Skip to main content

​
Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) supplements the Terms of Service between Foalk, Inc. (“Processor”, “we”, “us”) and the customer entity agreeing to these terms (“Controller”, “Customer”, “you”). It applies where and to the extent that Processor processes Personal Data on behalf of Controller in the course of providing the Qumo Deploy service.

​
1. Roles and Scope of Processing

  • Controller & Processor: Customer acts as the Data Controller (or Processor acting on behalf of a third-party Controller), and Foalk, Inc. acts as the Data Processor.
  • Subject Matter & Purpose: The subject matter of data processing is the performance of the Qumo Deploy relay network operation, verification-key (signing key) management, usage metering, and organization management.
  • Duration: The term of this DPA corresponds to the duration of your active subscription or account registration.

​
2. Customer Instructions

Processor shall process Personal Data exclusively upon documented instructions from Controller, including with respect to transfers of Personal Data to third countries or international organizations, unless required to do so by applicable European Union or Member State law.

​
3. Confidentiality & Personnel

Processor ensures that all personnel authorized to process Customer Personal Data:
  1. Have committed themselves to strict confidentiality or are under an appropriate statutory obligation of confidentiality.
  2. Access systems only with the least privilege their work requires.

​
4. Technical and Organizational Measures (TOMs)

Processor maintains industry-standard technical and organizational measures to ensure a level of security appropriate to the operational risk, including:
  • Data In Transit: Every connection is encrypted: HTTPS for the console and the REST API, TLS 1.3 for relay connections over QUIC and WebTransport, and TLS 1.2 or later for the WebSocket fallback.
  • Data At Rest: The hosting providers encrypt stored data, including the CockroachDB database and its backups, and the Oracle Cloud Object Storage bucket that receives a daily export of the audit log, where it cannot be changed or deleted for 90 days. GitHub access tokens from connected accounts, notification recipients (email addresses and webhook URLs) and webhook signing secrets, two-factor (TOTP) secrets, and audit log webhook URLs and signing secrets are additionally encrypted by the application with AES-256-GCM.
  • Credential Protection: Personal access tokens and Identity tokens are stored only as SHA-256 hashes, never in plain text. Relay credentials are signed by customer-held Ed25519 keys, and Qumo stores only the public keys.
  • Vulnerability Scanning: Every change to the Go code runs static analysis and a Go vulnerability check, and Go dependencies and CI actions are kept current with automated updates.

​
5. Approved Sub-Processors

Controller grants Processor general written authorization to engage the sub-processors listed, with their purpose and location, in section 4 of the Privacy Policy. That list is the single list of Processor’s sub-processors. Processor shall notify Controller at least 30 days in advance of adding or replacing any sub-processor by updating that list and notifying designated administrative contacts.

​
6. Personal Data Breach Notification

Processor shall notify Controller without undue delay (and in any event within 48 hours) upon becoming aware of a confirmed Personal Data Breach affecting Controller’s data. The notification shall describe:
  1. The nature of the breach, including categories and approximate numbers of data subjects and records concerned.
  2. The name and contact details of our Data Protection Officer or security representative.
  3. The likely consequences of the incident and remediation measures taken or planned.

​
7. Audit & Data Subject Rights

  • Data Subject Requests: Each user can export (GET /v1/users/me/export) or delete (DELETE /v1/users/me) their own account data from the console. Processor handles other data subject requests on request to [email protected].
  • Compliance Audits: Processor shall make available to Controller all information reasonably necessary to demonstrate compliance with GDPR Article 28, allowing for audits and reviews conducted by Controller or an independent auditor.

​
8. Execution of a Signed DPA

Customers requiring an individually executed, signed copy of this DPA (including standard contractual clauses for international data transfers) may contact our legal compliance team at: