Data Processing Agreement
In short: when your team uses TerrAlert, we hold some personal data on your behalf, such as your team members' email addresses and the webhook addresses you give us. This agreement sets out how we handle that data, as Article 28 of the GDPR requires. It forms part of our Terms of Service and applies automatically: there is nothing to sign. If you need a countersigned copy, write to [email protected].
1 Parties, scope and order of precedence
1.1 This Data Processing Agreement ("DPA") is between TerrAlert, Inc., United States ("TerrAlert") and the business, organisation or professional that has accepted TerrAlert's Terms of Service (the "Customer").
1.2 This DPA is incorporated by reference into the Terms of Service and forms part of the agreement between the parties (the "Agreement"). It applies whenever TerrAlert processes Customer Personal Data in providing the TerrAlert service (the "Service"), and takes effect when the Customer accepts the Terms.
1.3 If documents conflict, this order applies: first the Standard Contractual Clauses incorporated under section 9, then this DPA, then the rest of the Agreement.
2 Definitions
- Data Protection Laws: the GDPR (Regulation (EU) 2016/679); the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; and any US state privacy law that applies to the processing, each as amended.
- Customer Personal Data: personal data that the Customer, or its authorised users, supply to the Service and that TerrAlert processes on the Customer's behalf, as described in Annex I.
- Subprocessor: a third party TerrAlert engages to process Customer Personal Data.
- Standard Contractual Clauses or SCCs: the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
- UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
- "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the GDPR.
3 Roles of the parties
3.1 For Customer Personal Data, the Customer is the controller (or a processor acting for its own client) and TerrAlert is the processor (or subprocessor).
3.2 TerrAlert is a controller, not a processor, for the personal data it needs to run its own business: creating and securing accounts, sign-in and security logs, billing, support correspondence with the account holder, error reports, and compliance with law. Our Privacy Policy covers that processing, and this DPA does not.
3.3 The Customer is responsible for having a lawful basis for the Customer Personal Data it supplies, for giving the people concerned any notice the law requires, and for the lawfulness of its instructions. The Customer will not use the Service to monitor individuals or private residences, or supply special categories of personal data, in line with the Acceptable Use section of the Terms.
4 Instructions
4.1 TerrAlert processes Customer Personal Data only on the Customer's documented instructions, including for transfers to a third country, unless the law of the EU, an EU Member State or the UK that applies to TerrAlert requires otherwise. In that case TerrAlert tells the Customer about that legal requirement before processing, unless the law prohibits it on important grounds of public interest.
4.2 The Agreement, this DPA and the Customer's use and configuration of the Service (for example, inviting a team member or adding a webhook) are the Customer's complete documented instructions. Further instructions must be in writing and consistent with the Agreement.
4.3 TerrAlert will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws. TerrAlert need not follow such an instruction until the Customer confirms or changes it.
5 Confidentiality
TerrAlert ensures that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only to the extent the task requires.
6 Security
6.1 TerrAlert implements and maintains the technical and organisational measures in Annex II, which are designed to meet Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and its risks.
6.2 TerrAlert may change these measures over time, but will not reduce the overall level of protection they provide.
7 Subprocessors
7.1 The Customer gives TerrAlert general written authorisation to engage Subprocessors. The current list is published at terralert.io/subprocessors.html, which forms Annex III.
7.2 TerrAlert will tell the Customer of any intended addition or replacement of a Subprocessor at least 30 days before it starts processing Customer Personal Data, by updating that page and emailing the Customer's account owner.
7.3 The Customer may object in writing to [email protected] within those 30 days, on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may end the affected part of the Service before the change takes effect, and TerrAlert will refund any fees paid in advance for the period after termination.
7.4 TerrAlert imposes on each Subprocessor, by written contract, data protection obligations that give at least the same protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. TerrAlert remains fully liable to the Customer for each Subprocessor's performance of those obligations.
8 Assistance to the Customer
8.1 Requests from individuals. Taking into account the nature of the processing, TerrAlert helps the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests to exercise data subject rights under Chapter III of the GDPR. The Customer can view, change and remove team members and webhook endpoints in the Service itself. If TerrAlert receives such a request directly about Customer Personal Data, it will pass the request to the Customer without undue delay and will not answer it except as the Customer instructs or the law requires.
8.2 Security, breaches, impact assessments and consultation. Taking into account the nature of the processing and the information available to it, TerrAlert helps the Customer meet its obligations under Articles 32 to 36 of the GDPR, including by providing the information in this DPA and its annexes and reasonable further information for a data protection impact assessment or a prior consultation with a supervisory authority.
8.3 Assistance beyond what the Service and this DPA already provide may be charged at reasonable rates agreed in advance.
9 International transfers
9.1 TerrAlert is established in the United States and processes Customer Personal Data there (see where TerrAlert runs). To the extent that the Customer's supply of Customer Personal Data to TerrAlert is a transfer of personal data to a third country under the GDPR, the Standard Contractual Clauses are incorporated into this DPA by reference and apply as follows:
- Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor.
- The Customer is the data exporter and TerrAlert is the data importer.
- Clause 7 (the docking clause) applies.
- Clause 9: Option 2 (general written authorisation) applies, with the notice period in section 7.2 of this DPA.
- Clause 11: the optional language does not apply.
- Clause 13: the competent supervisory authority is the one determined by Clause 13(a), according to where the data exporter is established or, if it is not established in the EU, where the data subjects concerned are located.
- Clause 17: Option 2 applies. The Clauses are governed by the law of the EU Member State in which the data exporter is established, or, where that law does not allow for third-party beneficiary rights or the data exporter is not established in the EU, by the law of Ireland.
- Clause 18: disputes are resolved by the courts of the Member State whose law governs under Clause 17.
- Annex I.A and I.B of the Clauses are completed by Annex I of this DPA; Annex I.C by Clause 13 as set out above; Annex II by Annex II of this DPA; and Annex III by Annex III of this DPA.
9.2 United Kingdom. For personal data subject to the UK GDPR, the UK Addendum is incorporated by reference and supplements the Standard Contractual Clauses as set out in 9.1. Tables 1 to 3 of the UK Addendum are completed with the information in 9.1 and the annexes of this DPA, and for Table 4 either party may end the UK Addendum as its Section 19 allows.
9.3 Switzerland. For personal data subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; references to the GDPR are read as references to the Swiss Act; and the term "Member State" does not prevent data subjects in Switzerland from bringing claims where they habitually reside.
9.4 Where TerrAlert passes Customer Personal Data on to a Subprocessor outside the EEA, the UK or Switzerland, it does so under the Subprocessor's data processing terms, which incorporate the Standard Contractual Clauses and the UK Addendum, or under another transfer mechanism recognised by Data Protection Laws.
10 Personal data breaches
10.1 TerrAlert notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the Customer's account owner.
10.2 The notice describes, as far as TerrAlert then knows: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact for more information. Where TerrAlert cannot give all of this at once, it provides the information in phases as it becomes available.
10.3 TerrAlert takes reasonable steps to contain and investigate the breach, and cooperates with the Customer so that the Customer can meet its own duties to notify supervisory authorities and data subjects. TerrAlert records every personal data breach, with its facts, effects and remedial action, in its breach register. A notice under this section is not an admission of fault.
11 Deletion or return at the end
11.1 Before the Service ends, the Customer can export its data through the Service (detections as CSV or GeoJSON, and the "Download my data" JSON export of account data, which includes areas with their settings and detections with their geometry), or ask TerrAlert at [email protected] to return Customer Personal Data in a commonly used, machine-readable format.
11.2 When the Customer deletes its account, TerrAlert deletes Customer Personal Data from its live systems immediately. Copies in database backups are deleted as the backups expire: backups on the server are kept up to 15 days, and the encrypted off-site copies are removed about 35 days after upload. Until they expire, backups are kept secure and used only to restore the Service.
11.3 If the Customer's paid subscription ends without the account being deleted, the Customer's full history is kept for 60 days so that the Customer can switch provider or retrieve it, and the Free plan's history window applies after that. This DPA continues to apply until the Customer deletes the account or the data is removed under that history window. The Customer may ask for deletion at any time.
11.4 These duties do not apply to data that the law of the EU, an EU Member State or the UK requires TerrAlert to keep. TerrAlert keeps such data only for as long as that law requires and processes it only for that purpose.
12 Information and audits
12.1 TerrAlert makes available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including written answers to reasonable security questionnaires. TerrAlert does not currently hold third-party security certifications such as SOC 2 or ISO 27001, and will say so rather than imply otherwise.
12.2 If that information does not reasonably answer the Customer's questions, or a supervisory authority requires it, TerrAlert allows and contributes to audits, including inspections, by the Customer or an independent auditor it appoints, on these terms:
- the Customer gives at least 30 days' written notice and a proposed scope;
- no more than one audit in any 12 months, unless a supervisory authority requires it or following a personal data breach affecting Customer Personal Data;
- during normal business hours, without unreasonable disruption to the Service, and without access to other customers' data;
- the auditor is bound by confidentiality and is not a competitor of TerrAlert;
- the Customer bears its own costs and the auditor's, and pays TerrAlert's reasonable costs of supporting the audit where agreed in advance.
13 US state privacy laws
Where a US state privacy law applies to Customer Personal Data, TerrAlert acts as the Customer's service provider or processor under that law. TerrAlert will not sell or share Customer Personal Data (as those laws define those terms); will not keep, use or disclose it for any purpose other than providing the Service under the Agreement, or outside the direct business relationship with the Customer; and will not combine it with personal data it receives from others, except as that law permits. TerrAlert will tell the Customer if it can no longer meet these obligations.
14 Term, liability and general
14.1 This DPA lasts for as long as TerrAlert processes Customer Personal Data, and ends when that data has been deleted or returned under section 11.
14.2 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow liability to be limited, including towards data subjects.
14.3 TerrAlert may update this DPA to reflect changes in Data Protection Laws or in the Service. A change that reduces the protection of Customer Personal Data will not apply to the Customer without its agreement. TerrAlert will publish each version on this page with its date.
14.4 Questions about this DPA go to [email protected].
I Annex I. Details of the processing
A. The parties
- Data exporter / controller: the Customer, as identified in its TerrAlert account. Contact: the account owner's email address. Activities: use of the TerrAlert Service.
- Data importer / processor: TerrAlert, Inc., United States . Contact: [email protected]. Activities: providing the TerrAlert Service.
B. Description of the processing
| Subject matter | Providing the TerrAlert Service: monitoring land areas that the Customer draws, detecting change in satellite imagery, and alerting the Customer's people about it. |
| Categories of data subjects | The team members the Customer invites and other authorised users; people reachable at the webhook addresses the Customer adds; people whose details the Customer chooses to write into an area's name. |
| Categories of personal data | Team members' email addresses, their role in the Customer's workspace (admin or member) and the dates they were invited and accepted; the webhook addresses the Customer adds (which can point to a person's or a channel's Slack or Microsoft Teams webhook) and their signing secrets; the content of alerts sent to those addresses; any personal data in area boundaries and names. |
| Special categories | None. The Service is not designed for special categories of data or for data about criminal convictions, and the Acceptable Use section of the Terms forbids monitoring individuals or private residences. |
| Frequency of transfer | Continuous, for as long as the Customer uses the Service. |
| Nature of the processing | Storage, organisation, retrieval, use to send invitations and alerts by email and webhook, and deletion. |
| Purpose | To let the Customer invite its team, and to deliver change alerts to the destinations the Customer chooses. |
| Duration and retention | For the term of the Agreement. Team members and webhook endpoints are kept until the Customer removes them or deletes its account. Alert history follows the Customer's plan history window. Everything is deleted with the account, and backups expire within 15 days on the server and, for off-site copies where made, 35 days (section 11). |
| Transfers to Subprocessors | As listed in Annex III, for the purposes stated there, for the duration above. |
C. Competent supervisory authority
As determined by Clause 13 of the Standard Contractual Clauses (section 9.1). For the UK, the Information Commissioner's Office. For Switzerland, the Federal Data Protection and Information Commissioner.
II Annex II. Technical and organisational security measures
These are the measures in place today. We describe them precisely, and where a measure is not in place, we say so.
Encryption
- All connections to terralert.io, including the API at terralert.io/api, use TLS, terminated at the edge by Cloudflare. TLS 1.0 is rejected, and HTTP Strict Transport Security tells browsers to use HTTPS only.
- Webhook signing secrets are stored encrypted with application-level field encryption (Fernet), under keys held outside the database that can be rotated without re-encrypting stored data.
- Share links carry an encrypted, tamper-proof token made with the same keys. A link shows a single detection and expires after 30 days.
- Outgoing webhooks are signed with HMAC-SHA256 so that the receiver can check they came from TerrAlert.
- Each database backup is encrypted with age on TerrAlert's server before a copy leaves it, and the off-site copies at Backblaze are stored only in that encrypted form; Backblaze does not hold the key.
- TerrAlert does not currently claim encryption at rest for the live database or disks beyond the fields and backup copies listed above.
Access control for customers
- Sign-in is handled by Supabase; passwords never reach TerrAlert's servers. Optional two-factor authentication (TOTP) is available to every user; once a user enrols, the web app enforces the second step, but the API does not yet require it.
- Every API request carries a signed session token that the API verifies, and the API returns only data that belongs to the signed-in account or its workspace.
- The web app signs a user out after 24 hours without activity.
- Requests are rate-limited per client to limit abuse.
Access control for TerrAlert staff
- Staff use individual access tokens with one of four roles (owner, admin, support, analyst), and each administrative function checks the caller's role. One shared owner token also exists. It is a permanent owner credential, kept only in the server environment and in the deployment system's secret store (GitHub secrets), and the API refuses to start in production unless it is at least 24 characters long.
- Individual staff tokens are stored only as hashes, and administrative requests are rate-limited.
- Administrative actions that change data, including replies to and status changes of support tickets, are recorded in an audit log (who, what, which record, from which IP address, and when), which is kept for 2 years. Customers' data exports and account deletions are recorded in the same log.
- Production secrets are kept in server configuration and the deployment system's secret store, never in source code.
Availability and resilience
- The database is backed up every 6 hours by an automated job, and before every database migration. Backups on the server are kept up to 15 days. Each backup is also copied, encrypted, to Backblaze B2 in the United States (US East region); those off-site copies are removed about 35 days after upload by the storage bucket's retention rule.
- Restoring a backup is a scripted procedure that requires explicit confirmation.
Secure development and operations
- Automated weekly dependency updates for the application, its container images and its build pipeline.
- Container images are scanned for known vulnerabilities and signed in the deployment pipeline.
- A Content Security Policy restricts what the web app may load.
- Application errors are logged and kept for 90 days, and may be reported to Sentry. Server reports carry the error, its stack trace and the request path, not request bodies, cookies or user details.
Data minimisation and retention
- Card details are entered on Stripe's pages and never reach TerrAlert.
- Product analytics count a small set of events with no user identifier.
- Data is deleted on a published schedule, and account deletion takes effect immediately (see our Privacy Policy).
Incident response
- A written incident response runbook covers containment, credential rotation, a breach register, notification of customers under section 10, and notification of authorities.
- Security reports can be sent to [email protected].
Physical security
- Servers run in DigitalOcean data centres, whose physical and environmental security is DigitalOcean's responsibility under its terms.
III Annex III. Subprocessors
The authorised Subprocessors, with what each does, the data involved, its location and the transfer safeguard, are listed at terralert.io/subprocessors.html. That page is updated, and account owners emailed, at least 30 days before a new Subprocessor starts processing Customer Personal Data (section 7).