Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of, and is incorporated into, our Terms of Service or any agreement we sign with you for the Service. It applies where we process personal data on your behalf as part of providing the Service. Where it conflicts with those terms on a matter of data protection, this DPA prevails.
1. Roles
You are the controller of personal data contained in the files you submit and in the analysis of them, and of the account data of your users. You decide what to submit and why.
We are the processor of that data when we analyse your files and hold your workspace content. We act only on your instructions, which are: to provide the Service as described in the agreement; to apply the retention in section 9; and to do what we must to keep the Service secure and lawful.
We are the controller of the personal data described in our Privacy Notice — your account and billing relationship, service telemetry, security and abuse records — and of the public corpus. Processing we carry out as a controller is outside this DPA and is described in our Privacy Notice and removal policy.
Partners and their customers. Where a partner uses the Service to serve its own customers, each party is a controller of its own relationship and the partner is our counterparty under this DPA. We do not receive instructions from the partner's customers and will not act on them.
2. What we process
The subject matter, duration, nature and purpose of processing, and the categories of personal data and data subjects, are set out in Annex I. Anything outside Annex I is a new processing activity and we will not begin it without your written instruction.
3. Our obligations
- Instructions. We process your personal data only on your documented instructions, including for transfers outside Singapore or the EEA, unless the law requires otherwise. Where the law requires processing without your instruction, we will tell you before we do it unless prohibited.
- Confidentiality. Everyone we authorise to process your personal data is bound by confidentiality obligations.
- Security. We maintain the measures in Annex II. We may update them, but not so as to reduce protection.
- Assistance. We will help you respond to requests from data subjects, and with security, breach notification, and assessments such as a data protection impact assessment, taking account of the information we have and the nature of the processing.
- Breach notification. We will tell you without undue delay after we become aware of a personal data breach affecting your data, and in any event within 72 hours — matching the deadline the law gives you, so we are not the reason you miss it. Our notice will say what happened, the categories and approximate number affected, the likely consequences, the measures taken, and our contact point. We will keep you informed as the matter develops and will not withhold information we have.
- Deletion and return. On termination we delete your personal data as described in section 9, or return it to you if you ask for a copy instead, and we may confirm in writing when we have done so.
4. Your obligations
You confirm that you have a lawful basis for the personal data you submit to the Service and the instructions you give; that submitting it, and our processing it, does not breach any law or any third party's rights; and that you have given whatever notices and obtained whatever consents or permissions are needed. You must not submit special-category data, and you must not ask us to process data in a way that would break the law.
You acknowledge that analysis necessarily copies and transforms what you submit, that some analysis is produced by a third-party model provider named in Annex III, and that the Service is not designed to hold personal data as its purpose — we recommend you submit files that do not contain it where possible.
Disclosure is yours to control, and that includes share links. You decide what is private, what you publish, and who receives a share link. A share link is a disclosure by you to a person we cannot identify, and we cannot tell you afterwards who opened it or what they read. Where you disclose personal data that way, it is your disclosure to account for in your own notices, not ours.
5. Subprocessors
You give us a general authorisation to engage subprocessors to help provide the Service. Our subprocessors are listed in Annex III, with their role, the data they handle and their location.
We will tell you at least 30 days before adding or replacing a subprocessor, and you may subscribe to those notices. If you reasonably object to a change on data protection grounds, tell us within the notice period and we will work with you to resolve it. If we cannot, you may end the affected part of the Service and we will refund prepaid, unused fees.
We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain liable to you for our subprocessors' performance of those obligations. Our current subprocessors are set out in Annex III and on our website; the website list is the operative one for change notices.
Tell is not a subprocessor. Our product analytics, logs and metrics are collected by our own software on our own infrastructure. It is not a third-party service and no separate processor relationship exists for it.
6. International transfers
Production is in the European Union, in Germany.
Where personal data subject to the GDPR is transferred to us outside the EEA, or to a subprocessor outside the EEA, we will ensure a valid transfer mechanism is in place: an adequacy decision, or the European Commission's Standard Contractual Clauses (Decision 2021/914) incorporated into this DPA by reference, completed as set out in Annex IV, together with a transfer impact assessment. For transfers out of the United Kingdom, the UK Addendum to those clauses applies. For transfers out of Singapore, we comply with the PDPA transfer limitation obligation, which we satisfy through the protection of these clauses plus the measures in Annex II.
Where you are in the EEA or the United Kingdom and we have no establishment there, you can raise anything under this DPA with us at legal@openbinary.ai, or with the supervisory authority where you are established. We will publish the details of our Article 27 representative here before we market the Service to individuals in those territories.
7. Audit
Once a year, and where the law requires or a regulator asks, we will give you the information you reasonably need to confirm we are meeting this DPA. We will provide our most recent security documentation and, where relevant, an independent report. We do not offer on-site audits of our systems, and we do not permit audits that would expose the data of other customers or our own security measures.
8. Security incidents and government access
We will notify you per section 3 of any breach affecting your data. If we receive a request from a public authority for your personal data, we will tell you unless we are prohibited, and we will challenge it where we have grounds and the law allows. We may disclose the minimum necessary to comply.
9. Retention
We hold your files and their analysis while your account or workspace is open. A file store keyed to content is what makes the Service work, so identical bytes share one record, and the comparison libraries keep what they learned from comparing your files — that is stated in the Terms and is not affected by deletion.
On your instruction, or when you delete a workspace or item, we remove the workspace and the records that reference those files, so the Service stops surfacing them to anyone, and we delete the files and their analysis unless the same bytes are held elsewhere or are in the corpus. If you would rather have a copy than a deletion, ask and we return your data in a machine-readable format before deleting it. Where we cannot delete — a shared record, a corpus record, a legal retention — we tell you which and why, and we sever your association with it instead.
Deletion is from live systems. Encrypted backups roll over and may retain a copy for up to 90 days before being overwritten; we do not restore from backup to satisfy a request for data we have deleted.
Corpus records for files you have published are governed by our removal policy and are outside this DPA, because the corpus is ours and is not your processing. Analysis of files obtained from public sources is likewise outside this DPA.
10. Liability
Our liability under this DPA is subject to the limitations in the agreement, including the confidentiality carve-out in those limitations. The question of whether data protection should carry a higher cap than the general one is an open commercial position, recorded internally and not in this document.
Annex I — Processing
Parties. Controller: you, as identified in the agreement. Processor: BETA BLOCKS PTE. LTD. (trading as openbinary), 68 Circular Road #02-01, Singapore 049422.
Subject matter. Analysis of software submitted to the Service, and provision of workspace and API access.
Duration. The term of the agreement, plus the retention in section 9.
Nature and purpose. Receipt, storage, static and emulated analysis, indexing, derived-output generation, retrieval, export and deletion — all to provide the Service to you.
Categories of personal data. Data embedded in submitted files and surfaced by analysis: names, usernames, email addresses, machine and file paths, hostnames, URLs, network identifiers such as IP addresses, account-like identifiers found in software, certificate details, and any other personal data present in a file you choose to submit.
Categories of data subjects. Your users; developers and publishers of the software analysed; persons identifiable from the analysed software; persons whose data is carried by software submitted for analysis.
Sensitive data. Not knowingly processed. Where a submitted file contains special-category data, it is incidental to the analysis and you are responsible for it.
Frequency. Continuous, for the term of the agreement.
Annex II — Security measures
This annex states the measures we apply. It is not a substitute for our security questionnaire answers, which go into more detail under confidentiality.
- Encryption in transit. All public endpoints are HTTPS; the certificate is provisioned and renewed automatically by our reverse proxy. API and MCP traffic terminates TLS at the proxy before reaching the application.
- Access control. Separate system accounts per service, with no shared logins. Configuration files are mode 0640 and owned by the service user. Secrets are held in a password manager and never in the repository. Administrative access is by SSH with a hardened daemon configuration, and the firewall admits only SSH — with rate limiting — and HTTPS.
- Tenancy isolation. Every read is decided by a visibility gate: public, private to a workspace, or a share link bounded to a single file. The gate is applied per request and covered by tests that fail closed. A share link resolves to a reader principal that cannot perform any action that does work. Credentials extracted from a private file are never rendered outside the holding workspace.
- Monitoring and logging. Access logs, application logs, host metrics and operator actions on publish and share are recorded in our own analytics system in the same region as production. Incident-relevant logs are kept for 90 days, or 12 months where part of an incident.
- Vulnerability management. We analyse our own dependencies and patch critical and high findings with a target of 7 days for critical and 30 days for high. Our own software has a public disclosure route at security@openbinary.ai.
- Physical and supplier. Production runs on dedicated hardware in a German datacentre under the supplier's physical controls and information security certification.
- Resilience. Account and annotation databases, the fingerprint corpus, the upload ledger and the upload bucket are backed up nightly to a separate storage service, copy-only, so a production deletion cannot propagate to the backup. Our recovery point objective is 24 hours.
- People. Access to production is limited to named operators under confidentiality obligations, and is removed on departure by rotating credentials in the password manager.
- Deletion. Deletion from live systems is described in section 9. Backups roll over and are not restored to satisfy a request for data we have deleted.
Annex III — Subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure | All Service data | Germany (EU) |
| WorkOS, Inc. | Sign-in and authentication | Email address, name, workspace membership | United States |
| Stripe, Inc. | Payments and billing | Name, email address, billing details, tax identifiers | United States |
| Anthropic PBC | Model-generated summaries and triage | Analysis content sent for the feature, which may include personal data present in the file | United States |
Notes: Tell, our analytics, logging and metrics system, is our own software on our own infrastructure and is not a subprocessor.
Annex IV — Transfer mechanism
Standard Contractual Clauses, Decision 2021/914, Module 2 (controller to processor) are incorporated. Modules 3 and 4 apply where a subprocessor operates in a third country. The clauses are completed as follows: clause 7 docking clause applies; clause 9 uses a 30-day notice period for subprocessor changes per section 5; clause 11 has no independent dispute resolution; clause 13 supervisory authority is the one where you are established; clause 17 governing law is the law of Ireland and clause 18(b) forum is the courts of Ireland. Annexes I, II and III of the clauses are those of this DPA. The UK Addendum applies for transfers out of the United Kingdom, with tables completed to match.