Processor commitments
For personal data in customer workspaces, SignalDeck acts as a processor for the customer, which is the controller. We process it only on the customer's documented instructions (these Terms and the customer's use of the Service), ensure people with access are bound by confidentiality, help the customer respond to data subject requests and carry out impact assessments, and delete or return the data at the end of the service as described in the Privacy Policy.
Security measures
Tenant-scoped authorization with workspace isolation, encrypted provider tokens, managed key vault for secrets, private networking for databases and caches, encryption in transit (TLS) and at rest, malware scanning of uploads, audit records, rate limiting, and backup and restore procedures.
Subprocessors
We use the subprocessors on our subprocessor list, under written terms that protect the data at least as well as this addendum. We will give notice of new subprocessors before they process customer personal data, and customers may object on reasonable data protection grounds.
Breach notification
We will notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting its workspace data, with the information the customer reasonably needs to meet its own obligations.
International transfers
Customer data is hosted in the United States. Where data protection law requires, transfers are made under the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference.