Data Processing Agreement

This Data Processing Agreement (DPA) is part of the Terms of Service between the customer (controller) and Simon ApS, Gersonsvej 40, 1., 2900 Hellerup, Denmark, CVR 38213458 (processor). It applies to the personal data of the customer's end users that Anchr.ing processes on the customer's behalf, and meets Article 28 of the GDPR.

1. Subject, duration, nature and purpose

The processor runs an identity service for the controller's apps: it signs end users in, stores their accounts and credentials, issues tokens to the controller's apps, sends sign-in and security mail, and delivers webhooks to endpoints the controller configures. Processing lasts as long as the controller has a project, plus the deletion periods in section 9.

2. Data subjects and data

Data subjects: the controller's end users, invited users and the controller's own project members. Data: email address and verification status, name and picture, profile metadata the controller defines, passkey public keys and metadata, password hashes, encrypted authenticator secrets, hashed recovery codes and tokens, linked external identities (provider, subject, email), organisation memberships and SCIM attributes, sessions (IP address, user agent, times), an audit log and a token issuance log, webhook payloads, mail suppression entries, and in test environments a log of mail not sent. No special categories of data are needed; the controller must not put them in profile metadata.

A session's IP address and browser string are kept for the session's life, at most 14 days (3 days unused, or until the user signs out), and then deleted.

3. Instructions

The processor processes the data only on the controller's documented instructions: these terms, the settings the controller chooses in the dashboard and the admin API, and requests by the controller's end users through the self-service account pages. If the processor believes an instruction breaks data protection law, it tells the controller.

4. Confidentiality

Only people who need it to run or support the service have access, they are bound to confidentiality, and access to a project's user data for support is logged in that project's audit log.

5. Security measures (Article 32)

• Isolation: each project has its own database namespace with separate production and test databases and its own scoped database users; the request-serving process never holds root credentials.
• Secrets: tokens, codes and client secrets are stored as SHA-256 or keyed HMAC hashes, passwords as argon2id; secrets that must be read back (signing keys, authenticator secrets, webhook and upstream client secrets) are encrypted with AES-256-GCM under a data key per project environment, itself encrypted with a master key kept apart from backups.
• In transit: TLS on every connection; sign-in cookies are __Host- cookies, HttpOnly and Secure, with CSRF protection; strict content security policy and no third-party scripts on sign-in pages.
• Sign-in protection: passkeys with user verification, optional or required second factor, rate limits and proof-of-work against guessing, short-lived single-use codes, rotating refresh tokens with reuse detection.
• Accountability: an append-only audit log per environment, a log of every token issued, signed webhook deliveries, guarded outbound requests.
• Operations: regular backups with a tested restore, operator access with a second factor, an external security review before general availability.

6. Sub-processors

The controller authorises the sub-processors on the sub-processor list. The processor tells the controller at least 30 days before adding or replacing one (on that page and by email to project owners); the controller may object on reasonable grounds, and if no solution is found, may end the agreement. The processor imposes the same data protection obligations on each sub-processor and remains responsible for them.

Adyen N.V. (Amsterdam, the Netherlands) processes payments for Anchr.ing's own billing only, that is the controller's payment for its plan, not its end users' data, and is listed on the sub-processor page for that. A controller that charges its own end users with the service's billing features connects its own Adyen account: Adyen is then the controller's payment processor under the controller's own agreement with Adyen, not a sub-processor of ours; the service only passes Adyen the payment instructions the controller configures.

7. Transfers

Service data is stored in the EU (Hetzner, Germany and Finland). Transfers to a country outside the EU/EEA happen only through a listed sub-processor and under an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the EU standard contractual clauses.

8. Assistance, data subject requests and breaches

The service lets the controller answer data subject requests itself: the admin API and dashboard read, correct and delete users, and end users can download their data and delete their account on their own. The processor helps further where needed, and with impact assessments and consultations.

The processor notifies the controller of a personal data breach without undue delay and at the latest 48 hours after becoming aware of it, with what is known about its nature, the data and people affected, the likely consequences and the measures taken, and follows up as more is learned.

9. Deletion and return

Users the controller deletes are removed at once; their entries in the audit and token logs are pseudonymised (the user id and email replaced by a keyed pseudonym, IP address and browser dropped). Audit and token log entries are deleted after the retention the controller sets per environment (30 to 730 days, default 365); finished webhook deliveries after 30 days. When the agreement ends, the controller can export its data first; the processor then deletes the project within 30 days and from backups when they expire, after 30 days.

10. Audits

The processor makes available the information needed to show it meets this DPA, including summaries of security reviews, and allows audits by the controller or an auditor it appoints, with reasonable notice, at most once a year unless there was a breach, and at the controller's cost.

11. Precedence

If this DPA and the Terms of Service conflict on the processing of personal data, this DPA wins. Customers that need a signed copy, or the EU standard contractual clauses as a separate document, write to privacy@anchr.ing.