Data Processing Addendum

1. Scope and Roles

This Data Processing Addendum ("DPA") supplements the Terms of Service between you ("Customer") and Raster & State LLC ("Raster & State", "we"), the operator of the Fjord platform, and applies whenever Raster & State processes Personal Data on Customer's behalf in providing the Service. In respect of such processing, Customer is the Controller (or processor acting on behalf of a third-party controller) and Fjord is the Processor.

Capitalized terms not defined here have the meanings given in the Terms or, where applicable, in the data protection laws that apply to Customer's use of the Service.

2. Subject Matter and Duration of Processing

• Subject matter: hosting, transmitting, processing, and backing up Customer Data on a managed Forgejo Instance, including via CI Runners where engaged.
• Duration: the term of the Customer's subscription, plus the post-termination data return/deletion window in Section 10.
• Nature and purpose: providing the Service per the Terms.
• Types of Personal Data: any Personal Data Customer chooses to store in its repositories, issues, pull requests, comments, CI artifacts, and related Forgejo data; Customer's own account data for Fjord users administering the Instance.
• Categories of Data Subjects: Customer's authorized users and collaborators; any individual whose Personal Data is included in Customer Data.

3. Customer Instructions

Fjord processes Personal Data only on documented instructions from Customer, which include the Terms, this DPA, Customer's configuration of the Service, and any additional written instructions. Fjord will inform Customer if, in its opinion, an instruction infringes applicable data protection law.

4. Confidentiality

Fjord ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations and receive training on data protection.

5. Security

Fjord implements appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures are described in Annex A (Security Measures) below. Customer confirms that Annex A meets its requirements for the categories of Personal Data it processes through the Service.

6. Sub-processors

Customer authorizes Fjord to engage the sub-processors listed in our Privacy Policy ("Approved Sub-processors") to process Personal Data, subject to written terms providing protections substantially the same as those in this DPA. Fjord remains liable for the acts and omissions of its sub-processors as for its own.

Fjord will give Customer at least 30 days' notice before adding a new sub-processor that will process Personal Data. Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection in good faith, Customer may terminate the affected portion of the Service for the remainder of the then-current term.

7. Data Location and International Processing

Fjord is operated from the United States and, at this time, is offered only to customers in the United States. Customer Data on a managed Instance, its backups, and any CI Runner VMs are hosted by Hetzner in the region Customer chooses at deploy time (EU Central (Falkenstein), United States, Asia Pacific (Singapore)); other sub-processors process limited Personal Data in the United States and the European Union as described in the Privacy Policy. Where Customer selects the Asia Pacific (Singapore) region, Customer Data on that Instance, its backups, and its CI Runner VMs is processed in Singapore.

Because the Service is currently offered only to United States customers, this DPA does not incorporate the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, and the Service is not offered to organizations established in the EU/EEA or the UK as their basis for engaging a processor. We plan to extend availability to the European Union and Canada in the future, at which point we will put an appropriate Article 46 transfer mechanism in place before processing Personal Data subject to the EU or UK GDPR. EU/UK organizations interested in advance should contact us at [email protected].

8. Assistance to Customer

• Data Subject Rights: Fjord assists Customer in responding to requests from Data Subjects (access, rectification, erasure, restriction, portability, objection). Where a Data Subject contacts Fjord directly, Fjord will, unless prohibited by law, direct the Data Subject to Customer.
• DPIAs and prior consultation: Fjord provides reasonably available information to assist Customer with data protection impact assessments and prior consultations required under applicable data protection law.

9. Breach Notification

Fjord notifies Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Data, with the information reasonably necessary for Customer to comply with its own breach notification obligations. Notice is given by email to the Customer's account contact and by any other channel Customer designates in writing.

10. Return and Deletion

On termination of the Service, Customer may export Customer Data for 30 days. After that window, Fjord deletes Customer Data from active systems. Backups containing Customer Data are deleted in the ordinary course per the backup retention schedule in the Privacy Policy, after which deletion is permanent. Fjord will, on request, certify deletion in writing.

11. Audits

At Customer's reasonable request and no more than once per year (except where required by a supervisory authority or following a Personal Data Breach), Fjord will provide reasonable information to demonstrate compliance with this DPA. Fjord may satisfy audit obligations through up-to-date third-party certifications or audit reports where reasonably available. On-site audits are scheduled in advance, conducted during business hours, and subject to confidentiality.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions in the Terms.

13. California Consumer Privacy Act (Service-Provider Terms)

To the extent Fjord processes Personal Information (as defined in the California Consumer Privacy Act, as amended, the "CCPA") on Customer's behalf in providing the Service, Fjord acts as Customer's service provider. Fjord:

• processes that Personal Information solely to perform the Service under the Terms and this DPA, and for no other purpose;
• does not sell or share that Personal Information (as those terms are defined in the CCPA);
• does not retain, use, or disclose that Personal Information for any purpose other than performing the Service, including outside the direct business relationship between the parties, except as the CCPA permits;
• does not combine that Personal Information with personal information it receives from, or on behalf of, another person, or collects from its own interaction with the consumer, except as the CCPA permits a service provider;
• certifies that it understands and will comply with these restrictions; and
• will notify Customer if it determines it can no longer meet its obligations under the CCPA.

Customer may take reasonable and appropriate steps, consistent with Section 11 (Audits), to confirm that Fjord uses Personal Information in a manner consistent with Customer's obligations under the CCPA, and to stop and remediate any unauthorized use.

14. Order of Precedence

In the event of conflict, this DPA prevails over the Terms with respect to the processing of Personal Data. Where Standard Contractual Clauses or other transfer mechanisms are separately agreed under Section 7, those prevail over this DPA to the extent of any conflict.

Annex A: Security Measures

Fjord implements, at a minimum, the following technical and organizational measures:

• Encryption in transit: TLS for all customer-facing endpoints; control plane to Instance traffic over authenticated TLS once provisioning completes.
• Encryption at rest: Hetzner volume-level encryption; backups encrypted with per-Instance keys via restic.
• Single-tenant isolation: each customer's Instance and CI Runners run on dedicated VMs; no cross-customer shared compute.
• Secrets derivation: per-Instance secrets are derived from a durable root key held only in the control plane; secrets are fetched by the Instance over TLS at first boot and never embedded in user-data.
• Network controls: a per-project Hetzner firewall restricts inbound access; SSH limited to Fjord's control-plane CIDR; CI Runners expose no inbound services.
• Access control: least-privilege access to production; operator MFA required for sensitive administrative endpoints (price changes, key rotation).
• Audit logging: a tamper-evident audit ledger records administrative events (token issuance, configuration changes, bootstrap consume).
• Vulnerability management: operating system patches applied on a regular cadence; dependency updates reviewed and applied promptly when security relevant.
• Backups: nightly Forgejo dumps shipped to a jailed Storage Box sub-account per Instance; retention is a rolling 90-day window (snapshots older than 90 days are pruned).
• Incident response: documented runbooks; on-call rotation for security and availability incidents.
• Personnel: background checks where permitted by law; confidentiality obligations; data-protection training on hire and annually.