the Customer of any personal data breach it becomes aware of within forty-eight (48) hours, by email to the account address, with the information available (nature, categories and approximate volume, likely consequences, measures taken, contact). Information not yet known is sent as soon as possible, in stages. The Customer, as controller, notifies the supervisory authority and the data subjects where required. Because of client-side encryption, a breach of the storage exposes only encrypted data; a breach of the platform may expose metadata.

9. Audits

The Processor provides the documentation of its security measures on request and answers the Customer’s reasonable security questionnaires. The Customer may have an audit carried out, at its own cost, once a year with thirty (30) days’ notice, by an independent auditor bound by confidentiality, in a way that doesn’t compromise other customers’ security. An additional audit is possible after a personal data breach affecting the Customer or at the request of a supervisory authority.

10. Data at the end of the service

• Deleting a server in the dashboard: its backups are deleted immediately.
• Deleting the account: the backups of all its servers are deleted 7 days after the Customer’s request, which can be canceled until then; they are checked gone from the storage before the account is deleted.
• Cancellation: deleted 30 days after the end of the paid period.
• Unpaid amount not settled: deleted 45 days after the failed payment.
• End of a trial without subscription: deleted 7 days after the end of the trial.

Backup content exists in a single copy, on the storage server: no copy of it remains at the Processor after these deletions. Metadata deleted from the platform remains, encrypted, in the platform’s backups until they rotate out, at most 12 months, and in the platform’s disk images kept by the host (at most 7 days); it is used there only to restore the platform after an incident.

Until then, the Customer can restore their data with the agent. The Processor can’t return it in any other form, as it doesn’t hold the key.

11. Customer obligations

The Customer ensures a legal basis for the data it backs up, informs the data subjects, keeps its recovery key and tests its restores. It alone chooses which data is backed up. It is responsible for the members it invites to its team: their actions in the dashboard count as the Customer’s instructions.

12. Term

This agreement applies for the whole service and until the data is actually deleted (article 10).

13. Conclusion, signed copy and changes

This agreement is accepted with the terms at sign-up, in electronic form (GDPR article 28(9)). A business Customer who wants a signed copy gets one on request at TODO_LEGAL(EMAIL_RGPD): the parties then sign the version in force, with the annex below filled in, without changing the text. If this agreement and the terms conflict on personal data protection, this agreement prevails.

The Processor may update this agreement; any change that lowers data protection is notified by email at least thirty (30) days in advance, and the Customer may cancel at no cost before it takes effect.

Contact for any question about this agreement: TODO_LEGAL(EMAIL_RGPD).

Annex — Signature page (optional signed copy)

Version of the agreement signed: TODO_LEGAL(DATE_VERSION).