Legal
Data processing agreement
When your agents process personal data inside TaskCloud VMs, we act as your processor. Here is a summary of what our DPA covers and how to get a signed copy.
Draft — pending legal review. This text has not yet been reviewed by a lawyer and is not final. Fields in [square brackets] are placeholders. Questions: legal@task.cloud.
Summary
| Roles | You are the controller (or a processor for your own customers); TaskCloud is your processor (or sub-processor) for Customer Content: files, disks, memory snapshots, logs and network traffic of your VMs. |
|---|---|
| Legal basis | Art. 28 GDPR. The DPA forms part of the terms of service or your enterprise agreement. |
| Instructions | We process Customer Content only to provide the Service as configured through the API and dashboard, and as required by law. |
| Location | Processing and storage in the EU, on servers we operate ourselves and on servers rented from the infrastructure sub-processor below. No transfers of Customer Content outside the EU/EEA without your prior written consent. [Confirm.] |
| Confidentiality | Access limited to staff who need it to operate the Service, bound by confidentiality obligations. We do not inspect VM contents routinely. |
| Security measures | Firecracker microVM per sandbox with jailer, seccomp, cgroups and a network namespace per VM; encryption in transit; access controls and logging. Details on the security page; full technical and organisational measures in Annex II of the DPA. No SOC 2 report yet (planned). |
| Sub-processors | Infrastructure (control plane, object storage for snapshots, rented servers): [Hetzner Online GmbH — to be confirmed]. [Add the operator and location of our own server room once confirmed.] Payment and email providers do not receive Customer Content. We notify you [30] days before adding or replacing a sub-processor, and you may object. |
| Breach notification | Without undue delay and at the latest within [48] hours after becoming aware of a personal data breach affecting Customer Content. |
| Assistance | We help you answer data subject requests and with data protection impact assessments, to the extent the information is available to us. |
| Deletion | Customer Content is deleted when you delete the VM, snapshot or template, and in any case within [30] days after the end of the contract (backups within their rotation cycle). |
| Audits | We provide information needed to demonstrate compliance and allow audits on reasonable notice, at most once a year unless a breach or regulator requires it. |
Request a DPA
Email legal@task.cloud with your company's legal name, address, the name and email of the signatory, and whether you need the EU Standard Contractual Clauses. We will send the DPA for electronic signature. If you need to review it on your own paper, send it to the same address.
The pre-signed DPA PDF is being prepared together with legal review. [Link to PDF once available.]