Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, our customer ("Customer", "Controller", "you") and Observer ("the Company", "Processor", "we"). It applies whenever the Company processes Personal Data on the Customer's behalf in connection with the Service.

By accepting the Terms of Service, the Customer accepts this DPA. The Customer does not need to print, sign, or send a separate copy. The Company has pre-signed this DPA by publishing it. If the Customer's procurement process requires a separately executed copy, write to [email protected] and we will arrange one.

Defined terms used in this DPA have the meaning given in UK GDPR, EU GDPR, or the Terms of Service unless otherwise defined here.

1. Roles, subject matter, and duration

The Customer is the Controller of Personal Data uploaded to or generated through the Service ("Customer Personal Data"). The Company is the Processor of that Personal Data. The Company processes Personal Data only on the Customer's documented instructions, as set out in the Terms of Service, this DPA, and the Customer's use of the Service.

The subject matter of the processing is the provision of monitoring, alerting, and status communication services by the Company to the Customer. The nature and purpose of the processing is described in the Privacy Policy and in this DPA.

The Company is an independent controller, not a processor, for the personal data it needs to run its own business: account and sign-in data, billing records, audit and security logs, support requests, and website analytics. That processing is described in the Privacy Policy and is outside this DPA.

The duration of the processing matches the duration of the Customer's subscription to the Service, plus the data-retention windows described in section 9.

2. Categories of Personal Data and Data Subjects

The categories of Personal Data processed and the categories of Data Subjects are:

3. Customer's responsibilities as Controller

The Customer warrants that:

1. it has a lawful basis under UK GDPR or EU GDPR (or any other applicable law) for processing each category of Personal Data it provides to or generates through the Service;
2. it has provided any notice or obtained any consent required for the processing it asks the Company to perform;
3. its instructions to the Company through use of the Service do not require the Company to process Personal Data in a way that breaches applicable law;
4. it is the Controller of the Personal Data of the end users of any status pages it creates, and it is responsible for providing them with a privacy notice, handling their data subject rights requests, and obtaining any consent required from them;
5. it monitors only systems that it owns or has explicit authorisation to monitor.

4. Company's obligations as Processor

The Company will:

1. process Personal Data only on the Customer's documented instructions, including with regard to transfers, save where required to do so by UK or EU law. If required by such a law to process otherwise, the Company will inform the Customer of that legal requirement before processing, unless the law prohibits the Company from doing so;
2. ensure that any person authorised to process Personal Data on the Company's behalf is bound by a duty of confidentiality;
3. apply appropriate technical and organisational measures to protect Personal Data, as described in Annex II below;
4. assist the Customer, taking into account the nature of the processing, by appropriate technical and organisational measures, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights;
5. assist the Customer in ensuring compliance with its obligations under UK GDPR Articles 32 to 36 / EU GDPR Articles 32 to 36 (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to the Company;
6. make available to the Customer the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits in accordance with section 8;
7. immediately inform the Customer if, in its opinion, an instruction from the Customer infringes UK GDPR, EU GDPR, or any other applicable data protection law.

Assistance under this DPA (including under sections 4, 7, and 10) beyond what the Service's self-service features provide is at the Customer's cost, at the Company's reasonable rates, except where it is needed because of the Company's own breach of this DPA.

5. Sub-processors

The Customer authorises the Company to engage the sub-processors listed at Subprocessors. The Company will:

1. enter into a written agreement with each sub-processor that imposes data protection obligations no less protective than those in this DPA;
2. remain liable to the Customer for the acts and omissions of its sub-processors;
3. inform the Customer in advance of any intended addition or replacement of a sub-processor, by email to the account owner and by updating the Subprocessors page, before the new sub-processor processes Customer Personal Data;
4. allow the Customer to object to the change on reasonable data-protection grounds. If the objection cannot be resolved, the Customer may terminate the affected part of the Service by written notice, as its sole remedy.

Recipients the Customer chooses (such as its chat, incident, ticketing, email, or webhook destinations, and the systems its Agents query) receive Personal Data on the Customer's instruction and are not the Company's sub-processors.

6. International transfers

The Company is established in the United Kingdom. The production database holding Customer Personal Data, its standby, and its backups are hosted in the European Economic Area and the United Kingdom, on a primary environment and a continuously replicated standby environment operated by different hosting providers. The hosting providers, and the location in which each one processes Personal Data, are listed at Subprocessors. Transfers between the European Economic Area and the United Kingdom for this purpose rely on adequacy: the European Commission's adequacy decision for the United Kingdom for EU Personal Data, and the United Kingdom's adequacy regulations covering the European Economic Area for UK Personal Data. No Standard Contractual Clauses are required for those transfers.

Transfers of EU Personal Data from the Customer to the Company rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, or a transfer from the Customer to the Company is otherwise a restricted transfer that needs safeguards, the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (Controller to Processor), are incorporated by reference and completed as follows: the "data exporter" is the Customer; the "data importer" is the Company; the optional docking clause in Clause 7 applies; Option 2 of Clause 9 (general written authorisation) applies, with notice given as set out in section 5; the optional language in Clause 11 does not apply; Annex I is as set out in section 2 and Annex I below; Annex II is as set out in Annex II below; Option 1 of Clause 17 applies with the law of Ireland; and the courts of Ireland are chosen under Clause 18.

Where the Company transfers Customer Personal Data to a sub-processor outside the United Kingdom and the European Economic Area (for example, a sub-processor in the United States), the transfer is made under a mechanism recognised by UK GDPR and EU GDPR: the European Commission's 2021 Standard Contractual Clauses together with the UK International Data Transfer Addendum (version B1.0), or, where the sub-processor is certified, the EU-US Data Privacy Framework and its UK Extension. The Subprocessors page shows the mechanism for each sub-processor.

For transfers of UK Personal Data that need safeguards, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) applies to the clauses above, governed by the laws of England and Wales.

7. Personal data breaches

The Company will notify the Customer without undue delay after becoming aware of any Personal Data breach affecting Customer Personal Data. The notification will include, to the extent known:

1. a description of the nature of the breach, including categories and approximate number of Data Subjects and records concerned;
2. the likely consequences of the breach;
3. measures taken or proposed to address the breach and mitigate possible adverse effects.

Where the Company does not have all of this information at the point of notification, it will provide it in phases without further undue delay. The Company's notification is not an admission of liability.

8. Audit rights

The Customer has the right, no more than once in any 12-month period, to audit the Company's compliance with this DPA, subject to the following:

1. the Customer gives at least 30 days' written notice;
2. the Company may first respond to the request with documentation (for example, written answers to the Customer's questions and the technical and organisational measures in Annex II of this DPA). An on-site or remote audit takes place only if that documentation does not reasonably demonstrate the Company's compliance with this DPA;
3. the audit is conducted during the Company's normal business hours, in a way that does not unreasonably interfere with the Company's operations;
4. the audit is subject to confidentiality: the auditor signs a confidentiality agreement on terms reasonable to the Company;
5. the audit is at the Customer's cost: the Customer bears its own and the auditor's costs, and reimburses the Company for time spent at the Company's reasonable rates;
6. where the Company has independent third-party reports (for example, ISO 27001 or SOC 2 reports, none currently held; see the Security page for current state), the Customer will accept those reports in lieu of an on-site audit where they cover the issues being audited.

A regulatory authority's right to audit is not affected by the limits in this section.

9. Return and deletion of data

On termination of the Customer's subscription:

1. when the Customer deletes its organisation, or the Company terminates it, Customer Personal Data is removed from active systems and deleted from backups within 90 days, unless law requires the Company to retain it;
2. the Customer should export any Customer Personal Data it wants to keep, using the export features and API available on its plan, before deleting its organisation. Until the data is deleted from active systems, the Company will make reasonable efforts to provide an export on request.

Cancelling a paid subscription does not by itself end processing: the organisation moves to the Free plan and its data is kept until the organisation is deleted.

10. Data Subject requests

If the Company receives a request from a Data Subject relating to Customer Personal Data, the Company will:

1. not respond directly without the Customer's prior authorisation, unless legally required to do so;
2. promptly notify the Customer of the request;
3. provide reasonable assistance to enable the Customer to respond.

11. Liability

The Company's total aggregate liability under or in connection with this DPA, however arising (including breach of contract, negligence, or breach of statutory duty), is included within and subject to the same limitation, exclusion, and aggregate cap set out in the Terms of Service, including the mandatory carve-outs for liability that cannot be excluded under the laws of England and Wales (death or personal injury caused by negligence, fraud, and any other liability that cannot be limited under English law). The Customer acknowledges and agrees that any claim arising under this DPA is part of, and not separate from, the liability allocation in the Terms of Service.

12. Governing law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.

13. Order of precedence

In the event of conflict between this DPA and the Terms of Service, the conflicting provision of this DPA prevails for matters relating to the processing of Personal Data; the Terms of Service prevail for all other matters.

---

Annex I. Description of processing

A. List of Parties

• Data exporter (Controller): the Customer, as identified by the account that accepted the Terms of Service.
• Data importer (Processor): Observer, a sole trader based in England, United Kingdom, trading as "Observer".

B. Description of Transfer

• Categories of Data Subjects: as listed in section 2.
• Categories of Personal Data: as listed in section 2.
• Special categories of Personal Data: none intentionally processed. Where the Customer chooses to include such data in monitoring configuration or content, the Customer is responsible for any additional safeguards required under Article 9.
• Frequency of transfer: continuous, for the duration of the Customer's subscription.
• Nature of processing: storage, hashing, computation, retrieval, transmission, display via the Service.
• Purpose of processing: provision of the Service in accordance with the Terms of Service.
• Period of storage: as described in section 9 above and in the Privacy Policy.

C. Competent supervisory authority

For UK Personal Data: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, ico.org.uk.

For EU Personal Data: the supervisory authority of the EEA member state in which the relevant Customer or its representative is established.

---

Annex II. Technical and organisational measures

The Company applies the following technical and organisational measures to protect Personal Data. These describe what the Company actually does today; further detail is in the Security page.

Encryption in transit. All connections to the Service are served over TLS, and the Service sends HTTP Strict Transport Security headers. The Observer Agent connects to the Service over HTTPS.

Encryption at rest. Database backups are encrypted at rest in object storage. Credentials that customers store for alerting integrations (such as webhook URLs, routing keys, and signing secrets), subscriber channel destinations, and wallet push tokens are encrypted with AES-GCM before they are written to the database.

Authentication and access control. Access to the console requires authentication through the Company's identity provider. API access requires bearer tokens, stored only as SHA-256 hashes. Private status pages can be protected by a password (stored as a salted scrypt hash), signed access links, IP allowlists, or sign-in with an allowlist of email addresses or domains. The Observer Agent uses keys generated from 32 bytes of cryptographically random data; the raw key is shown once and only its SHA-256 hash is persisted. Agent keys can be rotated with a grace period or revoked immediately. Credentials the Agent uses to reach customer systems (such as database connection strings, client certificates, and access tokens) are referenced by environment-variable name and resolved on the customer's host; for those, the Company stores only the name.

Tenancy isolation. Every database read and write is filtered by organisation identifier at the application layer. The isolation boundary is exercised by automated cross-tenant access tests on every build.

Audit logging. Administrative actions are recorded in an audit log capturing actor, action, target, client IP address, User-Agent, and a timestamp. The Service offers no means to edit audit entries. Audit log entries are retained for 90 days and then deleted automatically.

Webhook security. Webhooks sent to status page subscribers are always signed using HMAC-SHA-256 with a per-subscription secret. Webhooks sent to destinations the Customer configures for alerting are signed in the same way when the Customer sets a signing secret. The signed material includes a timestamp to allow receivers to reject delayed deliveries. Outbound requests are checked against private and internal network addresses before they are sent.

Network controls. The Service is protected by denial-of-service mitigations. Application-level rate limiting is applied to the public API, Agent ingestion, and public status page endpoints; sign-in is protected by the identity provider's own controls.

Backups and disaster recovery. Full backups of the production database are currently taken daily, and the database's write-ahead log is archived continuously. Together they allow point-in-time recovery within the backup retention period, which is currently up to 30 days. Backups are encrypted at rest and are stored separately from the primary environment. A continuously replicated copy of the production database is kept ready and can take over if the primary environment fails.

Personnel. Production access is limited to a small set of authorised administrators bound by confidentiality and security obligations. Additional personnel are bound by the same obligations before being granted access.

Support diagnostics. Diagnostics a user chooses to attach to a support request are scrubbed of keys and tokens in the browser before they are sent, screen recordings mask form inputs, and screenshots and recordings are stored privately and deleted automatically after 60 days.

Vendor management. Third-party processors are listed at Subprocessors. Each is engaged under a written agreement with GDPR-compliant terms.

Incident response. The Company maintains a security disclosure address ([email protected]) and an RFC 9116 security.txt. A formal incident response plan with documented runbooks is in development.

Out of scope today. The Company does not currently hold SOC 2 Type II, ISO 27001, HIPAA, or PCI DSS certifications. The Company does not provide a service-level credit regime; please see the limitation of liability in the Terms of Service.