Data Processing Addendum
Last updated: [EFFECTIVE DATE]
Draft. This addendum is not in effect yet and still needs a review before launch. It describes the setup as planned. Items in brackets are filled in at launch.
This addendum is part of the Terms of Service between you (the "Customer") and [LEGAL NAME], doing business as Jump Gate Networks ("we"). It applies to personal data stored or handled inside the sites, apps and databases we host for you.
1. Roles
You decide what personal data your site collects and why, so you are the controller. We store and process that data only to host your site, so we are your processor.
2. Processing details
| Subject | Hosting, deploying, monitoring and backing up the Customer's sites, apps and databases. |
|---|---|
| Duration | The life of the service, plus the deletion period in section 8. |
| Nature | Storage, computing, network transmission, backup and restore. |
| Types of data | Whatever the Customer's app stores, such as names, contact details, account data and records. Plus the Customer's own contact details. |
| People affected | The Customer's end users, staff and contacts. |
3. What we commit to
- We process personal data only to provide the service and on your documented instructions. Your service settings and support tickets count as instructions.
- We don't read, use or share the data in your app for any other purpose, unless the law requires it. In that case we tell you first if the law allows.
- Anyone with access to our systems is bound to keep the data confidential.
- We keep the security measures in section 5 in place.
- We help you answer requests from people exercising their data rights, as far as the service allows.
- On reasonable request, once a year, we give you the information you need to check we meet this addendum.
4. Subprocessors
We use these vendors to run the service:
| Vendor | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | DNS, network edge, DDoS protection, encrypted tunnels to our servers, Turnstile bot check | Traffic in transit, IP addresses, request metadata |
| Cloudflare, Inc. (R2) | Off-site backup storage, North America | Backups encrypted before upload. We hold the key, Cloudflare can't read them. |
Code is deployed from your own GitHub repository, so GitHub is your vendor, not ours. Our monitoring alerts carry only site names and status, never data from your app.
Before we add or replace a subprocessor, we email you at least 30 days ahead. If you object on reasonable data protection grounds, we work with you on an alternative. If there isn't one, you can end the affected service without penalty.
5. Security measures
- Isolation: each app runs in its own container with CPU and memory limits. Containers cannot reach each other or our internal network.
- No inbound ports: all public traffic arrives through encrypted Cloudflare tunnels. Our servers accept no direct connections from the internet.
- Encryption in transit: every public site is served over HTTPS.
- Backups: databases every 15 minutes, files nightly, encrypted with AES-256 before leaving our servers, kept 30 days, with regular test restores.
- Secrets: keys and passwords you enter go straight into your app's settings and are never shown again in the dashboard.
- Access: server access is limited to the operator, with SSH keys only. Firewalls block everything not needed.
- Updates: security updates are applied automatically on our servers.
- Monitoring: uptime checks every 30 seconds, with alerts within a minute.
6. Personal data breaches
If we become aware of a breach affecting your personal data, we notify you without undue delay, and no later than 72 hours after we become aware. We tell you what happened, what data is affected, and what we are doing about it, and we keep you updated.
7. Location
Our servers are in the United States. Encrypted backups are stored in North America. Traffic passes through Cloudflare's global network on its way to our servers.
8. End of service
When the service ends, you have 30 days to export your data. Then we delete it from our servers. Copies in backups expire within the following 30 days. On request, we confirm deletion in writing.
9. Contact
Data protection questions: support@jumpgatenetworks.com.