Legal · Draft · pending counsel review

Data Processing Addendum

The DPA covering PSCO's processing of personal data on the customer's behalf. Draft pending counsel review.

Updated 2026-11-09

This is a placeholder. The Data Processing Addendum is being drafted with counsel and will be available for signature before public launch.

What the DPA will cover

Roles: the customer as controller, PSCO as processor for customer user and auditor contact data.
Scope of processing: names, emails and roles of authorized users; metadata about pull requests (repository, number, author login, paths, timestamps). No source code is stored; see the code-at-rest policy on the Trust page.
Subprocessors and notice of changes.
Security measures: Row Level Security, envelope encryption of stored credentials, mandatory TOTP for PSCO staff, audit logging, US-only staffing.
Data subject requests, breach notification timelines, and audit rights.
Retention and deletion, including the seven-year retention of evidence records.
International transfers: PSCO staff and subprocessors are in the United States.

Customers who need a signed DPA before launch can request one through the booking page.