Data Processing Agreement
Last updated: 2026-07-26
This Data Processing Agreement ("DPA") supplements our Terms of Use and applies whenever SieveGuard ("SieveGuard", "Processor") processes personal data on behalf of you ("Customer", "Controller") under the EU GDPR or UK GDPR.
1. Definitions
Terms not defined here have the meanings given in the GDPR. "Personal Data", "Processing", "Data Subject", "Supervisory Authority", "Personal Data Breach" bear their GDPR meanings.
2. Scope and roles
You are the Controller of Personal Data you submit to the Service. SieveGuard is the Processor. This DPA applies to all Processing carried out under your Terms of Use.
3. Processing only on documented instructions
SieveGuard processes Personal Data only on your documented instructions, including any configuration you make in the SieveGuard console and any API requests you submit. We will not process Personal Data for any other purpose without your prior written consent.
4. Confidentiality of personnel
All personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
5. Data subject rights assistance
Taking into account the nature of the Processing, we assist you by appropriate technical and organisational measures, insofar as possible, for the fulfilment of your obligation to respond to requests from data subjects (access, rectification, erasure, restriction, portability, objection).
6. Security
SieveGuard implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk — see Annex II.
7. Personal data breach
SieveGuard notifies you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting your data. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed.
8. Data protection impact assessments
On request and at reasonable cost, we assist you with data protection impact assessments and prior consultations with Supervisory Authorities.
9. Return or deletion at end of services
At the end of your Subscription, we delete all Personal Data within 30 days, unless EU or member-state law requires retention. You may request immediate purge at any time from the portal or by email to [email protected].
10. Audits
We make available to you all information necessary to demonstrate compliance with this DPA. Once per year, on 30 days' written notice, you may request a remote audit conducted at your reasonable expense, subject to confidentiality undertakings. Where available, we may satisfy this obligation by providing a current SOC 2 or ISO 27001 report.
11. International transfers
Where personal data is transferred outside the EEA / UK, the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) are incorporated by reference and apply between the parties.
12. Liability
Each party's liability under this DPA is subject to the limitations set out in the Terms of Use.
13. Governing law
This DPA is governed by the laws of the Republic of Malta.
Annex I — Details of processing
| Controller | Customer |
| Processor | SieveGuard |
| Data subjects | Customer's end users, contacts, prospects whose email addresses are submitted |
| Categories of personal data | Email addresses (raw + canonical); optionally domain / local-part metadata |
| Special categories | None — email addresses do not fall within GDPR Art. 9 |
| Nature of processing | Canonicalisation, near-duplicate clustering, risk scoring, deliverability verification |
| Purpose | Fraud, bot-enumeration, and multi-accounting detection on Customer's signup flows |
| Duration | Lifetime of the Subscription + 30 days deletion window |
Annex II — Technical & organisational measures (TOMs)
- Encryption: TLS 1.3 in transit; AES-256 at rest (managed by AWS RDS).
- Tenant isolation: PostgreSQL Row-Level Security policies on every tenant-scoped table; per-request GUC + AsyncLocalStorage context; cross-tenant isolation e2e test gate in CI.
- Access controls: role-based access (super_admin / tenant_owner / tenant_member); password hashing with Argon2; per-API-key rate limiting; JWT access tokens with short TTL + refresh-token rotation.
- Network security: VPC isolation; security groups limiting DB access to application instances only; Cloudflare WAF + DDoS protection.
- Logging & monitoring: API request logs (90 days); audit logs for all sensitive actions; CloudWatch metrics + alerts.
- Business continuity: RDS automated backups with point-in-time recovery (7-day retention); disaster recovery procedure documented.
- Vulnerability management: dependency scanning, regular patching, security-review skill applied on every release.
- Personnel: confidentiality agreements with all personnel having production access; least-privilege principle.
- Incident response: 72-hour breach notification SLA; documented response playbook.