Data Processing Agreement

This Data Processing Agreement (the "DPA") is between NRD Tech LLC ("NRD Tech," "we," "us"), acting as processor, and the customer that accepts it ("Customer," "you"), acting as controller. It supplements the NRD Terms of Service at nrdsight.com/terms (the "Terms") and explains how we handle personal data on your behalf when you use our Services. We have kept it in plain English; the defined terms and the Standard Contractual Clauses it incorporates do the legal work.

1. Definitions

Capitalized terms not defined here have the meaning given in the Terms. In this DPA:

• "Agreement" means the Terms, the Privacy Policy and this DPA.
• "Services" means NRD Sight, NRD Compass and NRD Relay, and the shared NRD Platform sign-in and administration they use, to the extent Customer uses them.
• "Customer Data" has the meaning given in the Terms: source code, development data and everything derived from them for Customer's workspace, together with the other content Customer or its users put into the Services.
• "Customer Personal Data" means personal data contained in Customer Data that NRD Tech processes on Customer's behalf to provide the Services.
• "Data Protection Laws" means the data protection laws that apply to the processing of Customer Personal Data under the Agreement, which may include Regulation (EU) 2016/679 (the "GDPR"), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (the "UK GDPR"), the Swiss Federal Act on Data Protection (the "FADP"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA") and other U.S. state privacy laws.
• "controller," "processor," "data subject," "personal data," "processing" and "supervisory authority" have the meanings given in the GDPR, and their equivalents under other Data Protection Laws.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by NRD Tech or its Subprocessors.
• "Subprocessor" means a third party NRD Tech engages that processes Customer Personal Data in providing the Services.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

2. Scope, roles and how this DPA becomes part of the Agreement

2.1 Scope. This DPA applies whenever NRD Tech processes Customer Personal Data on Customer's behalf in providing the Services. The details of that processing are in Annex I.

2.2 Roles. Customer is the controller of Customer Personal Data and NRD Tech is its processor. NRD Tech acts as an independent controller only for the account, billing and operational information it processes for its own business purposes (administering accounts, billing, securing the Services and meeting legal obligations), as described in the Privacy Policy.

2.3 Incorporation. When a workspace owner accepts this DPA in the Services, or Customer otherwise signs it, this DPA forms part of the Agreement between Customer and NRD Tech from that moment, and it remains in effect for as long as NRD Tech processes Customer Personal Data. The person accepting confirms that they have authority to bind Customer. No further signature is needed.

2.4 Customer's responsibilities. Customer is responsible for having a lawful basis for the processing it instructs, for giving any notices to and obtaining any consents from its personnel and contributors that Data Protection Laws or employment law require (including about how the Services evaluate their work), and for having the authority to connect the repositories, work trackers and other sources it connects.

3. Processing on Customer's instructions

3.1 NRD Tech processes Customer Personal Data only on Customer's documented instructions, unless the law that applies to NRD Tech requires otherwise, in which case NRD Tech will tell Customer of that legal requirement before processing unless the law prohibits it.

3.2 Customer's documented instructions are the Agreement and Customer's configuration and use of the Services: the repositories it enables, the integrations it connects, the settings it chooses (for example whether review comments are posted on pull requests or the merge gate is turned on), and requests it makes to support. Any additional instruction needs NRD Tech's written agreement.

3.3 NRD Tech will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.4 NRD Tech does not sell Customer Personal Data, does not use Customer Data to train AI models, and does not use one customer's data to benefit another. As the Terms describe, NRD Tech may use aggregated, de-identified operational metrics, which never include code or anything identifying Customer or its developers, to operate and improve the Services.

4. Confidentiality of personnel

NRD Tech ensures that everyone it authorizes to process Customer Personal Data is bound by an appropriate obligation of confidentiality. Production access is restricted, logged, and used only to operate the Services or to support Customer at Customer's request.

5. Security

5.1 NRD Tech implements and maintains the technical and organizational measures described in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches and are appropriate to the risks of the processing.

5.2 NRD Tech may update these measures as technology and threats change, provided the update does not materially reduce the overall protection of Customer Personal Data.

5.3 Customer is responsible for its own use of the Services, including protecting its users' credentials, deciding who has access to its workspace, and choosing which repositories and data sources to connect.

6. Subprocessors

6.1 Authorization. Customer gives NRD Tech general authorization to engage Subprocessors. The Subprocessors in use on the effective date are listed in Annex III; the live list is published at nrdsight.com/privacy#subprocessors.

6.2 Notice of changes. NRD Tech will update the live list and email Customer's workspace owners at least 14 days before a new Subprocessor begins processing Customer Personal Data.

6.3 Emergency replacement. Where a change is needed urgently to protect the security, integrity or availability of the Services (for example, a vendor failure or a security incident), NRD Tech may replace a Subprocessor with shorter notice. It will update the live list and notify Customer's workspace owners as soon as practicable, and Customer's right to object under Section 6.4 still applies, running from that notice.

6.4 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing support@nrdsight.com within 14 days of the notice. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services by written notice; this is Customer's sole remedy for the objection.

6.5 Obligations. NRD Tech imposes data protection obligations on each Subprocessor that are no less protective than those in this DPA, to the extent they apply to the service that Subprocessor provides, and remains responsible to Customer for each Subprocessor's performance of those obligations.

6.6 AI models. The AI models the Services use are provided through Amazon Bedrock, within Amazon Web Services, which is listed in Annex III as the Subprocessor for that processing. As the Privacy Policy describes, under Amazon Bedrock's terms prompts and outputs are not used to train or improve the underlying models and are not shared with model providers for that purpose. Changing or adding the models NRD Tech uses through Amazon Bedrock is therefore not a change of Subprocessor under this Section.

6.7 Services Customer connects. Some providers in the list (GitHub, Atlassian, Linear, Google and Microsoft) appear because Customer Personal Data passes between them and the Services when Customer chooses to connect them or to sign in with them. Customer's own agreement with each of those providers governs that provider's processing.

7. Data subject requests

7.1 Taking into account the nature of the processing, NRD Tech assists Customer, insofar as possible, in responding to requests from data subjects to exercise their rights. Customer can handle many requests directly in the Services, for example by managing its users and choosing which repositories are analyzed. For export or deletion that Customer cannot complete itself, Customer may email support@nrdsight.com.

7.2 If NRD Tech receives a request directly from a data subject that identifies Customer, it will forward the request to Customer without undue delay and will not respond to it, other than to refer the data subject to Customer, unless the law requires otherwise.

8. Personal Data Breaches

8.1 NRD Tech will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice goes to Customer's workspace owners by email.

8.2 The notice will include the information reasonably available to NRD Tech at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned where known, its likely consequences, the measures taken or proposed to address it, and a contact for further information. Where not all of this is available at once, NRD Tech will provide it in phases as it becomes available.

8.3 NRD Tech will take reasonable steps to contain and investigate the breach and to reduce its effects. Notifying a breach is not an acknowledgement of fault or liability.

9. Data protection impact assessments

Where Data Protection Laws require it, NRD Tech will give Customer reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority that relate to Customer's use of the Services, taking into account the nature of the processing and the information available to NRD Tech. NRD Tech assists first by making available this DPA, its security page and the security documents described in Section 11; further assistance is at Customer's reasonable cost.

10. Deletion and return

10.1 During the term. Customer may request an export of its Customer Data at any time.

10.2 On termination. NRD Tech will delete Customer Personal Data within 30 days of Customer's written request, or, if Customer prefers, after a 60-day export window following account closure, except minimal records NRD Tech must keep for legal, billing or security purposes. Anything kept for those purposes remains protected by this DPA for as long as it is kept.

10.3 Backups. Automated database backups are retained for 14 days. Customer Personal Data deleted from the live database remains only in those backups until they expire on that schedule.

10.4 Relay history. NRD Relay keeps published review history for the retention period Customer configures (seven years by default, adjustable from one to ten years), and ending a subscription does not by itself erase it. Customer may request its deletion under Section 10.2.

11. Information and audits

11.1 NRD Tech makes available to Customer the information reasonably necessary to demonstrate compliance with this DPA: this DPA, its security page, its responses to the CSA CAIQ v4 security questionnaire and its architecture overview (available on request), and the third-party attestations that Amazon Web Services holds for the infrastructure the Services run on. NRD Tech does not itself hold a SOC 2 report or ISO 27001 certification; the attestations referred to are AWS's.

11.2 If Data Protection Laws or a supervisory authority require an audit or inspection beyond that information, NRD Tech will allow it, provided that: it is carried out at Customer's cost by Customer or an independent auditor bound by confidentiality; Customer gives at least 30 days' written notice; it takes place during normal business hours and does not unreasonably disrupt the Services; it does not give access to other customers' data; and it happens no more than once in any 12-month period, unless a supervisory authority requires otherwise or it follows a Personal Data Breach.

12. International transfers

12.1 Where data is processed. Customer Personal Data is hosted in the United States, in Amazon Web Services' us-west-2 region. Amazon Bedrock may serve an analysis request from another AWS region in the United States; Customer Personal Data does not leave the United States.

12.2 EU Standard Contractual Clauses. To the extent Customer Personal Data subject to the GDPR is transferred to NRD Tech in a country without an adequacy decision, the SCCs, Module Two (controller to processor), are incorporated into this DPA by reference, with Customer as data exporter and NRD Tech as data importer, and with these elections:

• Clause 7 (docking clause) is included.
• Clause 9(a): Option 2 (general written authorization) applies, and the time period for prior notice of changes is 14 days, as set out in Section 6.2.
• Clause 11(a): the optional language is not used.
• Clause 13: the competent supervisory authority is determined in accordance with Clause 13(a), as set out in Annex I.C.
• Clause 17: Option 1 applies, and the governing law is the law of Ireland.
• Clause 18(b): disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annex I, Annex II and Annex III of this DPA.

12.3 UK transfers. To the extent Customer Personal Data subject to the UK GDPR is transferred, the UK Addendum is incorporated into this DPA by reference and amends the SCCs as incorporated under Section 12.2. In the UK Addendum: Table 1 is completed with the parties' details in Annex I.A; Table 2 refers to the SCCs incorporated under Section 12.2, with the module and elections stated there; Table 3 is completed by Annexes I, II and III of this DPA; and for Table 4, neither party may end the UK Addendum under its Section 19.

12.4 Swiss transfers. To the extent Customer Personal Data subject to the FADP is transferred, the SCCs incorporated under Section 12.2 apply with these adaptations: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; and "Member State" in Clause 18(c) is read so that data subjects in Switzerland can bring claims where they habitually reside.

12.5 Accepting this DPA counts as each party's signature of the SCCs and the UK Addendum as incorporated here. If the SCCs or the UK Addendum conflict with any other part of the Agreement, they prevail.

13. CCPA and other U.S. state privacy laws

To the extent the CCPA or a similar U.S. state privacy law applies, NRD Tech acts as Customer's "service provider" (or "processor") and: (a) does not sell or share Customer Personal Data, as those terms are defined in the CCPA; (b) does not retain, use or disclose Customer Personal Data for any purpose other than the business purpose of providing the Services under the Agreement, or outside its direct business relationship with Customer; (c) does not combine Customer Personal Data with personal information it receives from or on behalf of others, except as the CCPA permits; (d) complies with the obligations that apply to it under the CCPA and provides the same level of privacy protection the CCPA requires; and (e) will notify Customer if it determines it can no longer meet these obligations, in which case Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. NRD Tech understands and will comply with these restrictions.

14. Liability

Each party's liability arising out of or relating to this DPA, including the SCCs and the UK Addendum to the extent the law allows, is subject to the limitations and exclusions of liability in the Terms, and counts toward the same aggregate cap. Nothing in this DPA limits the rights of data subjects under the SCCs.

15. Order of precedence

If there is a conflict: the SCCs and the UK Addendum prevail where they apply; otherwise, this DPA prevails over the Terms and the Privacy Policy on matters of data protection; in all other respects the Terms prevail.

16. Term, new versions and general terms

16.1 This DPA lasts for as long as NRD Tech processes Customer Personal Data, and Sections 10, 11 and 14 survive until the deletion described in Section 10 is complete.

16.2 NRD Tech may publish new versions of this DPA at nrdsight.com/dpa. A new version applies to Customer once a workspace owner accepts it; until then, the version Customer accepted continues to apply.

16.3 Except as Section 12 provides for the SCCs and the UK Addendum, this DPA is governed by the law and venue provisions of the Terms.

16.4 Contact for anything in this DPA: support@nrdsight.com, NRD Tech LLC, United States.

Annex I: Processing details

A. Parties

B. Description of the processing and transfer

C. Competent supervisory authority

The supervisory authority determined in accordance with Clause 13(a) of the SCCs. For transfers governed by the UK GDPR, the UK Information Commissioner; for transfers governed by the FADP, the Swiss Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational security measures

• Hosting. The Services run on Amazon Web Services in the us-west-2 region (United States). AI analysis runs on Amazon Bedrock in the United States; under Bedrock's terms, prompts and outputs are not used to train the underlying models. AWS holds SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018 and PCI DSS attestations for its infrastructure; these are AWS's attestations, not NRD Tech's.
• Encryption in transit. TLS 1.2 or higher on every connection over the internet; traffic between NRD Tech's services stays inside its private AWS network.
• Encryption at rest. The database is encrypted at rest with AWS KMS; object storage, including stored diffs, is encrypted with AES-256; secrets are held in AWS Secrets Manager.
• Network exposure. The database is not publicly accessible, and object storage buckets block all public access.
• Repository access. Access is limited to the repositories Customer enables. The Services read repository contents, pull requests and metadata and never push code or change branches; the only writes are optional review comments on a pull request and, if Customer turns on the merge gate, a check or build status and pull request tasks. Uninstalling the GitHub App or revoking Bitbucket access ends access immediately.
• Tenant isolation. Every row of Customer Data is bound to Customer's workspace and isolated with PostgreSQL row-level security enforced at the database layer, and the application connects as a restricted database role that is subject to those policies.
• Access control and least privilege. Role-based access within each workspace, with billing and legal acceptance limited to owners; credentials Customer provides for integrations (for example Linear keys and Jira tokens) are stored per tenant in AWS Secrets Manager, never in the database or application configuration; production access is restricted and logged.
• Backups and resilience. Automated database backups are retained for 14 days, and the production database has deletion protection enabled.
• Logging and monitoring. Service logs are kept in Amazon CloudWatch, with secrets and code kept out of logs; administrative actions in each workspace are recorded in an audit log; Amazon GuardDuty findings of high severity and operational alarms alert NRD Tech's operators.
• Change management. Every production change goes through a pull request with required automated tests before it deploys.
• Vulnerability disclosure. NRD Tech publishes a vulnerability disclosure policy with a safe harbor for good-faith research and a security.txt file, and acknowledges reports within three business days.
• Payments. Card payments are handled by Stripe; card numbers never reach NRD Tech's servers.
• Incident response. Personal Data Breaches are handled and notified as Section 8 describes.

Annex III: Subprocessors

The Subprocessors on the effective date of this version. The live list is at nrdsight.com/privacy#subprocessors, and changes follow Section 6. Models offered through Amazon Bedrock are covered by the Amazon Web Services entry (Section 6.6).