Data Processing Agreement

It is between the customer (“Controller”) and SigWise (“SigWise”, “Processor”), and forms part of the Terms of Service. Terms such as “personal data” and “processing” have the meaning they have in applicable data protection law.

1. Roles and scope

The Controller decides why and how the personal data in the events and messages it sends to SigWise are processed. SigWise processes that data only to provide the Service the Controller configures (storing events, analyzing them against the Controller's signals, returning answers and firing the Controller's rules and webhooks), on the Controller's documented instructions. The API calls, signals and settings are those instructions.

2. Confidentiality and personnel

SigWise keeps the data confidential and limits access to personnel who need it to run the Service and who are bound by confidentiality obligations.

3. Security

SigWise applies the measures in Annex II and keeps them appropriate to the risk as the Service changes.

4. Sub-processors

The Controller gives general authorization for the sub-processors in Annex III. SigWise will give notice on the Sub-processors page before adding or replacing one. The Controller may object on reasonable data-protection grounds by writing to legal@sigwise.ai; the parties will then work in good faith to resolve it, and if they cannot, the Controller may stop using the affected part of the Service. SigWise imposes data protection obligations on each sub-processor no less protective than these, and stays responsible for their performance.

5. Assistance

SigWise helps the Controller respond to requests from the people whose data it holds, and with data protection impact assessments and consultations with authorities, taking into account the nature of the processing. The Controller can delete everything stored about one of its users with DELETE /v1/objects/{object_id} and can limit how long events are kept (see Annex II). If SigWise receives a request directly from a data subject about Customer Data, it will refer them to the Controller.

6. Personal data breaches

SigWise will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will give the information it has to help the Controller meet its own obligations.

7. Return and deletion

During the term the Controller can delete objects at any time and set the retention policy for events. When the agreement ends, SigWise will delete the Controller's events, answers and settings on request or after a reasonable period, except billing records and other data it must keep by law. The Controller can read and export its answers through the API before then.

8. Audits

SigWise will make available the information needed to show compliance with this agreement and will allow and contribute to reasonable audits by the Controller or its auditor, on reasonable notice, no more than once a year unless a breach requires otherwise, and subject to confidentiality.

9. International transfers

Where processing involves a transfer of personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, the parties will rely on the standard contractual clauses approved for that purpose (controller to processor, and processor to sub-processor), which SigWise will provide on request and which are incorporated by reference.

10. Liability and term

Liability under this agreement is subject to the limits in the Terms of Service. This agreement lasts as long as SigWise processes Customer Data for the Controller.

Annex I: Description of the processing

Annex II: Security measures

• Requests are authenticated with short-lived tokens signed with a per-key secret, bound to a method and path.
• Each account's data is scoped to its account ID.
• API key secrets are encrypted at rest with AES-256-GCM under a versioned master key. Console passwords are bcrypt hashes. Two-factor authentication is available.
• Per-account rate limits and caps on concurrent inline analyses.
• The Controller chooses event retention: forever, a number of days, or only until an analysis has read them. Inline checks can be configured so content is never written. One call deletes an object's data.
• Message content is not written to application logs.
• The hosted API and console are served over HTTPS.

More detail is on the Security page.

Annex III: Sub-processors

The current list, with what each receives, is on the Sub-processors page.