Data Processing Addendum

Scope

This Data Processing Addendum ("DPA") is part of the Terms of Service between Steycode ("we") and the customer that uses PeekInside Cloud ("you"). It applies when the data your apps send to PeekInside Cloud ("Customer Data") contains personal data and the processing is subject to data protection law, including the EU and UK General Data Protection Regulation ("GDPR"), India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and similar laws (together, "Data Protection Law").

It doesn't cover the local dashboard, which runs on your computer and sends us nothing, or the account details we hold about you and your team, which our Privacy Policy covers.

Roles

For personal data in Customer Data, you are the controller (the data fiduciary under the DPDP Act), or a processor acting for your own customer, and we are your processor (sub-processor). You're responsible for having a lawful basis for sending it, for the notices and consents the law requires, and for its accuracy.

Your instructions

We process Customer Data only on your documented instructions, which are: the Terms of Service, this DPA, and how you configure and use PeekInside (which projects send data, what the SDK records and masks, and what you delete). We process it for no other purpose, unless the law requires us to, in which case we'll tell you first unless the law forbids it. If we believe an instruction breaks Data Protection Law, we'll tell you.

What we process

Encryption, and what we can access

The SDK encrypts Customer Data on your servers with your project's public key before sending it. We receive and store it encrypted, apart from the details listed in the Privacy Policy (times, method, status, duration, sizes, environment and counters), which contain no content of requests.

• Under advanced protection, only your organization's devices, passkeys and recovery keys can decrypt Customer Data, and we can't.
• Under standard protection (the default), our servers hold a key that can open a member's account key, so that signing in can unlock a new browser. We use it only for that, and we restrict and log access to it. If you need assurance that we can't decrypt Customer Data, have your members turn on advanced protection.

Our commitments

• Confidentiality. Everyone we authorize to process Customer Data is bound by confidentiality.
• Security. We keep the technical and organizational measures described below, appropriate to the risk, and review them as the service changes.
• Subprocessors. We use the subprocessors listed below. We'll update this page at least 30 days before adding or replacing one; if you object on reasonable data protection grounds and we can't resolve it, you may cancel and we'll refund any prepaid, unused period. We impose the same data protection obligations on them as this DPA imposes on us, and remain responsible for them.
• Requests from individuals. If someone asks us to exercise their rights over Customer Data, we'll pass the request to you and not answer it ourselves. Since Customer Data is encrypted, you can find and delete it from the dashboard: clearing a project's requests or exceptions, or deleting the project, deletes it at once. We'll help with anything else that's reasonably within our reach.
• Assistance. We'll give you the information you reasonably need for data protection impact assessments, consultations with authorities, and records of processing.
• Breaches. We'll notify you without undue delay, and within 48 hours, after becoming aware of a breach affecting Customer Data, with what we know about it and what we're doing, and keep you informed as we learn more.
• Deletion. Customer Data is deleted automatically 14 days after it's recorded. When your use of PeekInside Cloud ends, any that remains is deleted within 30 days, unless the law requires us to keep it.
• Audits. We'll make available the information needed to show we meet this DPA. Once a year, on 30 days' written notice and at your cost, you or an independent auditor bound by confidentiality may audit our compliance, in a way that doesn't disrupt the service or expose other customers' data.

International transfers

We're in India, and our subprocessors process data in India, the United States and other countries. Where Customer Data subject to the GDPR is transferred to a country without an adequacy decision, the European Commission's standard contractual clauses (Decision 2021/914, module two or three as applicable) apply between you and us, with the UK's International Data Transfer Addendum for UK data. The clauses' options are: the optional docking clause applies; general written authorization for subprocessors, with the notice period in this DPA; the governing law and courts are those of Ireland. If the clauses conflict with this DPA, the clauses prevail.

Security measures

• Customer Data is encrypted by the SDK on your servers: a fresh ECDH P-256 key pair for each batch, keys derived with HKDF-SHA-256, and AES-256-GCM, each record bound to its identifier.
• Decryption happens in your members' browsers. Browsers' private keys can't be exported from them.
• Everything travels over HTTPS.
• Organization and project keys are stored only in encrypted forms. The key that opens escrowed account keys is kept apart from the database.
• API keys, sign-in codes and recovery checks are stored as hashes.
• Access within an organization follows roles (owner, admin, developer, viewer), and new members can't read anything until an admin confirms them.
• Pages are served with a strict, nonce-based Content Security Policy; sessions use secure, HTTP-only cookies.
• Access to production systems is limited to the people who run them, and protected with strong authentication.
• Customer Data is deleted automatically after 14 days.

Subprocessors

Amazon Web Services sends our emails, which contain no Customer Data, so it isn't a subprocessor for it.

Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, as far as Data Protection Law allows. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data.

Contact

Data protection questions, and notices under this DPA, go to support@peekinside.dev.