Data Processing Agreement

Last updated: October 24, 2026

1. About This Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the customer, and DataBlock AB, a Swedish company based in Stockholm that provides Cosmoner ("we", "our", and "us"). It applies whenever we process personal data on your behalf while providing the services, and it takes effect when you accept the Terms of Service. You do not need to sign anything separately.

It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR). Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meaning the GDPR gives them.

If this DPA and the Terms of Service conflict on the processing of personal data, this DPA applies.

2. Roles

For the personal data contained in the content you put on Cosmoner — the files, websites, databases, emails, container images, secrets, and application data in your projects ("Customer Data") — you are the controller, or a processor acting for your own customer, and we are your processor or sub-processor.

The data we need to run your account, such as your login details and billing information, is not covered by this DPA. We are the controller for it, as described in our Privacy Policy and on our GDPR page.

3. Details of the Processing

  • Subject matter: hosting, storing, transmitting, and backing up Customer Data so that we can provide the services you order.
  • Duration: for as long as we provide the services to you, and afterwards for the time needed to delete Customer Data as described in section 11.
  • Nature and purpose: storage, computation, networking, backup, restoration, email delivery, and the support you ask us for. We process Customer Data only to provide the services.
  • Types of personal data: whatever you choose to store or send through the services. This may include contact details, account and identification data, communications, and any other personal data your applications handle.
  • Categories of data subjects: whoever your Customer Data relates to, such as your end users, customers, employees, and contacts.
  • Special categories of data: the services are not designed specifically for them. If you store special categories of personal data or data about criminal convictions, you are responsible for making sure that our security measures are appropriate for it.

4. Your Instructions

We process Customer Data only on your documented instructions. Those instructions are this DPA, the Terms of Service, and the way you configure and use the services through the control panel, the API, and the SDKs. We will not process Customer Data for any other purpose, including our own.

If we are required by EU or Member State law to process Customer Data in another way, we will tell you before we do so, unless that law forbids it. If we believe an instruction from you infringes the GDPR or other data protection law, we will tell you.

You are responsible for having a legal basis for the processing you instruct us to carry out, and for the accuracy and lawfulness of Customer Data.

5. Confidentiality

Everyone we authorize to process Customer Data is bound by a duty of confidentiality, either by contract or by law. Access is limited to the staff who need it to run, secure, and support the services.

6. Security

We implement the technical and organizational measures described in the annex to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and access. We may update these measures over time, but we will not reduce the overall level of protection they provide.

You are responsible for the security of what is within your control, such as your account credentials, API keys, application code, and the access you grant to members of your organization.

7. Subprocessors

You give us general authorization to engage subprocessors. The subprocessors we use, what they do, and where they process data are listed on our GDPR page.

  • Before a new subprocessor starts processing personal data, we will update that list and notify the owners of your organization by email at least 30 days in advance.
  • If you have a reasonable, data-protection-based objection to a new subprocessor, tell us within that period. We will work with you in good faith to find a solution. If we cannot, you may stop using the affected service and we will credit any prepaid, unused amount for it.
  • We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible to you for their performance.

Some products run on a subprocessor's infrastructure in the region you choose when you create the resource. Choosing that region is an instruction from you.

8. International Transfers

Apps, web hosting, and the PostgreSQL and Valkey databases we host run on our own hardware in Stockholm, Sweden. Where a subprocessor processes Customer Data outside the EU/EEA, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework for providers certified under it, or on the European Commission's Standard Contractual Clauses.

9. Assisting You

Taking into account the nature of the processing and the information available to us, we will help you:

  • Respond to data subject requests. Most requests can be handled directly through the services, because you control Customer Data. If a data subject contacts us about Customer Data, we will pass the request on to you and will not respond ourselves unless you instruct us to.
  • Meet your other obligations under Articles 32 to 36 of the GDPR, including security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority.

10. Personal Data Breaches

If we become aware of a personal data breach affecting Customer Data, we will notify the owners of your organization without undue delay, and no later than 72 hours after becoming aware of it. We will give you the information you need to meet your own obligations, including, as far as it is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose to take. Where we cannot provide everything at once, we will provide it in phases as we learn more.

Notifying you is not an acknowledgement of fault or liability.

11. Deletion and Return

You can export Customer Data at any time while you use the services. When you delete a resource, the Customer Data it holds is deleted. When your account is closed, Customer Data remains available for export for 30 days and is then deleted.

Backups are deleted when their retention period ends, as described on our GDPR page. We may keep Customer Data for longer only where EU or Member State law requires it, and then only for as long as it requires and protected by this DPA.

12. Audits and Information

We will make available the information you reasonably need to demonstrate that we comply with Article 28 of the GDPR, including answers to reasonable security questionnaires.

If that information is not enough, you may audit our compliance, either yourself or through an independent auditor bound by confidentiality, no more than once a year unless a supervisory authority requires it or a personal data breach gives reason to. Give us at least 30 days' written notice and a proposed scope. Audits take place during business hours, in a way that does not disrupt the services or compromise other customers' data, and at your own cost.

13. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where the GDPR does not allow liability to be limited.

14. Term, Governing Law, and Changes

This DPA lasts for as long as we process Customer Data on your behalf. It is governed by the laws of Sweden, and disputes are resolved in the courts of Stockholm, Sweden.

We may update this DPA to reflect changes in the law or in the services. We will notify the owners of your organization before a material change takes effect. A change will not reduce the protection Customer Data receives under this DPA.

If you need a signed copy of this DPA for your records, email [email protected].

Annex: Technical and Organizational Measures

Access control

  • Access to production systems is limited to the staff who need it, and requires strong authentication.
  • Your account supports two-factor authentication and passkeys, and members of your organization get project roles that limit what they can see and change.
  • API keys are scoped to the permissions you choose.

Separation

  • Each organization's resources are kept separate from every other organization's. Applications and web hosting sites run in isolated containers, and network policies stop one customer's workloads from reaching another's.
  • Each database has its own credentials.

Encryption

  • Traffic to the website, the control panel, and the API is encrypted with TLS. Connections to the PostgreSQL databases we host from outside Cosmoner require TLS.
  • Passwords are stored hashed. Secrets are encrypted at rest, and service credentials are hashed or encrypted, never stored in plaintext.

Availability and resilience

  • Web hosting sites are backed up nightly, and backups are kept for the retention you choose.
  • Storage for the databases we host is persistent and survives restarts and maintenance.

Monitoring and incident handling

  • Errors and abuse are monitored. Sign-in attempts are rate-limited, and repeated failed SFTP logins block the source address.
  • Personal data breaches are handled as described in section 10.

Subprocessors

  • Subprocessors are bound by written data protection obligations, as described in section 7.