Infranautic Data Processing Agreement

Using this DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Key Terms

The key legal terms of the DPA are as follows:

Agreement

This DPA supplements the following agreement: https://infranautic.com/policies/terms

Approved Subprocessors

Name	Country of location	Anticipated processing task
Amazon Web Services	United Kingdom	Hosts the service and its runners, and stores plan and apply output and logs.
GitHub, Inc.	United States	Source hosting the Customer connects through the Infranautic GitHub App. Infranautic reads repositories and pull requests, and writes check results back.
Zoho	European Union	Email, meaning support correspondence sent to hello@infranautic.com.
Stripe, Inc.	United States	Payments, meaning the billing contact's name and email address, and invoices.

Provider Security Contact

security@infranautic.com

Security Policy

Security Policy available at: https://docs.infranautic.com/security/

Changes to the Agreement

Service Provider Relationship

To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers

Governing Member State

EEA Transfers: Ireland

Annex I(A) List of Parties

Data Exporter

Name: the Customer signing this DPA

Activities relevant to transfer: See Annex 1(B)

Role: Controller

Data Importer

Name: the Provider signing this DPA

Contact person: Daniel Flook, Director

Address: Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, Greater Manchester BL6 6HG, United Kingdom of Great Britain and Northern Ireland

Activities relevant to transfer: See Annex 1(B)

Role: Processor

Annex I(B) Description of Transfer and Processing Activities

Service

The Service is: Infranautic, a hosted service for reviewing, approving and applying OpenTofu infrastructure changes made through GitHub pull requests.

Categories of Data Subjects

Customer's employees

Any other individuals whose personal data Customer includes in its infrastructure code or cloud resource configuration.

Categories of Personal Data

Name

Contact information such as email, phone number, or address

Identifiers that appear in infrastructure configuration, such as cloud account user names and IP addresses in firewall or security group rules.

Special Category Data

Is special category data (as defined in Article 9 of the GDPR) Processed? No

Frequency of Transfer

Continuous

Nature and Purpose of Processing

Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms. The nature of processing includes:

Receiving data, including collection, accessing, retrieval, recording, and data entry

Holding data, including storage, organization, and structuring

Protecting data, including restricting, encrypting, and security testing

Showing plan and apply output to Customer's users in the Service and in check results on Customer's GitHub repositories, and comparing new plans with previously approved plans.

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.

Annex I(C)

Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II

Technical and Organizational Security Measures

See Security Policy

Pseudonymization and encryption of personal data

Customer Personal Data is encrypted in transit and at rest. Connections to the Service use TLS 1.2 or later, and runners upload operation output over HTTPS. Stored data, including operation output and database replicas, is encrypted with AES-256, and secrets Customer saves in the Service are encrypted with a dedicated AWS KMS key. Provider does not pseudonymise Customer Personal Data.

Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services

The Service runs on AWS in London. Each plan, apply and health check runs in its own single-use container, created for that operation and destroyed when it finishes, and separate from the systems that store Customer data. Each customer organisation's data is held in its own database. Access to Customer data in the Service follows Customer's repository permissions on GitHub, and operations reach Customer's cloud accounts with short-lived credentials issued for each operation. Further detail is in Provider's security policy at https://docs.infranautic.com/security/.

Ability to restore the availability of and access to the Customer Personal Data in a timely manner following a physical or technical incident

Each customer organisation's database is replicated continuously to Amazon S3 in the same region, and can be restored from that replica. Operation output is stored in Amazon S3 for 30 days. Customer's OpenTofu state and code remain in Customer's own backend and GitHub repositories, and the Service does not hold a copy of either.

User identification and authorization process and protection

Users sign in to the Service with their GitHub account; the Service holds no passwords, and password and multi-factor authentication requirements are those of GitHub and of Customer's GitHub organisation. What a user can see and do follows their permissions on each repository in GitHub, and actions across the organisation require a GitHub organisation owner. Provider's administrative access to its AWS accounts uses AWS single sign-on. Secrets Customer stores in the Service are encrypted and cannot be read back through the Service.

Protecting Customer Personal Data during transmission (in transit)

Connections to the Service are encrypted with TLS 1.2 or TLS 1.3; the load balancer accepts no other protocol. Runners send operation output to Provider over HTTPS, and the Service reaches GitHub, Amazon S3 and other AWS services over HTTPS.

Protecting Customer Personal Data during storage (at rest)

Customer Personal Data at rest is encrypted with AES-256: operation output and database replicas in Amazon S3, and the Service's working storage on AWS Fargate. Storage buckets block all public access. Each customer organisation's data is held in its own database, and secrets Customer saves in the Service are encrypted with a dedicated AWS KMS key. Only Provider's administrators can access the underlying storage, through AWS single sign-on.

Physical security where Customer Personal Data is processed

Customer Personal Data is processed and stored only in Amazon Web Services data centres in the London region, and physical security is provided by AWS under its own controls, which are independently audited. Provider has no premises where Customer Personal Data is held.

Events logging

The Service logs requests and application events to Amazon CloudWatch, kept for 30 days, and each operation's runner logs are kept for 7 days. Within the Service, each plan, apply and approval is recorded with who started or decided it and when, and Customer can review these records in the Service.

Systems configuration, including default configuration

Provider's infrastructure is defined in OpenTofu code and changed only by applying a reviewed plan of that code. Runners start from a fixed container image for each operation and hold no credentials between operations. Storage defaults to private and encrypted. The Service's health is checked continuously by the load balancer, which stops sending traffic to an unhealthy instance.

Ensuring limited data retention

Operation output is deleted automatically 30 days after the operation, and runner logs after 7 days. Request and application logs are kept for 30 days. The rest of Customer's data, such as pull request records, approvals and the resources the Service has observed, is kept while Customer's account is open. When the account closes, Provider deletes Customer's database and its backups, which are kept for no more than 30 days.

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. This DPA forms part of the Agreement and applies from the date Customer accepts the Agreement. A copy signed by Provider is available on request from hello@infranautic.com.