← All policies

Data Processing Addendum

Effective 30 August 2026 · Operated by [Your name], an independent developer based in Hyderabad, India

This Addendum applies where nvault processes personal data on behalf of a customer (a “Controller”), typically an organization on the Team plan. It forms part of the Terms of Service. Where it conflicts with the Terms on data protection, this Addendum prevails.

1. Roles

For account and organization metadata, the customer is the Controller / Data Fiduciary and nvault is the Processor / Data Processor. For the contents of files stored in the vault, nvault acts purely as a processor of ciphertext and has no ability to access the plaintext.

2. Subject matter and duration

Processing continues for as long as the customer uses the service and for the retention periods stated in the Privacy Policy. The subject matter is the provision of a zero-knowledge configuration vault.

3. Nature and purpose of processing

Storage, versioning, transmission, backup and restoration of encrypted files; authentication; organization and membership management; billing; security monitoring and audit logging.

4. Categories of data and data subjects

  • Data subjects: the customer's personnel who hold accounts or organization memberships.
  • Personal data: names, email addresses, hashed passwords, session/device records, roles, audit events. Any personal data the customer places inside a stored file is encrypted client-side and is opaque to nvault.
  • nvault does not require or want special-category data in account metadata.

5. Processor obligations

  • Process personal data only on the customer's documented instructions, including for transfers, unless required by law.
  • Ensure personnel with access are bound by confidentiality.
  • Implement the technical and organisational measures in section 7.
  • Assist the customer, taking into account the nature of processing, with data-subject requests and with DPIAs and prior-consultation obligations.
  • Make available information necessary to demonstrate compliance and allow for reasonable audits (section 9).
  • On termination, delete or return personal data as described in the Privacy Policy.

6. Sub-processing

The customer authorises the sub-processors listed at /subprocessors. nvault imposes data-protection obligations on each sub-processor no less protective than this Addendum and remains responsible for their performance. nvault will give at least 30 days' notice of a new sub-processor, during which the customer may object on reasonable data-protection grounds.

7. Security measures

  • Client-side AES-256-GCM encryption of file contents before upload; the server stores ciphertext only.
  • A server-side envelope-encryption layer over stored blobs, keyed outside the database.
  • Key hierarchy derived from a user passphrase that is never transmitted (see the security page).
  • Passwords stored using a memory-hard hash; scoped, short-lived access tokens; session and device revocation.
  • Authorization checks on every project, file, version and organization operation; non-guessable identifiers.
  • Encryption in transit (TLS); strict transport security and a restrictive content-security policy.
  • Audit logging of security-sensitive actions without secret values; least-privilege operational access.

8. Personal data breach

nvault will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information the customer reasonably needs to meet its own notification obligations, and will cooperate on remediation.

9. Audit

On reasonable written request, no more than once per year (or after a breach), nvault will provide relevant documentation and respond to a security questionnaire. On-site audits, where required by law, are by prior appointment, subject to confidentiality, and at the requesting party's cost.

10. International transfers

Where nvault or its sub-processors transfer personal data across borders, the transfer relies on an adequacy decision or on Standard Contractual Clauses (or the UK IDTA / Addendum), which are incorporated by reference. File contents are transferred only as ciphertext.

11. Liability and precedence

Each party's liability under this Addendum is subject to the limitations in the Terms of Service. This Addendum does not grant the customer rights beyond those in applicable data-protection law.

12. Requesting a signed copy

Organizations that need a countersigned DPA can email privacy@nvault.dev from an authorised address.