Legal
Data Processing Agreement, version 2026-12
Version 2026-12
Status: published, takes effect on 1 December 2026.
Current version: 2026-08, in effect since 31 August 2026.
This text will not change. bytesafe.dev/legal/dpa always shows the version in effect.
This Data Processing Agreement (the "DPA") sets out the terms on which Bitfront AB, reg. no. 559155-7912 ("Bitfront"), processes personal data on behalf of its customer ("Customer"), as required by Article 28 of Regulation (EU) 2016/679 (the "GDPR").
Relationship to the Agreement. This DPA forms part of the agreement under which Bitfront provides the Products to Customer (the "Agreement"): the Bytesafe Terms of Service, or a Master Software and Services Agreement signed by Customer and Bitfront.
1. Definitions
"Products" means the Bytesafe products and services Bitfront provides to Customer under the Agreement, and "Permitted Users" means the people Customer permits to use them.
"Customer Data" means data submitted to or generated by the Products in connection with Customer's use.
"Order Form" means an order form signed by Customer and Bitfront under a Master Software and Services Agreement. A Customer that uses the Products under the Bytesafe Terms of Service has no Order Form, so the references to one in this DPA do not apply to it.
"Customer Personal Data" means personal data contained in Customer Data that Bitfront processes on Customer's behalf under the Agreement.
"Data Protection Law" means the GDPR, the UK GDPR and the Data Protection Act 2018 where applicable, and any national law implementing or supplementing them.
"Sub-processor" means any processor engaged by Bitfront to process Customer Personal Data.
"Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR.
2. Roles and scope
2.1 Customer is the Controller and Bitfront is the Processor in respect of Customer Personal Data.
2.2 The Products are not designed to process personal data beyond that necessary to administer Permitted User accounts and to record Product usage. Customer shall not submit special category data under Article 9 GDPR, criminal conviction data under Article 10 GDPR, or personal data of children to the Products.
2.3 Appendix 1 records the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of Data Subjects, as required by Article 28(3) GDPR.
3. Bitfront's obligations
Bitfront shall:
3.1 Documented instructions. Process Customer Personal Data only on Customer's documented instructions, including as to international transfers, unless required to do otherwise by Union or Member State law. Where such a requirement applies, Bitfront shall inform Customer before processing unless that law prohibits it. The Agreement, this DPA and Customer's configuration and use of the Products constitute Customer's documented instructions.
3.2 Unlawful instructions. Inform Customer without undue delay if, in Bitfront's opinion, an instruction infringes Data Protection Law. Bitfront may suspend performance of the instruction until it is confirmed, withdrawn or amended.
3.3 Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by an obligation of confidentiality, whether contractual or statutory.
3.4 Security. Implement and maintain the technical and organisational measures in Appendix 2 (the "Security Measures"), as Article 32 GDPR requires. Bitfront may update the Security Measures only as Section 9.6 allows.
3.5 Assistance with Data Subject rights. Taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests to exercise rights under Chapter III GDPR. Where Bitfront receives such a request directly, it shall promptly forward it to Customer and shall not respond except on Customer's documented instructions or where required by law.
3.6 Assistance with compliance. Taking into account the nature of processing and the information available to it, assist Customer in complying with Articles 32 to 36 GDPR. Bitfront provides the assistance under 3.5 and this Section mainly through the Products' self-service functions, their documentation and the information under Section 6.1. Where Customer asks for substantial further assistance, Bitfront may charge its reasonable costs, agreed in advance, unless the need arises from Bitfront's breach of this DPA.
3.7 Information and audit. Make available to Customer the information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits and inspections as set out in Section 6.
4. Personal Data Breach
4.1 Bitfront shall notify Customer without undue delay, and in any event no later than seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, as required by Article 33(2) GDPR. Seventy-two (72) hours is the latest permitted time, not the expected one.
4.2 The notification shall describe, to the extent then known: the nature of the breach including where possible the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a point of contact. Where the information is not all available at once, Bitfront may provide it in phases without undue further delay.
4.3 Bitfront shall take reasonable steps to contain and remedy the breach, and co-operate reasonably with Customer in its own response to it.
4.4 Notification under this Section is not an admission of fault or liability.
5. Sub-processors
5.1 Customer gives Bitfront general written authorisation to engage Sub-processors, subject to this Section.
5.2 Bitfront's current Sub-processors are listed at bytesafe.dev/legal/subprocessors.
5.3 Bitfront shall give Customer at least thirty (30) days' notice, by email as in Section 9.6, before adding or replacing a Sub-processor that processes Customer Personal Data. Customer may object within that period on reasonable grounds relating to data protection, by written notice stating those grounds.
5.4 If the Parties cannot resolve Customer's objection before the change takes effect, Customer may terminate the affected subscription by written notice given before that date. Termination is Customer's sole remedy for an objection under this Section.
5.5 Bitfront engages each Sub-processor under a written agreement, which may be the Sub-processor's standard data processing terms, that requires it to protect Customer Personal Data as Article 28(4) GDPR requires. Bitfront remains liable to Customer for each Sub-processor's performance of those obligations.
6. Audit
6.1 On Customer's written request, no more than once in any twelve (12) month period, Bitfront shall provide the information reasonably necessary to demonstrate compliance with this DPA, including the Security Measures, its Sub-processor list, and responses to a reasonable written security questionnaire.
6.2 Where the information provided under 6.1 is not sufficient, Customer may conduct a remote audit, no more than once in any twelve (12) month period, on thirty (30) days' written notice, during business hours, subject to confidentiality obligations, and in a manner that does not disrupt Bitfront's operations or compromise the confidentiality of other customers' data. Customer bears its own costs and pays Bitfront's reasonable costs of supporting the audit, estimated in advance.
6.3 Audits shall not extend to source code, infrastructure account identifiers, cryptographic key material, IAM policy definitions, firewall rules, or any information relating to another customer. Audits may not be conducted by a competitor of Bitfront.
7. International transfers
7.1 Bitfront stores Customer Personal Data in the European Union, or in a hosting region outside it if Customer's Order Form states one. The hosting provider and region are those in the Sub-processor list, or in Customer's Order Form where it states them.
7.2 Where a Sub-processor established outside the EEA may access Customer Personal Data, Bitfront treats that access as a transfer and covers it by an adequacy decision under Article 45 GDPR or by appropriate safeguards under Article 46 GDPR. The Sub-processor list names each such Sub-processor and the mechanism relied on.
7.3 Standard Contractual Clauses. Where Customer is established outside the EEA and Data Protection Law requires it, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the "SCCs"), Module Four (processor to controller), apply between Bitfront and Customer and are incorporated by reference. Swedish law governs them, the courts of Sweden resolve disputes under them, and Appendix 1 serves as their Annex I.
8. Return and deletion
8.1 Export window. On expiry or termination of the Agreement or of Customer's subscription, Bitfront shall make Customer Personal Data available for export in a machine-readable format for thirty (30) days.
8.2 Deletion from production. Bitfront shall delete Customer Personal Data from its production systems within thirty (30) days after the end of the export window.
8.3 Backups. Customer Personal Data contained in routine encrypted backups is deleted on expiry of the applicable backup retention cycle, and in any event within ninety (90) days after the end of the export window. Until deletion, that data remains subject to this DPA and is not actively processed for any other purpose.
8.4 Legal retention. Bitfront may retain Customer Personal Data where required by Union or Member State law, for the period required and for that purpose only.
8.5 Customer is responsible for exporting the data it wishes to retain within the export window.
9. Liability, term and updates
9.1 Liability under this DPA is subject to the limitations of liability in the Agreement.
9.2 This DPA takes effect when the Agreement does and continues for as long as Bitfront processes Customer Personal Data, after which Sections 8 and 9 survive.
9.3 In the event of conflict between this DPA and the Agreement in respect of the processing of personal data, this DPA prevails, except where an Order Form expressly varies it. Nothing in this DPA is intended to conflict with Data Protection Law, and Data Protection Law prevails over any conflicting term.
9.4 Governing law and dispute resolution are those of the Agreement, except for the Standard Contractual Clauses under Section 7.3.
9.5 This version replaces earlier versions of this DPA, and any earlier data processing terms between Bitfront and Customer, in respect of processing under the Agreement.
9.6 Updates. Bitfront may update this DPA, including the Security Measures, only by publishing a new version at its own address and emailing Customer's account administrators, or the notices contact in Customer's Order Form, at least thirty (30) days before it takes effect. The notice says what has changed and links to the new version. An update may not materially reduce the protection of Customer Personal Data, unless Data Protection Law requires it. Customer may object on reasonable grounds within the notice period. If the Parties cannot resolve the objection, Customer may terminate the affected subscription before the update takes effect, and the previous version continues to apply until then.
Appendix 1: Description of the processing
For a Customer established outside the EEA, this Appendix also serves as Annex I of the SCCs under Section 7.3, with Bitfront as data exporter and Customer as data importer.
A. Parties
| Item | Details |
|---|---|
| Controller | Customer, as identified in the Agreement. Contact: the account administrator, or the notices contact in Customer's Order Form. Activities: use of the Products in its software development and security operations. |
| Processor | Bitfront AB, reg. no. 559155-7912, Mellanvägen 5, 136 70 Vendelsö, Sweden. Contact: privacy@bytesafe.dev. Activities: provision of the Products. |
B. Description of processing
| Item | Details |
|---|---|
| Subject matter | Provision of the Products under the Agreement |
| Duration | The term of the Agreement, plus the retention periods in Section 8 |
| Nature and purpose | Hosting, storage, access control, logging and support necessary to make the Products available, to authenticate Permitted Users, to record and audit Product usage, and to provide support |
| Categories of Data Subjects | Permitted Users, being the employees and individual contractors of Customer, and Customer's administrative and billing contacts |
| Types of personal data | Name; business email address; user identifier; authentication and session metadata; role and permission assignments; IP address; audit log records of actions taken in the Product, including package requests attributed to a user; support correspondence |
| Special category data | None (Section 2.2) |
| Frequency | Continuous for the term of the Agreement |
| Retention | As set out in Section 8 |
C. Sub-processors
The Sub-processors are those listed at bytesafe.dev/legal/subprocessors, as updated under Section 5.
D. Technical and organisational measures
Set out in Appendix 2.
Appendix 2: Security Measures
The technical and organisational measures referred to in Section 3.4. They apply to the Products Bitfront hosts and may be updated only as Section 9.6 allows.
1. Policies and responsibilities
1.1 Bitfront maintains written security policies, including for access management, data classification, incident response and the onboarding and offboarding of personnel, and reviews them as the business and the Products change.
1.2 Bitfront is responsible for the measures in this Appendix. Customer is responsible for the matters in Section 10 of this Appendix.
2. Hosting and infrastructure
2.1 The Products are hosted with the hosting provider and in the region set out in Section 7.1. The hosting provider is responsible for the physical and environmental security of its data centres.
2.2 Customer Data is logically separated from the data of other customers. A single-tenant deployment is available where agreed in an Order Form.
3. Encryption
3.1 Customer Data is encrypted in transit over public networks using current versions of TLS, and at rest, including in backups, using industry-standard algorithms.
3.2 Encryption keys are held in a managed key management service, with access restricted and logged. Credentials Customer supplies for upstream registries are additionally encrypted at application level.
4. Access control
4.1 Access to production systems and Customer Data follows the principles of least privilege and need to know, through unique personal accounts, with multi-factor authentication for administrative and production access.
4.2 Access rights are reviewed periodically, and revoked promptly when a person leaves Bitfront or no longer needs them.
5. Secure development
5.1 Bitfront follows a secure development lifecycle aligned with OWASP guidance. It includes code review, and automated security testing, dependency scanning and secrets scanning in continuous integration before a change is released.
5.2 Production environments are changed only through a controlled deployment process. Development and test environments are separate from production.
6. Vulnerability management and testing
6.1 Bitfront identifies vulnerabilities through automated scanning, vendor and upstream advisories, its own testing and external reports, which may be sent to security@bytesafe.dev, and remediates them according to severity and risk. Where Customer's agreement includes service levels, the remediation targets in them apply.
6.2 Bitfront keeps the software components it operates up to date. The hosting provider patches the platform services it operates.
6.3 Bitfront performs penetration testing of the Products periodically, and after material changes to them.
7. Logging and monitoring
7.1 Administrative and security-relevant events on production systems are logged.
7.2 Bitfront monitors the availability of the Products.
8. Personnel, devices and suppliers
8.1 Everyone at Bitfront with access to Customer Data is bound by confidentiality obligations and is instructed in Bitfront's security and data protection requirements before being given that access.
8.2 Company devices use full-disk encryption, automatic screen lock and malware protection.
8.3 Bitfront assesses each Sub-processor before engaging it, and again on material change, in proportion to the data it processes.
9. Incident response and continuity
9.1 Bitfront maintains an incident response process and playbooks for its principal failure scenarios. Incidents affecting availability are communicated on Bitfront's status page.
9.2 Notification. Where Bitfront confirms a security incident that affects the confidentiality, integrity or availability of Customer Data, Bitfront shall notify Customer's account administrators, or the named contacts in Customer's Order Form, without undue delay, and in any event no later than seventy-two (72) hours after confirmation. Seventy-two (72) hours is the latest permitted time, not the expected one. The notification, or a follow-up given without undue delay, states what is known of the cause, the data and systems affected, and the steps taken and planned, and Bitfront keeps Customer informed of material developments until the incident is closed. A Personal Data Breach is also notified under Section 4, on the same deadline.
9.3 Customer Data is backed up, and backups are encrypted and stored within the European Union, or in the country of the hosting region where Customer's Order Form states one outside it. Restore procedures are exercised in routine operations. Where Customer's agreement includes service levels, the recovery objectives in them apply.
10. Customer responsibilities
Customer is responsible for:
- the security of its accounts, tokens and credentials, and for revoking them when no longer required;
- its own configuration of the Products, including policies, rules and exceptions;
- the security of its own systems, networks and endpoints; and
- applying updates to any Bitfront client software it runs, within a reasonable period.