# Calcutab: Data Processing Agreement

*Version 1.1 · 1 November 2026*

## 1. Roles

The customer is the **controller** of its users' personal data. The operator is the
**processor**, acting only on the customer's documented instructions, which are to
provide the Calcutab service as described in the Terms.

## 2. What is processed

| Category | Data | Source |
| --- | --- | --- |
| Identity | name, email address, profile picture URL | the user's Google or Atlassian sign-in; for a person without a login, the name only, typed by a manager |
| Working time | days, hours and minutes logged, per calendar day, per product, marked as new development or maintenance and by lifecycle phase | entered by the user, or by a manager on their behalf |
| Organisation | job role, skill band, team, department, day rates attached to those | entered by the customer's managers |
| Jira activity | issue keys and summaries the user touched, and the day; **never comment bodies** | pulled from the customer's Jira when the customer connects it |
| Slack | the user's Slack user id, looked up by email once | when the customer connects Slack |
| Audit | who changed what and when | generated by the service |

Data subjects are the customer's employees and contractors whom the customer
records in Calcutab: those given a seat, who sign in, and those a manager records
by name without a login, who never sign in and hold no seat. For a person without
a login we hold their name, the time logged for them, the organisation details
above and the audit trail; never an email address, a photo, Jira activity or a
Slack id.

## 3. Duration

For the term of the agreement, then deletion as set out in the retention statement.

## 4. Processor obligations (Art. 28(3))

- **Instructions.** We process only as instructed; we will tell you if an instruction
  appears to infringe data protection law.
- **Confidentiality.** Everyone with access to the data is bound by confidentiality.
- **Security (Art. 32).** Set out in section 6.
- **Sub-processors.** Only those in section 7; we will give 30 days' notice of any
  change, and you may object.
- **Data subject rights.** We will help you respond: a user's data can be exported and
  deleted on your instruction.
- **People without a login.** They cannot sign in, so they cannot download or
  erase their own data. A request from one reaches you; a manager exports or
  erases their data from their profile, and we will help as for any data subject.
- **Breach notification.** We will notify you **without undue delay** after becoming
  aware of a personal data breach, with what we know at the time and updates as we
  learn more. Our internal procedure is written down and rehearsed
  (`docs/incident-response.md`). *Your* 72-hour clock to the supervisory authority
  runs from when we tell you, and we know that.
- **Deletion and return.** On termination, you export; we delete per the retention
  statement, and confirm in writing on request.
- **Audit.** We will make available the information needed to demonstrate compliance
  and allow audits by you or an auditor you mandate, on reasonable notice.

## 5. Where data is

The EU. The application runs on Google Cloud Run in `europe-west1` (Belgium) and the
database on Neon in AWS `eu-central-1` (Frankfurt). Backups stay in the EU. No transfer
outside the EU/EEA is made by the service itself; see the sub-processor list for what
each sub-processor commits to.

For a customer in Canada this is a transfer out of Canada. PIPEDA permits a transfer
for processing where the customer remains accountable for the data and secures
comparable protection by contractual means; this agreement is that means. Quebec's
Law 25 additionally requires the customer to carry out a privacy impact assessment
before communicating personal information outside Quebec, and to have a written
agreement in place; this agreement, with sections 6 and 7, is written so that the
assessment can be completed from the document.

## 6. Security measures (Art. 32)

- Every customer's data is isolated by tenant identifier on every query, and the
  database itself enforces it: cross-tenant references are rejected by composite
  foreign keys.
- Credentials the customer entrusts to us (Jira API tokens, Slack tokens) are encrypted
  at rest with AES-256-GCM; the key is held outside the database, in Google Secret
  Manager, and never in the repository.
- All traffic is TLS. Session cookies are Secure, HttpOnly, SameSite. A per-request
  Content-Security-Policy is sent on every page.
- Access levels are enforced server-side; money figures are never sent to a browser
  whose user may not see them.
- An append-only audit trail records rate, membership, settings and on-behalf changes.
- Backups are taken with the restore procedure rehearsed, not assumed.
- Alerting notifies the operator if the service or its database becomes unreachable.

- Passwords, where a workspace uses them rather than Google or Atlassian, are stored
  as salted scrypt hashes and never in a readable form. Invitation and password-reset
  tokens are stored only as their SHA-256, so a leaked database completes neither.
- Fifteen automated checks run against a deployment before release, covering tenant
  isolation, access levels, session forgery and information disclosure.

What is **not** in place, stated so it is not discovered: no independent penetration
test, no on-call rota, no SOC 2 or ISO 27001 certification. See `/security` for the
same list in full.

## 7. Sub-processors

| Sub-processor | Purpose | Location |
| --- | --- | --- |
| Google Cloud (Cloud Run, Secret Manager, Cloud Monitoring, Cloud Scheduler) | running the application, holding secrets, alerting, the two scheduled jobs | `europe-west1` (Belgium); Google's own DPA applies |
| Neon | the PostgreSQL database | AWS `eu-central-1` (Frankfurt) |
| Resend | invitations, password resets, reminders and the weekly digest | EU region; their DPA applies |
| Google (sign-in) | authentication only; we receive name, email address and picture | per their terms |
| Atlassian (sign-in) | authentication only, **if used**: name, email address and account id | per their terms |
| Atlassian Jira | **only if you connect it**, and only reading what section 2 lists | your own instance |
| Slack | **only if you connect it**, to deliver reminders | your own workspace |

No other sub-processor is used. This list is the complete one; a change to it is a
change to this document, and section 4 says how you are told.

## 8. Law

This agreement is governed by the law of the Federal Republic of Germany and forms part
of the Terms of Service. Where the GDPR and that law differ, the GDPR prevails.

This agreement is intended to satisfy, and not to limit, the rights a data subject
holds under Canada's PIPEDA or Quebec's Act respecting the protection of personal
information in the private sector as amended by Law 25.

## 9. Contact

Data protection enquiries, data subject requests and breach notifications:
**support@calcutab.com**.

We acknowledge a data subject request within 72 hours and answer it within the
month the GDPR allows. A personal data breach affecting your data is notified to
you without undue delay and in any event within 72 hours of us becoming aware of
it.