Skip to content
qaitai
Menu
Get started

Draft · not in force · pending review by counsel

DRAFT — not legal advice. Requires review by counsel before publication. Template only. Placeholders in [[DOUBLE_BRACKETS]] must be filled first; see docs/legal/README.md.

Data Processing Addendum (DPA)

Effective: [[EFFECTIVE_DATE]]

This DPA forms part of the Terms of Service (or other agreement) between the customer ("Customer", controller) and [[LEGAL_ENTITY]] ("qaitai", processor) for qaitai Cloud. It applies when qaitai processes personal data on Customer's behalf. It does not apply to self-hosted qaitai, where qaitai processes no Customer data.

1. Definitions

"GDPR" means Regulation (EU) 2016/679 and, where relevant, the UK GDPR and the Swiss FADP. "Customer Personal Data" means personal data in Customer Data that qaitai processes for Customer. Other terms have the meanings given in the GDPR.

2. Processing

  1. qaitai processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's use and configuration of the service (for example the journeys, targets and secrets it sets up) are those instructions. qaitai will tell Customer if it believes an instruction breaks data protection law.
  2. The details of processing are in Annex I.
  3. Customer is responsible for having a lawful basis for the data in the apps it tests, and should use test data where possible.
  4. qaitai does not sell Customer Personal Data or use it to train AI models.

3. Confidentiality

Everyone at qaitai with access to Customer Personal Data is bound by confidentiality obligations. Production access is limited to staff who need it and is logged.

4. Security

qaitai implements the measures in Annex II and may update them if the overall level of protection does not decrease.

5. Subprocessors

  1. Customer authorizes the subprocessors listed at subprocessors (Annex III).
  2. qaitai gives at least 30 days' notice of new subprocessors. Customer may object on reasonable data protection grounds within that period; if the parties can't resolve it, Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
  3. qaitai imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance.
  4. Providers that Customer connects with its own keys (BYOK) are Customer's own processors, not qaitai's subprocessors.

6. Data subject requests and assistance

qaitai will forward requests it receives from data subjects about Customer Personal Data to Customer, and will help Customer respond, carry out data protection impact assessments and consult regulators, to the extent reasonable and taking into account the nature of the processing.

7. Personal data breaches

qaitai will notify Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and people likely affected, likely consequences and measures taken, as far as known, and will be updated as more is learned. This matches the incident commitments in SECURITY.md.

8. Deletion and return

Customer can export and delete its data in the app. On termination, qaitai deletes Customer Personal Data within 30 days after the export window in the Terms, and from backups within [[BACKUP_RETENTION]], unless the law requires keeping it.

9. Audits

qaitai will make available information reasonably needed to show compliance with this DPA, including completed security questionnaires and, once available, third-party audit reports. If that is not enough, Customer may conduct an audit once a year on 30 days' notice, during business hours, at its own cost, under confidentiality terms.

10. International transfers

Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), incorporated by reference, with:

  • Clause 7 (docking clause): applies.
  • Clause 9: option 2 (general authorization), with the notice period in section 5 above.
  • Clause 11: the optional redress language does not apply.
  • Clause 13: [[SCC_SUPERVISORY_AUTHORITY]].
  • Clauses 17 and 18: the law and courts of [[SCC_MEMBER_STATE]].
  • Annexes I–III: as set out below.

For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies, with Table 1–3 information taken from this DPA and either party may end it as allowed by Section 19. For Swiss transfers, the SCCs apply with references to the GDPR read as the Swiss FADP and the competent authority being the FDPIC.

11. Order of precedence

If this DPA conflicts with the Terms, this DPA wins. If it conflicts with the SCCs, the SCCs win.

Annex I: Description of processing

Parties. Data exporter: Customer (controller), contact as in its account. Data importer: [[LEGAL_ENTITY]], [[REGISTERED_ADDRESS]] (processor), privacy@tryqaitai.com.

Data subjects. Customer's users of qaitai; people whose data appears in the applications Customer tests (typically Customer's test users, and Customer's end users if Customer tests with real data).

Categories of data.

  • Account data of Customer's users: name, email, GitHub or Google identity, IP address.
  • Content of tested applications: page URLs, accessibility snapshots, screenshots, replays, and findings, which contain whatever the pages show.
  • Test credentials (secrets) that Customer provides, stored encrypted.
  • Repository metadata and pull request data from GitHub repositories Customer connects.

Special categories. None intended. Customer should not test with special-category data unless agreed in writing.

Frequency. Continuous, while Customer uses the service.

Nature and purpose. Running AI-driven browser tests of Customer's applications, showing results, posting results to GitHub, and billing and support. As part of this, page content and screenshots are sent to the AI model provider; secret values are not.

Retention. As described in the Privacy Policy (screenshots and replays: Free 7 days, Pro 30, Team 90, Enterprise per contract), and section 8 above.

Subprocessor transfers. As listed in Annex III, for the purposes stated there.

Annex II: Technical and organizational measures

  • Tenant isolation. Every tenant table enforces Postgres row-level security (FORCE ROW LEVEL SECURITY) keyed on the workspace ID. The application connects as a restricted role with no superuser or RLS bypass. CI checks every tenant table is covered.
  • Encryption. TLS for all traffic. Test secrets, BYOK keys and GitHub App credentials are encrypted with AES-256-GCM using a fresh data key per value, wrapped by a master key (moving to a managed KMS); ciphertexts are bound to their workspace so they cannot be moved between workspaces. [[CONFIRM_ENCRYPTION_AT_REST]] for database and object storage volumes.
  • Secrets kept from the model. The AI model sees secret names only; a tool types the value into the page. Values are redacted from snapshots, recorded reasoning and logs.
  • Egress control. Cloud runs may only navigate to domains the workspace has verified (re-checked daily); requests to private networks and cloud metadata addresses are blocked; server-side fetches are protected against SSRF.
  • Runner isolation. Runners connect outbound only. Customer-hosted runners get no database or master-key access and use short-lived, per-job tokens. Tokens are stored as SHA-256 hashes and compared in constant time.
  • Access control. Least-privilege GitHub App (write access to checks only). Staff production access limited and logged. [[CONFIRM_MFA_AND_ACCESS_REVIEW]]
  • Input validation and limits. Every API input is schema-validated and size-capped; endpoints are rate-limited; runs have hard step and time budgets.
  • Auditing. Security-relevant actions (runs, runner tokens, domain verification, GitHub setup) are written to an audit log.
  • Resilience. [[CONFIRM_BACKUPS_AND_RECOVERY]]
  • Vulnerability management. Dependency updates, code scanning and a public disclosure policy (SECURITY.md).

Annex III: Subprocessors

See subprocessors.md, which is incorporated into this DPA.