DevQuaySign inStart a private trial
Draft
This text is under review and is not in force. Bracketed details are still to be completed.

DevQuay Data Processing Addendum

Version 0.2 (paid beta) · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-30

This Data Processing Addendum ("DPA") forms part of the [Terms of Service](terms-of-service.md) between Joao P M Pereira, Estrada Fraze, 90, Teresopolis, RJ, Brasil ("DevQuay", "Processor") and the Customer ("Controller"). It applies when DevQuay processes Customer Personal Data on the Customer's behalf. It is accepted together with the Terms; no separate signature is needed, although DevQuay will countersign a copy on request.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR (Regulation (EU) 2016/679) and, where applicable, the UK GDPR, the Swiss Federal Act on Data Protection and Brazil's Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD") ("Data Protection Law"). Under the LGPD, a controller is a *controlador* and a processor is an *operador*.

  • Customer Personal Data: personal data contained in Customer Content that DevQuay processes on behalf of the Customer.
  • Subprocessor: a third party engaged by DevQuay to process Customer Personal Data.
  • SCCs: the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

Other capitalised terms have the meaning given in the Terms.

2. Roles and scope

2.1 The Customer is the controller (or a processor acting for its own controller) of Customer Personal Data. DevQuay is its processor (or subprocessor).

2.2 This DPA does not cover data DevQuay processes as a controller for its own purposes (account, security, usage and billing data), which is described in the [Privacy Policy](privacy-policy.md).

3. Details of processing (Annex I.B)

| Item | Description | | --- | --- | | Subject matter | Providing the DevQuay Service: storing, versioning, resolving, searching, publishing and exporting engineering standards and related content, and the features the Customer enables (imports, GitHub sync, reference capture, hosted AI, portals, notifications) | | Duration | The term of the Customer's subscription plus the export and deletion periods in section 11 | | Nature and purpose | Hosting, storage, retrieval, indexing, rule resolution, rendering, transmission to Users and Agents the Customer authorises, transmission to Subprocessors needed for enabled features, backup, export and deletion | | Categories of data subjects | The Customer's Users; employees, contractors and other individuals named in Customer Content (for example service owners, reviewers, approvers, authors of imported documents or commits) | | Categories of personal data | Names, work email addresses, usernames and handles, roles and team assignments, authorship and approval records, and any other personal data the Customer chooses to include in content. The Service is not designed for special categories of data, and the [Acceptable Use Policy](acceptable-use-policy.md) prohibits submitting them | | Special categories | None intended | | Frequency | Continuous while the Service is used |

4. DevQuay's obligations

DevQuay will:

a) process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's configuration and use of the Service (including enabling providers, publishing portals and requesting exports or deletion) are the Customer's complete instructions. DevQuay will tell the Customer if it believes an instruction breaks Data Protection Law;

b) ensure that people authorised to process Customer Personal Data are bound by confidentiality;

c) implement the technical and organisational measures in section 6;

d) engage Subprocessors only under section 7;

e) assist the Customer, taking into account the nature of processing, in responding to data subject requests (section 8) and in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation, to the extent the Customer cannot do so with the Service's own features;

f) return or delete Customer Personal Data under section 11;

g) make available the information needed to demonstrate compliance with this DPA and allow audits under section 10;

h) not sell Customer Personal Data, not use it to train AI models, and not combine it with data from other customers except as needed to operate the multi-tenant Service.

5. Customer's obligations

The Customer is responsible for having a lawful basis for the processing, for the content it submits, for giving data subjects any required information, and for configuring the Service (roles, collection grants, AI provider policy, publication) in line with its own obligations.

6. Technical and organisational measures (Annex II)

These measures reflect what the Service implements or is required to implement before paid beta. DevQuay may change them if the overall level of protection is not reduced.

Tenant isolation - Every tenant table carries an organization identifier and enforces PostgreSQL row-level security (`ENABLE` and `FORCE`), with a policy that denies access when no organization context is set. The application database roles do not own the tables and cannot bypass row-level security. Organization context is set per transaction from the verified principal only; identifiers in URLs, headers or bodies never grant access. - Foreign keys between tenant records include the organization identifier, so records cannot reference another organization's data. - Collection-level permissions are applied in queries before results, counts, search ranking or AI model input are produced. - Cross-tenant negative tests run in CI and against the deployed environment.

Access control and authentication - Users authenticate through Clerk. API requests are verified for issuer, audience, expiry and current membership. OAuth tokens for MCP hosts are bound to the DevQuay resource and organization; tokens issued for other resources are rejected. - Roles (owner, admin, editor, reviewer, reader) and collection grants restrict actions. Separation of duties prevents requesters from approving their own exceptions. - Service credentials are random, shown once, stored only as peppered hashes, scoped to an organization and operations, and can expire and be revoked. Membership removal and grant revocation take effect immediately for local authorization checks. - Integration secrets (for example GitHub connector tokens) are envelope-encrypted. Operational secrets are kept in a password manager and injected at runtime; they are not stored in code or logs. - Administrative access to production systems is limited to DevQuay's operator, uses individual credentials and is protected by multi-factor authentication, either on the account itself or through a sign-in provider that requires it.

Encryption - All traffic to DevQuay hosts uses TLS 1.2 or later. Traffic between Cloudflare and the origin cluster uses TLS with a publicly trusted origin certificate and mutual TLS (Authenticated Origin Pulls), so the origin accepts only connections from Cloudflare. - Object storage (Cloudflare R2) encrypts objects at rest as provided by Cloudflare. Logical database backups are stored in R2; database storage at rest is provided by Neon [ENGINEERING TO CONFIRM at G10.3]. The staging environment's database volumes are not encrypted at rest; staging is not used for Customer Personal Data.

Network and application security - The cluster applies default-deny network policies; only the required paths (edge to API, API and jobs to database and approved external services) are open. - Rate limits per IP address and per credential protect the API and MCP endpoints. - Webhooks from Clerk, Paddle and GitHub are accepted only with valid signatures and are deduplicated. - Imported files are parsed as data. Uploaded code, templates and runbooks are never executed. Archive imports reject path traversal and symlinks and are size-limited. Fetching of remote URLs is restricted to prevent server-side request forgery. - Content is rendered from a sanitised representation, with a strict Content Security Policy. - Dependencies are pinned with lockfiles and scanned; container images are built with provenance attestation.

Logging and monitoring - Business actions (membership changes, publication, approvals, credential and integration changes, exports, deletions) are recorded in an organization-scoped audit log visible to the organization. - Application logs are structured and redact secrets, tokens and credentials before writing; request and response bodies and SQL text are not logged. Telemetry is collected through a collector that applies a second redaction step. - Records of access to the Service (date, time and IP address) are kept for 6 months, as Article 15 of Brazil's Marco Civil da Internet (Law 12.965/2014) requires. Other security logs are kept for 90 days.

Analytics and AI - Product analytics use an allowlist of events and properties with opaque identifiers; content, prompts, code and secrets are excluded. - Hosted AI requests are sent only to providers the organization has enabled, with no fallback to a provider the organization has not allowed. Recognised secrets are removed before sending. Full prompts and outputs are not retained by default.

Availability and backups - The production database runs on Neon managed PostgreSQL in Frankfurt, Germany. Point-in-time recovery covers `[HISTORY WINDOW, set with the Neon plan]`. An independent weekly logical backup is kept in object storage under separate credentials. - Restore drills are run monthly in an isolated environment, and deletions are reapplied to any restored data before it serves requests. Current recovery targets are a recovery point of 24 hours and a recovery time of 8 hours.

Data lifecycle - Raw import files and reference captures are deleted 7 days after processing, unless a User chooses to keep a selected reference. Export downloads expire after 24 hours. Deleted items can be restored for 30 days and are then permanently deleted.

Organisational measures - DevQuay is operated by a small team. Access to Customer Content by DevQuay staff is limited to what is needed for support requested by the Customer, security investigations or legal obligations. - Changes reach production only through version control, automated tests and an approved release.

7. Subprocessors

7.1 The Customer gives DevQuay general authorisation to engage Subprocessors. The current list, with purpose, data and location, is at [Subprocessors](subprocessors.md) (published at https://devquay.com/legal/subprocessors).

7.2 DevQuay will impose on each Subprocessor data protection obligations that offer at least the same protection as this DPA, and remains responsible for their performance.

7.3 DevQuay will give at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating the Subprocessors page and emailing the Organization owner. The Customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if DevQuay cannot offer a reasonable alternative (such as not enabling the feature that uses the new Subprocessor), the Customer may terminate the affected subscription and receive a refund of unused prepaid fees.

7.4 Providers used only for features an Organization chooses to enable (hosted AI, reference capture) process that Organization's data only after it enables the feature. An Organization can choose which AI providers, if any, may receive its content.

7.5 In an emergency (for example the sudden failure of a Subprocessor), DevQuay may replace a Subprocessor with shorter notice, and will notify the Customer as soon as possible with the same objection right.

8. Data subject requests

DevQuay will forward to the Customer, without undue delay, any request it receives from a data subject about Customer Personal Data, and will not answer it except to redirect the data subject, unless the Customer authorises it. The Service lets the Customer view, correct, export and delete content and remove Users. Where that is not enough, DevQuay will assist on request.

9. Personal data breaches

9.1 DevQuay will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Notice goes to the Organization owner's email address and, if provided, the Customer's security contact.

9.2 The notice will describe, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. DevQuay will provide further information as it becomes available.

9.3 DevQuay will take reasonable steps to contain the breach and reduce its effects. Notification is not an admission of fault.

10. Audits

10.1 On written request, at most once a year (or after a personal data breach, or if required by a supervisory authority), DevQuay will answer a reasonable security questionnaire and provide relevant documentation of the measures in section 6, including summaries of isolation test results and restore drills.

10.2 If the Customer reasonably shows that this information is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer (or an independent auditor bound by confidentiality, who is not a DevQuay competitor) may carry out an audit with at least 30 days' notice, during business hours, without access to other customers' data and without disrupting the Service. The Customer bears its own costs and DevQuay's reasonable costs of the audit unless the audit reveals a material breach of this DPA.

11. Return and deletion

11.1 During the subscription, the Customer can export Customer Content at any time (section 11 of the Terms).

11.2 When the subscription ends, the Organization stays available for export for 30 days. After that, or earlier on an owner's request, DevQuay deletes Customer Personal Data: integrations and credentials are disabled first, then active data, search indices and stored objects are removed within 30 days. Backup copies expire within 30 days, and deletion is reapplied if a backup is restored in that period.

11.3 DevQuay may keep Customer Personal Data where Brazilian, Union or Member State law requires it, keeps it confidential, and processes it only for that purpose. Records of the deletion itself are kept in minimised or pseudonymised form.

11.4 DevQuay will confirm deletion in writing on request.

12. International transfers

12.1 DevQuay is established in, and operated from, Brazil. Its API is hosted in Finland, and its production database in Germany. Subprocessors outside the EEA are listed in [Subprocessors](subprocessors.md) with the transfer mechanism each relies on.

12.2 Customer Personal Data subject to the GDPR is transferred to DevQuay in Brazil under the European Commission's adequacy decision for Brazil (Implementing Decision (EU) 2026/179), so the SCCs apply only to onward transfers. If that decision stops applying, the SCCs apply to the transfer to DevQuay and are incorporated by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For onward transfers to Subprocessors outside the EEA, DevQuay relies on the SCCs (Module 3) or the Subprocessor's certification under the EU–US Data Privacy Framework, as listed for each Subprocessor.

12.3 For the SCCs: Clause 7 (docking) applies; under Clause 9 option 2 (general written authorisation) applies with the notice period in section 7.3; the optional wording in Clause 11 does not apply; under Clause 17 the governing law is that of Ireland; under Clause 18 the courts of Ireland have jurisdiction. Annex I is completed by section 3 of this DPA and the parties' details in the Terms; Annex II by section 6; Annex III by the Subprocessors page. The competent supervisory authority for the SCCs is the Irish Data Protection Commission. DevQuay's own authority is Brazil's Autoridade Nacional de Proteção de Dados (ANPD).

12.4 For UK personal data, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Tables 1–3 completed by this DPA and Table 4 allowing either party to end it. For Swiss personal data, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

12.5 If the SCCs conflict with this DPA, the SCCs prevail.

13. Liability and term

Liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow those limits. This DPA lasts as long as DevQuay processes Customer Personal Data.

Parties

| | Controller (Customer) | Processor (DevQuay) | | --- | --- | --- | | Name | As registered in the Organization's billing details | Joao P M Pereira | | Address | As registered | Estrada Fraze, 90, Teresopolis, RJ, Brasil | | Contact | Organization owner | privacy@devquay.com | | Role | Controller (or processor) | Processor (or subprocessor) |