Data processing agreement
Last updated 19 October 2026
This text is a draft under legal review and is not yet in force. It describes how we intend to work at launch.
This data processing agreement (“DPA”) forms part of the terms of service between you (the “Controller”) and Orchec (the “Processor”) when Orchec processes personal data on your behalf.
1. Scope
Orchec processes personal data contained in Customer Data only to provide the Service: managing your servers, running deployments, collecting metrics and logs you configure, storing audit records, and answering AI copilot requests you make.
| Item | Detail |
|---|---|
| Categories of data subjects | Your staff and invitees; end users whose data appears in your logs or databases |
| Categories of data | Names, email addresses, IP addresses, identifiers in logs, and any personal data in databases you manage through Orchec |
| Duration | The term of the agreement plus 90 days for export and deletion |
2. Our obligations
We will:
- process personal data only on your documented instructions, including these terms and your use of the Service;
- make sure everyone with access is bound by confidentiality;
- apply the technical and organizational measures on our security page, including encryption in transit and at rest, envelope-encrypted secrets, least-privilege access and audit logging;
- engage subprocessors only under written terms at least as protective as this DPA, list them on the subprocessors page, and give 30 days’ notice of changes so you can object;
- help you answer data subject requests and meet your security, breach-notification and impact-assessment duties;
- notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data;
- delete or return personal data at the end of the Service, unless the law requires us to keep it;
- make available the information needed to show compliance, and allow reasonable audits.
3. AI processing
Data sent to AI models is limited to what a request needs. Secret values are removed first. Model providers act as our subprocessors, may not train on your data, and on Pro plans and above you can use your own model key instead.
4. International transfers
Where personal data leaves the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism. Counsel to attach the clauses.