Data Processing Agreement

1. Definitions

• "Controller": You, the AuditRails customer
• "Processor": AuditRails
• "Personal Data": Any data relating to an identified or identifiable person
• "Processing": Any operation performed on Personal Data
• "Sub-processor": Third party engaged by AuditRails to process data

2. Scope of Processing

Subject matter: Processing of audit log data submitted via the AuditRails API.

Nature and purpose: Storage, indexing, hash chaining, search, and display of audit events.

Types of personal data:

• Actor identifiers (user IDs, usernames)
• IP addresses
• Action descriptions and timestamps
• Resource identifiers
• Custom metadata fields provided by the Controller

Categories of data subjects: Individuals whose actions are logged (end users, employees, administrators).

Duration: For the term of the subscription plus the applicable retention period.

3. Processor Obligations

AuditRails shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure persons authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Delete or return all Personal Data at the end of the service, at the Controller’s choice
• Make available all information necessary to demonstrate compliance

4. Security Measures

AuditRails implements:

• Encryption in transit (TLS) for all traffic
• Multi-tenant data isolation with tenant_id enforcement at every layer
• API key hashing (SHA-256, raw keys never stored)
• WORM storage (S3 Object Lock in COMPLIANCE mode)
• Cryptographic hash chaining for tamper detection
• Role-based access control (RBAC)
• Automated data retention enforcement and deletion
• Encryption at rest for the durable audit-log copy in S3 (AWS KMS, SSE-KMS): our self-hosted database layer does not yet have disk-level encryption configured; see our security page for the current status

5. Sub-processors

AuditRails will notify the Controller 30 days before engaging a new sub-processor. The Controller may object within that period.

6. Data Breach Notification

AuditRails will notify the Controller within 48 hours of becoming aware of a Personal Data breach. Notification will include: nature of the breach, categories and volume of data affected, likely consequences, and measures taken to mitigate.

7. Data Subject Rights

AuditRails provides API endpoints (DSAR Export and DSAR Delete) to assist the Controller in responding to data subject access, portability, and erasure requests. ClickHouse data can be deleted immediately; S3 WORM data is retained until the Object Lock retention period expires (this is documented and accepted by signing this DPA).

8. International Transfers

Data is processed in AWS eu-central-1 (Frankfurt, Germany) by default: an explicit EU-first choice. EU Standard Contractual Clauses (SCCs) are incorporated by reference for any transfers outside the EU.

9. Audit Rights

The Controller may audit AuditRails’ compliance with this DPA once per year with 30 days’ notice. AuditRails will cooperate and provide access to relevant records and personnel.

10. Term and Termination

This DPA is effective upon signing and continues for the duration of the subscription. Upon termination, AuditRails will delete all Personal Data within 30 days unless retention is required by law or the applicable retention period has not yet expired.