DPA — Data Processing Agreement
Ten dokument nie jest jeszcze dostępny w Twoim języku: czytasz wersję angielską. ClearCloud jest francuską spółką, a niniejsze warunki podlegają prawu francuskiemu: w razie rozbieżności rozstrzyga wersja francuska.
1. Parties and roles
- Controller: the Customer (the organisation using OKStatus).
- Processor: ClearCloud (SIRET 53993273100034, Dijon, France), operator of OKStatus.
The description of the processing is set out in Annex I.
2. Processor obligations (GDPR art. 28.3)
- Instructions. ClearCloud processes the data only on documented instructions from the Customer — use of the service and its configuration by the Customer constitute those instructions — and informs the Customer if an instruction appears to infringe the GDPR.
- Confidentiality of personnel. Persons authorised to process the data are bound by a contractual duty of confidentiality and access the data only where operationally necessary (support, incident), in a traceable way.
- Security. ClearCloud implements the technical and organisational measures set out in Annex II.
- Sub-processors. The Customer authorises the sub-processors listed in Annex III. Any addition or replacement is notified in writing (email to the organisation owner) with 30 days' notice; the Customer may object on legitimate grounds within that period. Failing a solution, the Customer may terminate the subscription without penalty, with amounts already paid for the unused period refunded pro rata. ClearCloud contractually imposes on every sub-processor obligations equivalent to this agreement and remains fully liable to the Customer for their performance.
- Assistance — data subject rights. ClearCloud helps the Customer respond to requests to exercise rights (access, rectification, erasure, portability, objection, restriction): export and deletion are available self-service; any other request is handled within 10 working days at contact@clearcloud.fr.
- Assistance — articles 32 to 36. ClearCloud assists the Customer, taking into account the nature of the processing and the information available to it, with the security of processing, notification of breaches to the supervisory authority and to data subjects, data protection impact assessments (DPIA) and prior consultation.
- Personal data breach. ClearCloud notifies the Customer without undue delay and at the latest 48 hours after becoming aware of it, at the organisation owner's address, stating: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information not yet available is provided in phases.
- End of processing. At the Customer's choice, ClearCloud deletes or returns (JSON/CSV export) all personal data within 30 days of the end of the subscription, and confirms the deletion in writing on request; backups containing the data expire at the latest 30 days afterwards. Data whose retention is required by law (billing, 10 years) is excepted.
- Demonstrating compliance and audits. ClearCloud makes available the information needed to demonstrate compliance with article 28: this agreement and its annexes, the security policy, answers to standard questionnaires (CAIQ Lite / SIG Lite), the executive summary of the latest external security audit when one exists and, where applicable, the certifications obtained. An on-site audit, or one by a mandated third party, is possible once per 12-month period (more often after a confirmed breach), with 30 days' written notice, during working hours, at the Customer's expense, subject to a confidentiality agreement and without access to other customers' data.
- Records. ClearCloud maintains the record of categories of processing activities carried out on behalf of its customers (art. 30.2) and makes it available to the supervisory authority and to the Customer on request.
3. Customer obligations
The Customer warrants that it has a legal basis for the data it entrusts to OKStatus (in particular the authentication credentials it enters, the email addresses of alert recipients and of subscribers to its status pages), informs the data subjects, and configures no monitor against systems it is not authorised to test.
4. Duration, governing law
This agreement applies for the whole duration of the subscription and until the data is effectively deleted. It is governed by French law and by Regulation (EU) 2016/679. In the event of a conflict with the terms of service, this agreement prevails as regards personal data.
Annex I — Description of the processing
| Subject matter | Availability and performance monitoring of services (HTTP, TCP, DNS, ping, gRPC, LLM APIs), alerting, incident communication, reporting. |
|---|---|
| Data subjects | Members of the Customer's organisation; alert recipients; subscribers to the Customer's status pages; visitors reporting a problem. |
| Categories of data | Identity and role of members (email, name); monitor configuration, including credentials or authentication headers supplied by the Customer; check results (status, latency, code, timestamp, region); incidents and maintenance; alert channel configurations (emails, webhooks, tokens, mobile numbers of SMS channels); subscriber email addresses; optional email, message and IP of reports; audit log (action, IP). |
| Special categories | None are expected. The Customer refrains from transmitting any. |
| Nature of the processing | Collection, storage, execution of checks, sending notifications, publication on the Customer's status pages, report generation, deletion. |
| Duration | Duration of the subscription, then deletion within 30 days; retention of results according to the plan (90 / 180 / 365 / 730 days) or less on the Customer's instructions. |
| Retention by category | Check results and alert history: according to the plan (90 / 180 / 365 / 730 days). Audit log: the plan's duration, and at least 12 months. Status page subscribers: until they unsubscribe or the page is deleted; a subscription never confirmed is deleted after 7 days. Visitor issue reports (optional email, message, IP): until the Customer archives them, then deleted 12 months after receipt. Backups: rolling 30 days. All of this data is deleted with the organisation. |
Annex II — Technical and organisational measures
| Area | Measure |
|---|---|
| Access control | Centralised authentication; owner / admin / member / read-only roles enforced server-side on every request; SSO (SAML / OIDC) and two-factor authentication enforceable per organisation; scoped API keys with expiry; immediate revocation of access when a staff member leaves. |
| Encryption in transit | TLS on all public interfaces and between the probes and the platform; probes open outbound connections only. |
| Encryption of secrets | Monitoring credentials, authentication headers, API keys and alert channel configurations encrypted at application level (AES-256-GCM), with the key held in a vault separate from the database and rotatable; never returned in clear text, never logged, excluded from exports and decrypted only at execution time. |
| Segregation | Logical isolation per organisation (organisation identifier taken from the database, never from the client) verified by automated tests; private probes restricted to their own organisation's checks. |
| Logging | Application audit log (creation, modification, deletion, sensitive access, exports, sign-ins) with IP, exportable, kept for at least 12 months; technical logs kept for 30 days. |
| Backups and continuity | Daily backup and continuous archiving of the transaction log to object storage in France, kept for 30 days; recovery point objective (RPO) under 15 minutes; documented restore test at least once a quarter. |
| Secure development | Blocking automated tests before any deployment, dependencies kept up to date and scanned, container images scanned, secrets never in the code. |
| Vulnerability management | Remediation within 7 days for a critical vulnerability, 30 days for a high one, 90 days for the others; responsible disclosure policy (security.txt, contact@clearcloud.fr). |
| Incident management | Written procedure for detection, qualification, communication (status page, email) and post-mortem; breach notification in accordance with article 2.7. |
| Organisation | Designated security officer (contact@clearcloud.fr); written security policies, reviewed annually; external security audit planned before selling to large accounts. |
Annex III — Authorised sub-processors
Reference list, dated, with change history and RSS feed: okstatus.eu/legal/sous-traitants (last updated: 2026-10-14). Reproduced below as at that date.
| Sub-processor | Purpose | Location |
|---|---|---|
| OVHcloud OVH SAS — 2 rue Kellermann, 59100 Roubaix, France | Object storage (database backups, PDF reports, logos), hosting of the monitoring probes, and hosting of OKStatus's own status page (status.okstatus.eu) and its probes, outside the monitored platform | France — object storage and OKStatus's status page in Gravelines (GRA). United Kingdom — public probes, OVHcloud site in London (Erith): the London region, plus the regions that do not yet have a probe on site (all except Paris, Frankfurt, Madrid, Amsterdam and Warsaw), which run from this same site until they are deployed United Kingdom: European Commission adequacy decision |
| Scaleway Scaleway SAS — 8 rue de la Ville l'Évêque, 75008 Paris, France | Hosting of the platform (applications, database, identities) since 26 September 2026, and of the Paris region probe since 10 October 2026; transactional email delivery (alerts, notifications, reports, address verification) and the associated message queue | France (Paris, PAR2 datacentre) |
| Stripe Stripe Payments Europe Ltd — 1 Grand Canal Street Lower, Dublin 2, Irlande | Subscription payment and invoicing | Ireland (EU); Stripe, Inc. group (United States) for payment processing Standard contractual clauses (module 2) and Stripe's DPA |
| Google · GitHub · GitLab Google LLC · GitHub, Inc. · GitLab, Inc. | Social sign-in (OAuth), only when you choose that sign-in method | United States Each provider's own transfer framework (EU-US Data Privacy Framework / standard contractual clauses) |
| Cloudflare Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, États-Unis | DNS and proxy for OKStatus's own status page (status.okstatus.eu) only; the rest of the service does not go through it | Global network, point of presence closest to the visitor EU-US Data Privacy Framework and standard contractual clauses (Cloudflare's DPA) |
| Browser push services Google LLC (Chrome, Android) · Mozilla Corporation (Firefox) · Apple Inc. (Safari) | Delivering push notifications to the device, only if you enable the push channel; the service used depends on your browser or the app | United States Each provider's own transfer framework (EU-US Data Privacy Framework / standard contractual clauses); content end-to-end encrypted (Web Push, RFC 8291) |
| UpCloud UpCloud Oy — Aleksanterinkatu 15 B, 00100 Helsinki, Finlande | Hosting of the monitoring probes for the Frankfurt, Madrid, Amsterdam and Warsaw regions (one machine per region, on site) | European Union — Germany (Frankfurt), Spain (Madrid), Netherlands (Amsterdam), Poland (Warsaw) |
| OVHcloud SMS OVH SAS — 2 rue Kellermann, 59100 Roubaix, France | Sending SMS alerts and number verification codes, only if you create an SMS channel | France; the SMS is then delivered by the recipient's mobile operator (European Union, European Economic Area, United Kingdom or Switzerland) United Kingdom and Switzerland: European Commission adequacy decisions |
Keycloak, Matomo (self-hosted), monitoring and the secrets vault are operated by ClearCloud and are not sub-processors.
Annex IV — Transfers outside the European Union
Account data, configuration, results and incidents stay in the European Union (hosting by Scaleway in Paris, backups by OVHcloud in Gravelines). Exceptions: (1) check probes: the probe receives the target's address and, if the monitor uses them, its credentials (basic auth, token, headers); the probes of the Paris (Scaleway), Frankfurt, Madrid, Amsterdam and Warsaw (UpCloud) regions are located in the city of their region, in the European Union; the London region probe, and the regions that do not yet have a probe on site, run from an OVHcloud site in London (United Kingdom, adequacy decision); any probe deployed in a country without an adequacy decision will be subject to the 30-day notice and standard contractual clauses (module 3); (2) billing: Stripe Payments Europe Ltd (Ireland), subject to Stripe's transfer safeguards; (3) social sign-in (Google, GitHub, GitLab) and push notifications (browser push services): only at the user's initiative, under each provider's transfer framework; (4) OKStatus's own status page: hosted by OVHcloud in Gravelines (France) and served by Cloudflare (EU-US Data Privacy Framework), which only receives technical data about its visitors; (5) SMS alerts: OVHcloud (France) hands the SMS to the recipient's mobile operator, in the European Union, the European Economic Area, the United Kingdom or Switzerland (adequacy decisions), only if the Customer creates an SMS channel.
History
- 14 October 2026 — v2.4: OVHcloud SMS added to Annex III (optional, SMS alerts) and mobile numbers of SMS channels to the data categories; Infomaniak removed from Annex III, OKStatus's status page being hosted by OVHcloud in Gravelines since 29 September 2026; Annex IV updated.
- 10 October 2026 — v2.3: UpCloud Oy (Finland) added to Annex III as host of the Frankfurt, Madrid, Amsterdam and Warsaw probes; Paris probe at Scaleway; Annex IV: these five regions are checked from within the European Union.
- 28 September 2026 — v2.2: platform hosted by Scaleway (Paris); Annex IV rewritten: probe location and monitor credentials, push services, OKStatus's own status page (Infomaniak, Cloudflare); agreement applies to every plan; breach notification within 48 h (instead of 72 h); retention periods by category (Annex I).
- 6 September 2026 — v2.1: annex III fed from the reference list (/legal/sous-traitants); Plausible removed from the list (never put in service, audience measurement by self-hosted Matomo).
- 2 September 2026 — v2.0: restructured into annexes, sub-processor notice and objection, audit terms, detailed 72-hour notification, assistance under art. 32–36, deletion deadline, confidentiality of personnel, art. 30 records; sub-processor list moved to a dedicated page with history and RSS feed.
- 1 April 2026 — v1.0.
Contact
Signed DPA, security questionnaire, audit: contact@clearcloud.fr · GDPR: contact@clearcloud.fr