Data Processing Agreement

1What this agreement is

This Data Processing Agreement (DPA) is between you, the customer (you), and the operator of combobulating (we, us): Ohmyfin Limited, a company registered in England and Wales under company number 15431563, with its registered office at 275 New North Road, Islington Suite 1422, London, England, N1 7AA. It sets out how we process personal data on your behalf when we provide the service, and it is the agreement Article 28 of the GDPR and of the UK GDPR requires between a controller and its processor.

In this DPA:

• Data Protection Law means the GDPR (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018, and the Swiss Federal Act on Data Protection, each where it applies to the processing.
• Customer Personal Data means the personal data we process on your behalf in providing the service: whatever you, your users or your agents put on your server or Mini, the backups of it, the copy of a folder you connect on the Projects tab of your dashboard, the mail your agents send and receive through the mailboxes we give them, and the files you send to your machine through the dashboard.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• Controller, processor, data subject, personal data, processing and personal data breach mean what Data Protection Law says they mean.

Two things are outside this DPA. The data we hold about you as our customer (your account, your email address, your invoices, the messages you send us) is ours to look after as controller, and the Privacy Policy covers it. And what your agents send to Claude under your own Anthropic account is between you and Anthropic, under your agreement with them (clause 5 of the Terms): Anthropic is your processor there, not ours.

Where this DPA and the Terms disagree about personal data, this DPA wins. Where the SCCs apply under clause 10, they win over both.

2Who decides, and who carries out

You are the controller of Customer Personal Data and we are your processor. You decide what goes on your server and what it is for; we host it and keep the machine running.

If you are yourself a processor acting for someone else, we are your sub-processor, you confirm that your controller has authorised you to use us on these terms, and you pass on to them anything this DPA asks us to tell you.

You are responsible for having a lawful basis for the personal data your agents touch, for telling the people it is about what the law requires you to tell them, and for making sure your instructions to us are lawful (clause 6 of the Terms).

3We act only on your instructions

We process Customer Personal Data only on your documented instructions, including on transfers outside the EEA and the UK. Your instructions are:

• the Terms of Service and this DPA, which instruct us to host your server, keep it running, back it up where your plan includes backups, carry your agents' mail, and do the work and nothing more that clause 8 of the Terms describes;
• the choices you make in your dashboard, such as connecting a folder on the Projects tab and choosing what our team may do with it, asking for a restart, a rebuild or a restore, or sending a file to your machine;
• anything else you ask of us in writing, for example in a support request. If it needs work the service does not include, we tell you before we start, and we may decline it or quote for it.

We do not use your data for anything of our own. We do not read, copy, scan, index, analyse or review it in the ordinary course of business, no automated system of ours monitors it, and we never use it to train or evaluate any model. A person from our team looks at what is on your server only in the four cases clause 8 of the Terms names: you ask us to, you share a project with us, we have a specific reason to suspect a security incident, or the law requires it. The third is how we keep the processing secure as Article 32 requires, and you instruct us to do it by accepting the Terms.

Where the law requires it. We process Customer Personal Data beyond your instructions only where the law of the United Kingdom or of the European Union or one of its member states requires us to. Before we do, we tell you what the requirement is, unless that law forbids telling you on important grounds of public interest. A request from anywhere else has to reach us through a UK or EU court or authority, and we challenge one that goes further than the law allows.

An instruction we think is unlawful. If we think an instruction of yours breaks Data Protection Law, we tell you straight away, and we may hold off carrying it out until you confirm it or change it.

4The people who can reach your data

Administrative access to the servers that hold Customer Personal Data is limited to the people who need it to provide the service, each with a key of their own. Each of them is bound to keep the data confidential, by contract or by law, and that duty lasts after they stop working with us. When someone no longer needs access, we remove their keys.

Each time we sign in to your server or run a command on it, it is recorded on your machine under our own account's name, so you can read what we did (clause 8 of the Terms). We keep our own record of when that account was used and why, and you can ask us for the part that concerns your server.

5Security

We keep the technical and organisational measures in Annex 2 in place, to give a level of security appropriate to the risk, as Article 32 requires. We may change a measure when a better one comes along, as long as the overall level of protection does not go down.

The machine is shared work, and so is its security. We look after the infrastructure, our access to it, and the software we install and keep up to date on your server, Claude Code and its configuration. You have full administrative rights on the server, so what you install and run there, the accounts and keys you create or hand out, who you let in, and how the data inside your own applications is protected are yours to secure (clause 6 of the Terms). So is a copy of anything you cannot afford to lose, on a plan without backups (clause 13).

6Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 3. Before we add or replace one, we update that list here and tell you by email at least 30 days before it starts processing Customer Personal Data. Where a replacement cannot wait, because a provider has failed or the security of the service needs it, we tell you as soon as we can and say why it could not wait.

You can object to a new sub-processor on reasonable grounds of data protection, by writing to us before the change takes effect. We will look for a way round it with you in good faith. If there is none, you may end the affected service before the change takes effect, and we refund the unused part of anything you paid in advance for it.

We put each sub-processor under data protection obligations that protect Customer Personal Data at least as well as this DPA does, including on security. We stay responsible to you for the way each of them does its part.

7Helping you meet your own obligations

Requests from the people the data is about. You hold full access to your server, so you can find, export, correct and delete what is on it yourself, and most requests under Chapter III of the GDPR are answered there. Where you cannot do it alone, we help, as far as the nature of the processing allows. If someone writes to us about Customer Personal Data, we pass the request to you without undue delay and do not answer it ourselves, except to tell them we have passed it on.

Personal data breaches. If we become aware of a personal data breach affecting Customer Personal Data, we tell you without undue delay and within 48 hours at the latest, by email to the address on your account. We tell you what we know of what happened, the kinds and rough number of people and records concerned, the likely consequences, what we have done and propose to do about it, and who to talk to, and we send what we did not know at first as soon as we have it. We take reasonable steps at once to contain the breach and limit the harm. Telling you is not an admission of fault. A breach that starts with something on your side, such as software you installed, a key you shared or what one of your agents did, is yours to report, and we help you find out what happened as far as our records allow.

Impact assessments and the regulator. We give you the information we hold that you reasonably need for a data protection impact assessment, or to consult a supervisory authority about one, about the processing we do for you (Articles 35 and 36). This DPA and its annexes are free; help that takes substantial work beyond them, we agree a fair charge for with you beforehand.

8Showing that we comply, and audits

We make available the information you need to see that we keep to Article 28: this DPA and its annexes, and our written answers to a reasonable security questionnaire, once a year, or at any time after a personal data breach or when a supervisory authority asks you.

If that is not enough, you, or an independent auditor bound to confidentiality who is not our competitor, may audit our compliance with this DPA once in any 12 months, with at least 30 days' written notice, in business hours, and in a way that does not disrupt the service or put another customer's data at risk. A supervisory authority may audit whenever the law gives it the right to. Each side bears its own costs. The physical data centres are run by the providers in Annex 3, so for them we pass on their security certifications and audit reports as far as they allow, rather than open their buildings to an audit.

9Where your data is

Customer Personal Data is hosted in the European Union: your server and its backups in Germany or Finland, the copies on our git server in Spain, and your agents' mail in Amazon's EU regions, as Annex 3 says. We do not move it to another country, ourselves or through a sub-processor, except as Annex 3 says and with the safeguards in clause 10.

10Transfers

We are established in the United Kingdom, so data you send us from the EEA reaches a country the European Commission has found adequate. If that adequacy decision stops applying to the transfer, the SCCs apply between us from that day, without anything more being signed: Module 2 where you are a controller and Module 3 where you are a processor, with you as data exporter and us as data importer. For those SCCs: the docking clause 7 applies; under clause 9 option 2 applies, with the notice period in clause 6 of this DPA; the optional wording in clause 11 does not apply; the supervisory authority is the one clause 13 points to; clauses 17 and 18 choose the law and the courts of Ireland; and Annexes 1 to 3 of this DPA fill in their annexes.

Where a sub-processor in Annex 3 receives Customer Personal Data outside the EEA and the UK, the transfer is made under the EU-US Data Privacy Framework, and its UK Extension, where the recipient is certified under it, and otherwise under the SCCs, with the UK Addendum to the SCCs for data from the United Kingdom, together with the measures that provider publishes.

Where Swiss law applies, the SCCs are read with the changes the Swiss Federal Data Protection and Information Commissioner requires: the Commissioner is a competent supervisory authority, the Swiss Federal Act on Data Protection stands next to the GDPR, and "member state" includes Switzerland, so that people in Switzerland can enforce their rights there.

11When the service ends

When the agreement ends, clause 11 of the Terms keeps your server, and what is on it, for 14 days so that you can take your data out, and we help you do that if you ask. After that we delete Customer Personal Data: the server and its backups go first, and every other copy we hold, the folders on our git server and your agents' mailboxes included, is deleted within 30 days of the end of the agreement. Incoming mail held by Amazon on its way to your agents deletes itself after 14 days. We keep a copy only where the law of the United Kingdom or of the EU or a member state requires us to, and only for as long as it does. On request we confirm the deletion in writing.

12Liability, changes and law

Liability. Each side's liability under this DPA is subject to the limits and exclusions in clause 16 of the Terms, except where Data Protection Law does not allow liability to be limited, including towards the people the data is about.

How long it lasts. This DPA applies for as long as we process Customer Personal Data for you, which can be longer than the agreement itself, until the deletion in clause 11 is done.

Changes. We publish a new version here with a new date and, where it matters, tell you by email at least 30 days beforehand. We will not change this DPA in a way that lowers the protection of Customer Personal Data, except where the law, a supervisory authority or new standard clauses require it, and then only as far as they do.

Law. This DPA is governed by English law, and the courts of England and Wales have jurisdiction over any dispute arising out of it, as for the Terms. The SCCs, where they apply, are governed by the law their own clauses choose.

A1Annex 1: the processing

A2Annex 2: technical and organisational measures

Who can get at your data

• No routine access to your server's contents, and no automated monitoring of them. A person looks only in the four cases clause 8 of the Terms names, and only as far as the case needs.
• Administrative access only for the people who need it, each with a named SSH key of their own. No shared accounts and no passwords on administrative logins.
• On each server, a separate management account that signs in with a key and has no password. Every sign-in and command is recorded on your machine under that account's name. A Mini is reached from its host server under the same rules and with the same record.
• Your own sign-in to the server is by the SSH keys you put on your account. We never ask for a private key.
• No passwords on the website: you sign in with a six-digit code sent to your mailbox, stored hashed, valid for ten minutes, good for one use, with a limit on wrong guesses.

Keeping customers apart

• Each server is a virtual machine of its own. Each Mini is a container of its own, and the connections it opens to the internet are logged against that Mini (where to and when, never what was sent), so that a complaint about the shared address leads to one Mini and not to all of them.
• On our git server, one repository per connected folder. Each machine's key opens its own repository and no other; history cannot be rewritten or deleted, by us either; the server has no web interface reachable from the network; and a push carrying a private key, an API key or a password file is refused. A folder you set to «Only me» is closed to our team's keys.

Data in transit and at rest

• The website and the dashboard only over TLS. Administrative access only over SSH. The browser terminal over an encrypted connection.
• Your agents' mail passes between our mail server and Amazon SES over an authenticated, encrypted connection. Incoming mail waiting in Amazon S3 is encrypted at rest.
• Files sent to us through the website are scanned for malware before they are stored, and are never served to the web.

The servers we run

• Firewalls that refuse anything not explicitly allowed, rate limits, and automatic blocking of addresses that probe or attack the servers that run the site.
• Security updates installed automatically on our own servers, and Claude Code and the configuration we ship kept up to date on yours.
• An automated health check of our infrastructure every night, which reports what it finds to the founders.

Availability

• Daily backups of the whole machine on plans that include them, held by the hosting provider in the same location as the server and deleted with it.
• A record of every server we build, so that one can be restored or rebuilt by the same steps.

Data centres and providers

• Physical security, power and hardware are the providers' in Annex 3, in data centres run under security programmes certified to ISO/IEC 27001.

People and incidents

• Everyone with access is bound to confidentiality, and their keys are removed when they no longer need access.
• An incident is handled in the order: contain it, find out what happened, tell those affected within the times in clause 7, fix the cause, and write down what we changed.
• We review these measures after any incident, and when the service changes in a way that touches them.

A3Annex 3: sub-processors

These are the only companies outside our team that process Customer Personal Data. The Privacy Policy lists the providers we use for our own purposes as controller, such as payments, which are not sub-processors under this DPA.