Data Processing Agreement

1. Roles

You decide what personal data your apps hold and why: you are the controller, or a processor for your own customer. We process that data only to host and run your apps: we are your processor, or your sub-processor.

For the data about your account that we need to run the service and bill you, we are the controller. Privacy for Koru hosting covers that data.

2. Your instructions

We process your personal data only on your documented instructions, including about transfers outside the European Economic Area. They are the Hosting Terms, this agreement, and what you do in Koru hosting, such as deploying an app, adding a database, a bucket or a watcher, or deleting them.

If the law makes us process your data in another way, we tell you before we do, unless the law forbids that. If we think an instruction breaks data protection law, we tell you.

3. Confidentiality

Everyone we authorise to process your personal data is bound to keep it confidential.

4. Security

We keep the measures in Annex 2. We may change them as technology moves on, but we never lower the overall level of protection.

5. Sub-processors

• Your authorisation. You authorise us to use the sub-processors in Annex 3.
• The watcher. Anthropic, in Annex 3, processes your data only for an environment where you turn on a watcher, and turning one on is your authorisation for that environment. An account that never turns one on sends Anthropic nothing.
• Changes. We tell you by email at least 30 days before we add or replace a sub-processor, and update Annex 3. You can object on reasonable data protection grounds before the change takes effect. If we cannot resolve your objection, you can end the agreement for the affected service before the change takes effect, without any charge for ending it.
• Their duties. Each sub-processor is bound by a written contract with data protection duties no weaker than these. We remain responsible to you for them.

6. Transfers outside the EEA

We host your apps in Frankfurt, Germany, and run Koru’s own servers in Sweden. Some of our sub-processors belong to groups outside the European Economic Area (Annex 3). Where personal data could reach a country outside the EEA through one of them, the transfer is covered by a safeguard under Chapter V of the GDPR, such as the EU’s standard contractual clauses or the EU-US Data Privacy Framework.

For an environment with a watcher, the patterns of its logs are read by Anthropic’s AI model, which may run in the United States and other countries outside the EEA. That transfer is covered by the standard contractual clauses (module three, processor to processor) in Anthropic’s data processing addendum.

7. Requests from people

Your apps, databases and buckets are under your control: you can find, correct, export and delete the data in them yourself, so you can answer requests from the people the data is about. We do not see that data, but we help where we can, for example by explaining how the platform works. If someone sends us a request about data in your apps, we pass it on to you and do not answer it ourselves.

8. Personal data breaches

• We tell you without undue delay after we become aware of a personal data breach that affects your data, and we aim to do so within 48 hours.
• We tell you what we know: what happened, which of your apps, databases, disks or buckets are affected, the likely consequences, and what we have done and will do. We send more as we learn it. Because we do not see your data, we often cannot tell which people or records are affected; you know that best.
• We send the notice to the email address of your Koru account.
• Telling you about a breach is not an admission of fault.

9. Help with your other duties

We give you the information about Koru hosting that you need for your own security, for data protection impact assessments and for consultations with supervisory authorities, mainly through this agreement and Annex 2.

10. Requests from authorities

If an authority asks us for personal data in your apps, we refer it to you, as the controller, where the law allows. We tell you about the request unless the law forbids it, and we hand over only what the law obliges us to. Koru’s own servers hold the names and settings of your apps and the ciphertext of your values, not what your apps hold.

11. Information and audits

We make available the information needed to show that we keep this agreement. You, or an auditor you appoint who is bound to confidentiality, may audit us once a year with 30 days’ notice, and at any time after a personal data breach or when a supervisory authority requires it. An audit takes place during working hours, at your cost, and must not give access to other customers’ data. For our sub-processors’ part, we rely on their own audit reports and certifications where they cover it.

12. When the agreement ends

When the Hosting Terms end, you can take your data with you as their section 7 describes. After the retrieval period we delete your personal data, unless the law requires us to keep it, for example under a removal order. Its copies in our backups are removed as Annex 2 describes.

13. Liability, term and law

This agreement lasts as long as we process personal data for you. Liability between us follows the Hosting Terms; nothing in them limits the rights of the people the data is about. Swedish law applies, and disputes are settled as the Hosting Terms say.

Annex 1. The processing

Annex 2. Security measures

Isolation between customers

• Each account’s apps and databases run in a namespace of their own, and every container in it runs inside a gVisor sandbox. A container that is not in the sandbox is refused.
• Network rules let an app take traffic only through the platform (its gateway, or a server’s own public ports), and send only to the internet, its own account’s databases and the store that keeps its buckets, never to other customers, the platform’s own addresses or the cloud’s metadata service. Databases take traffic only from their own account’s apps in the same environment and from Koru’s tunnel, and cannot reach the internet.
• Apps get no access to the cluster’s API, no privilege escalation, and the default filter of system calls.

Secrets and access

• The values of variables are sealed on the owner’s device, each with a key of its own (AES-256-GCM) wrapped for one environment (RSA-OAEP). Koru’s servers keep only names and ciphertext, and the values are opened only inside that environment.
• The secrets the cluster stores are encrypted at rest.
• Koru’s servers drive the cluster with an account that cannot read secrets or enter containers.
• Database passwords are made on the owner’s device. Databases have no superuser login, take connections over TLS, and are reached from outside only through Koru’s tunnel, with one key per database that opens that database alone.
• Each bucket has a key of its own that reaches only that bucket. Files go straight between the owner’s device and the store; Koru’s servers never see the files or the key. Buckets are private: without the key, a file opens only through a signed link that expires.

Logs and builds

• Logs stream from the cluster to the app’s owner and are not stored on Koru’s servers.
• A watcher runs only where the owner turns one on. Its collector, a part of the cluster on its control servers, reads that environment’s logs, and the values of its variables in memory alone, only to take those of 8 characters or more out of each line. It keeps patterns and counts, never lines, in the cluster until the watcher is turned off, and the cluster’s backups keep copies of them until those backups are deleted. It can reach nothing on the internet.
• Only the patterns, their counts and the instances’ states, with the names of the app and the environment and when it was last deployed, go to the watcher’s AI model, never a line as the app wrote it. The model answers in a fixed form, Koru’s code writes the alert from that answer, and the model cannot act on your apps.
• An uploaded project folder is kept only until its build has finished.
• Builds run on servers that do not run apps.

Servers and storage

• Each server has a firewall of its own that opens only the platform’s ports. SSH accepts keys only, and the cluster’s API answers only Koru’s own servers and its operator.
• Disks are encrypted.
• Databases, disks and buckets are backed up every day. Their contents are encrypted before they leave the cluster, so the backup store holds them only as ciphertext.
• A file deleted from a bucket, what a file held before it was changed, and a whole bucket deleted are removed from the backups within 40 days.
• Each backup of a database or disk is kept for 30 days and then deleted. What it held stays in the backup store for at least 35 days after that, until the store’s clean-up removes it.
• What the cluster records about the apps, such as their names and settings, is backed up beside them under the backup store’s own encryption at rest, with the values of their variables only as the cluster stores them, encrypted. Copies of these records stay until the backups that hold them are deleted.

People

• Fly by wire’s operators have access to the servers that run customers’ apps. They use it only to keep Koru hosting running, to fix problems, or when the law requires it.
• Our monitoring of the platform watches how servers, apps and databases run, such as whether they answer and how much processor, memory, disk and traffic they use, never what customers’ databases, disks and buckets hold.

Annex 3. Sub-processors