Data processing agreement

Parties and scope

This agreement is between the customer that holds a Forseti workspace (the controller) and UnknwnAI (the processor). It applies whenever we process personal data contained in customer content, such as repositories, pull requests and comments, on the customer’s behalf. It forms part of our terms of service and meets Article 28 of the UK GDPR and, where it applies, the EU GDPR.

Details of the processing

Instructions

We process customer personal data only on the customer’s documented instructions: this agreement, the terms, and the settings the customer chooses in Forseti (for example which repositories are reviewed, whether snippets are stored and how long findings are kept). We will tell the customer if we believe an instruction breaks data protection law.

Our people

Anyone we authorise to process customer personal data is bound by confidentiality.

Security

We maintain the technical and organisational measures described on our security page, including read-only access to code, patches held in memory and never written to disk, secret redaction before model calls, encryption of sign-in tokens, workspace isolation on every query and an audit log.

Sub-processors

The customer authorises the sub-processors listed on our sub-processors page. We will give at least [30] days’ notice before adding or replacing one, and the customer may object on reasonable data protection grounds. Each sub-processor is bound by written terms that protect the data at least as well as this agreement. We remain responsible for them.

Model provider

Our model provider is Anthropic. Its commercial API terms exclude training its models on data sent through the API. Zero data retention with Anthropic is being arranged and is not yet in place; we will update this agreement when it is.

Helping the customer

We will help the customer respond to data subject requests, and with security, breach notification, data protection impact assessments and consultations with regulators, taking into account the nature of the processing and the information available to us.

Personal data breaches

We will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, with the information the customer needs to meet its own obligations.

International transfers

Where customer personal data leaves the UK or the EEA, we rely on an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. [Annexes to be attached.]

Deletion at the end

Diffs and file contents are never stored. Findings (with any lines they quote) are deleted when the customer’s retention period ends, and all customer personal data is deleted within [30] days of the workspace being deleted or the agreement ending, unless the law requires us to keep it. The customer can export its policies and rules before then.

Information and audits

We will make available the information needed to show we meet this agreement, and allow audits by the customer or its auditor on reasonable notice. We do not hold a third-party security report such as SOC 2 today; until we do, we will answer reasonable security questionnaires.

Order of precedence

If this agreement conflicts with the terms of service on the processing of personal data, this agreement wins. Liability is governed by the terms of service.