Data Processing Agreement

1. Parties and incorporation

This Data Processing Agreement (“DPA”) is entered into between the customer that uses OpenWAF Cloud (the “Customer”), as controller, and AI Services LLC, trade name OpenWAF, 99 Wall Street #2351, New York, NY 10005, USA (“OpenWAF”), as processor. It forms part of the Terms of Service and applies automatically when the Customer uses the service, without the need to sign it separately. If the Customer is an agency acting on behalf of its own clients, the Customer acts as processor for them, and OpenWAF acts as its sub-processor under the same terms.

2. Subject matter, duration, nature and purpose

• Subject matter: the processing of personal data needed to provide the authoritative DNS and web application firewall (WAF) service for the Customer’s domains and websites.
• Duration: while the Customer uses the service, and afterwards until the data are deleted as described in section 10.
• Nature: receiving, inspecting, filtering, forwarding and logging HTTP(S) requests to the Customer’s proxied hostnames; answering DNS queries; sending access-gate e-mails; storing the Customer’s configuration.
• Purpose: protecting the Customer’s websites and serving its DNS zones, as configured by the Customer.

The details are in Annex I.

3. Documented instructions

OpenWAF processes personal data only on the Customer’s documented instructions, unless the law requires otherwise; in that case OpenWAF will inform the Customer before processing, unless the law prohibits it. The configuration the Customer sets through the API or the CLI, together with this DPA and the Terms of Service, constitutes the Customer’s instructions. OpenWAF will tell the Customer if, in its opinion, an instruction infringes data protection law.

The Customer is responsible for having a legal basis for the processing, for informing the visitors of its websites and the people it authorises in the access gate, and for the lawfulness of its instructions.

4. Confidentiality

OpenWAF ensures that the people authorised to process personal data have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality.

5. Security

OpenWAF applies the technical and organisational measures described in Annex II, appropriate to the risk in accordance with article 32 GDPR. OpenWAF may update those measures as long as the overall level of security is not reduced.

6. Sub-processors

The Customer gives OpenWAF a general written authorisation to engage the sub-processors listed in Annex III. OpenWAF will inform the Customer by e-mail at least 30 days before adding or replacing a sub-processor. The Customer may object within that period on reasonable data-protection grounds; if the parties do not reach a solution, the Customer may terminate the service. OpenWAF imposes on each sub-processor data protection obligations equivalent to those in this DPA and remains responsible to the Customer for their performance.

7. Assistance to the Customer

Taking into account the nature of the processing, OpenWAF will help the Customer, as far as possible:

• to answer requests from data subjects exercising their rights. If OpenWAF receives such a request directly, it will forward it to the Customer without undue delay and will not answer it itself, unless the Customer instructs it to;
• to meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the supervisory authority (articles 32 to 36 GDPR), with the information available to OpenWAF.

8. Personal data breaches

OpenWAF will notify the Customer of any personal data breach affecting the Customer’s data without undue delay after becoming aware of it, by e-mail to the account’s contact address. The notification will include, as far as available, the information listed in article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed. Information not available at first may be provided in phases.

9. International transfers

Customer data are processed in the European Union (Germany). Where a transfer to a country outside the European Economic Area takes place, including access by AI Services LLC from the United States and the sub-processors in Annex III, it will rely on the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise on the Standard Contractual Clauses approved by the European Commission, which are incorporated by reference where applicable.

10. Deletion and return of data

• Security events expire and are deleted 30 days after they are recorded.
• When the account is closed, OpenWAF deletes the Customer’s configuration, including access-gate e-mail addresses and certificate private keys, within 30 days, unless the law requires it to keep them.
• Before closing the account, the Customer may ask OpenWAF at [email protected] for a copy of its configuration.

11. Information and audits

OpenWAF will make available to the Customer the information necessary to demonstrate compliance with article 28 GDPR, and will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints. Audits require reasonable prior notice, are carried out at the Customer’s cost, are subject to confidentiality and may take place once a year, unless there has been a personal data breach or a supervisory authority requires it.

12. Liability and order of precedence

The liability of each party under this DPA is governed by the Terms of Service, to the extent permitted by law. In case of conflict between this DPA and the Terms of Service on the processing of personal data, this DPA prevails.

Annex I. Details of the processing

Categories of data subjects

Visitors of the Customer’s websites; people the Customer authorises in the access gate; the Customer’s staff and members of its account.

Categories of personal data

IP addresses; request metadata, including hostname, path, method and headers such as the user agent; TLS fingerprint; country and autonomous system number (ASN) derived from the IP address; security-event details (time, status, action, rule, attack type and message); access-gate e-mail addresses and one-time codes. DNS queries are processed to answer them.

Special categories of data

None intended. The service is not designed to process special categories of data; any such data in the content of requests are processed only in transit.

Frequency

Continuous, while the service is in use.

Retention

Security events: 30 days by default. Configuration: while the account exists, and up to 30 days after it is closed.

Annex II. Technical and organisational measures

• Hosting in the European Union (Hetzner, Germany) for servers, DNS and edge nodes.
• Encryption in transit with TLS, including the configuration documents sent to edge nodes.
• Configuration documents signed with Ed25519, verified by edge nodes before use.
• Edge nodes keep serving the last valid configuration if the control plane is unreachable.
• Access to systems on a least-privilege basis.
• API tokens stored only as hashes, with mandatory expiry (at most 365 days).
• Mandatory reason for every configuration change and audit log of who changed what, when and why.
• Versioning of the configuration, with history, comparison and rollback.
• Automatic expiry of security events after 30 days.

Annex III. Sub-processors