Get Started

Data processing agreement

The English version governs if the two differ.

Scope

This agreement applies where we process personal data on your behalf. You are the controller, we are the processor, and we act only on your documented instructions - of which this agreement and the service configuration are part.

Subprocessors

We use the following subprocessors. We will give you 30 days' notice before adding one, and you may object.

OVH SAS (France) - hosting for the European Union, United Kingdom, United States, Canada and Asia-Pacific regions. Oracle Corporation - hosting for the Middle East region, Abu Dhabi. Cloudflare, Inc. - authoritative DNS for totuldigital.ro. DNS only; the site is not proxied through Cloudflare. Google LLC - web fonts loaded by the public website.

Security

Data in transit is encrypted with TLS. Passwords are stored as argon2id hashes. Administrative access requires two-factor authentication. Administrative actions are written to an append-only audit log.

We do not currently operate off-site backups. Your data exists on the infrastructure of your deployment and nowhere else. If that is not acceptable for your use, tell us before you buy.

Breach notification

If we become aware of a personal data breach affecting your data we will tell you without undue delay and in any case within 48 hours, with what we know at the time.

Deletion

When the agreement ends we delete your data within 30 days, unless law requires us to keep it. You can take a complete copy at any time over IMAP and WebDAV.