Data Processing Agreement

2. Scope and purpose of processing

Subject matter: providing the hosted single sign-on and identity service.
Duration: for as long as your subscription is active, plus the retention period after closure.
Nature and purpose: authenticating users, enforcing multi-factor authentication, maintaining sessions and the audit ledger, and sending transactional email.
Types of data: names, email addresses, password hashes, MFA credentials, session and device records, and authentication and administrative audit events.
Categories of data subject: your employees, staff, and other users to whom you give accounts.

3. Confidentiality

DeveloperOffice keeps your user data confidential and ensures that the staff who may access it are bound by confidentiality obligations and only access it as needed to run the service. Every staff action on your tenant is recorded in your tenant's own audit log and is visible to you.

4. Security measures

DeveloperOffice maintains appropriate technical and organizational measures, set out in the annex below.

5. Subprocessors

You authorize DeveloperOffice to use the infrastructure subprocessors listed below, each bound to equivalent data-protection obligations. Transactional email is sent through Postal, which DeveloperOffice self-hosts — it is not a third-party subprocessor.

DeveloperOffice gives you advance notice before adding or replacing a subprocessor, so you can object on reasonable data-protection grounds.

6. Personal data breaches

If DeveloperOffice becomes aware of a personal data breach affecting your user data, it will notify you without undue delay, with the information you reasonably need to meet your own notification obligations, and will cooperate on investigation and remediation.

7. Return and deletion

On termination, DeveloperOffice retains your user data for the retention period configured on your tenant so you can be reinstated, then exports and deletes it, save for any copies it must keep by law. Backups age out and are deleted on their normal cycle.

8. Audits

DeveloperOffice will make available the information reasonably necessary to demonstrate compliance with this agreement, including relevant reports and, where available, subprocessor compliance reports. Audit rights are satisfied through this report-based evidence rather than direct inspection of shared infrastructure.

Annex — security measures

• Per-tenant isolation enforced in the database with row-level security keyed to each organization, underneath application-level scoping.
• Passwords stored only as salted PBKDF2 hashes with a server-side pepper; client secrets and other sensitive secrets stored encrypted.
• Multi-factor authentication and passkey support.
• An append-only audit log of authentication and administrative actions, visible to the tenant.
• Encryption in transit (TLS); tenant-isolated storage on a dedicated database accessed through a least-privilege database role. Encrypted off-site backups and network-level database isolation are part of our operational roadmap and are being independently verified.
• Database reachable only from our own infrastructure — not the public internet — on a dedicated least-privilege role.
• Automatic expiry and purging of sessions and one-time codes.