Data Processing Addendum

What we commit to when we process personal data for you: in your sandboxes, their files, commands and output, the email they receive, and what you send through agental. It is part of the Terms of Service, and needs no signature.

Last updated 4 November 2026

Roles#

For personal data in your content, you are the controller, or a processor acting for your own customer, and we are your processor, or sub-processor. This addendum sets out the terms Article 28 of the GDPR (Regulation (EU) 2016/679) requires. For data about you as our customer, we are the controller, under the Privacy Policy.

The processing#

Our commitments#

• We process the data only on your documented instructions: the Terms, the settings you choose, and your requests to the API, the console and the command-line tool. If the law requires other processing, we tell you first, unless the law forbids it. If we think an instruction breaks data protection law, we tell you.
• Everyone at our company who can access the data is bound to keep it confidential.
• We take the security measures listed below, and keep them current.
• We help you answer requests from data subjects. The API lets you read, copy and delete your content at any time; we help further if you ask.
• We help you with security, with data protection impact assessments and with consulting an authority, as far as the nature of the processing and the information we hold allow.
• We tell you about a personal data breach affecting your data without undue delay, and no later than 48 hours after we become aware of it, with what we know at the time and updates as we learn more.
• You can copy and delete your content at any time. A closed account's content is erased 30 days after it was closed, or at once if you erase it, unless the law requires us to keep it. The sandboxes and snapshots of an account that has had no plan, or has owed for what it used, for 30 days are deleted, after we email you.
• We give you the information you need to show that these obligations are met. If that is not enough, you may audit us once a year, at your cost, with 30 days' notice, through an auditor bound to confidentiality, and without access to other customers' data.

Subprocessors#

You authorise us to use the subprocessors on the Subprocessors page. We email you at least 30 days before we add or replace one. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the Terms and we refund what you prepaid for the rest of the period. Each subprocessor is bound by contract to data protection obligations at least as strict as these, and we remain responsible for it.

Transfers#

Your sandboxes run, and their disks are kept, on servers from the providers on the Subprocessors page, in several countries. Today they are all in our eu region, which holds only servers in the European Economic Area or the United Kingdom, which has an adequacy decision. When we add servers in the us and apac regions, you will choose the region each sandbox runs in. A sandbox in the eu region stays there: we never place it, move it or keep its disk in another region. A sandbox you place in another region is transferred there on your instructions, under the Standard Contractual Clauses. Archived stopped sandboxes and received email are kept in Cloudflare's R2 storage, in its EU jurisdiction. Cloudflare's network carries traffic to and from agental, which may involve processing outside the European Economic Area. Each such transfer is covered by an adequacy decision or by the Standard Contractual Clauses.

Where the GDPR requires a transfer mechanism between you and us, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are part of this addendum: the module that fits our roles, Option 2 of Clause 9, and the law and courts of Bulgaria for Clauses 17 and 18. The details in Annex I are those on this page.

Liability and precedence#

Liability under this addendum is subject to the limits in the Terms of Service, as far as the law allows. If this addendum and the Terms differ on data protection, this addendum prevails.

Security measures#

• Every sandbox is a virtual machine with its own kernel. The host's firewall drops traffic between sandboxes and to private networks, and blocks outbound mail on port 25.
• Traffic to agental is encrypted with TLS. The servers that run sandboxes are reached only over WireGuard links, and their control interface accepts only our certificate.
• Every request to the API is checked against the account that owns what it touches. API keys and one-time codes are kept only as SHA-256 hashes, and passwords with scrypt. Sign-in is rate-limited, and sign-in cookies are HttpOnly and Secure.
• Secrets you store, the variables and files of templates and sandboxes, webhook signing secrets and the header values sent to your collector, are encrypted with AES-256-GCM before they are written to the database, with a key kept outside it. The tokens GitHub and Google give at sign-in are not kept. The secret and backup codes of two-factor sign-in are encrypted with XChaCha20-Poly1305 under a key kept outside the database.
• Only our operators can administer the servers, by SSH key. They act on a sandbox's content only as the Terms allow.
• Sandbox disks are kept on mirrored drives. A server refuses new sandboxes before its storage is full.
• No analytics or tracking scripts run on our pages. The one script of another company is Cloudflare Turnstile, on the Enterprise form. Our servers keep no log of API requests.
• Data is kept no longer than needed: received email for 7 days, mail server logs for 14, sandbox metrics for 15, webhook deliveries for 30, and command output, agent conversations, sandbox events and scheduled runs for 30 unless the account chooses otherwise.