0cloud Data Processing Agreement

1. Scope

This Data Processing Agreement (DPA) forms part of the Terms of Service with 0sec AG, CHE-171.151.937, Moosgässli 1, 8835 Feusisberg, Switzerland. It covers personal data we process on your behalf to provide the Services (Customer Personal Data).

You act as controller or an authorised processor; we act as your processor or subprocessor. Our own account, billing, security and legal processing is separate. This DPA prevails over conflicting Terms concerning Customer Personal Data. The other Terms, including liability limits and governing law, apply subject to mandatory law and applicable transfer clauses.

2. Processing

We process Customer Personal Data on your documented instructions, including your authorised use, integrations and settings, unless law requires otherwise. We notify you of legally required processing or instructions we consider unlawful where required and legally permitted.

Processing includes storing and analysing submitted materials, security testing, generating findings and fixes, and support. Data may include names, email addresses, identifiers, commit metadata and personal data in code or output, relating to your users, staff, contractors or other people identified in those materials. Processing continues during service provision and the applicable deletion process.

You are responsible for lawful instructions, permissions and notices. Submit only necessary data. Sensitive personal data and production datasets containing personal data require separate written agreement.

3. Security

Authorised personnel are bound by confidentiality. We maintain safeguards appropriate to the processing risks and may update them while meeting applicable legal requirements.

We notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, as required by law, and provide relevant information as it becomes available.

4. Service providers

You generally authorise us to use subprocessors. Depending on the Services used, Customer Personal Data may be processed by:

• Amazon Web Services: hosting and storage.
• Superserve: execution environments.
• Microsoft Azure and OpenAI: AI processing.
• OpenRouter and its inference providers: AI routing and processing.
• Sentry: error monitoring.

We impose applicable data-protection obligations on subprocessors and remain responsible to the extent required by law. Where required, we give advance notice of changes and an opportunity to object on reasonable data-protection grounds. Unresolved objections may lead to ending the affected Services, without affecting applicable refund rights.

Processing may occur in the United States and other countries. Where legally required, recognised transfer safeguards must be in place before a transfer. Mandatory transfer clauses prevail. Contact us for service-specific provider and location information.

5. Assistance

We provide assistance and compliance information required by law, taking account of the processing and information available to us. Verification uses documentation first. Legally required audits are subject to reasonable notice, confidentiality and protection of our systems and other customers. Additional assistance may be charged as agreed and legally permitted. Mandatory rights and regulatory powers remain unaffected.

6. Return and deletion

Download output before requesting deletion. Contact us beforehand if you need other Customer Personal Data returned. At the end of processing, we return or delete Customer Personal Data at your choice as required by law.

The standard deletion process includes a 90-day recovery window before eligible active data proceeds to permanent deletion. This is not a deadline for erasing every copy. Legally required earlier action is handled separately. Backups and provider copies follow their applicable deletion processes and remain protected pending deletion or lawful retention.

We may retain records for billing, legal, security and abuse-prevention purposes where legally permitted and justified. We do not guarantee recovery after permanent deletion. Material already published to connected services, including PRs and comments, is not removed by account or workspace deletion.