Data Processing Agreement

Effective 2026-10-27

1. About this agreement

This Data Processing Agreement (“DPA”) is part of our Terms of Service and is accepted with them; it needs no separate signature. It is between Zautha, operated by an individual based in Türkiye (“Zautha”, “we”), and the customer who accepted the Terms for a workspace (“you”).

It applies to the personal data of your applications’ end users that we process for you when we provide the service (“customer personal data”). It does not cover the data of your own Zautha account, your workspace and its billing: for that we are the controller, as our Privacy Policy explains.

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meaning they have in the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Where Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies, the corresponding terms of that law apply too.

If this DPA and the Terms conflict, this DPA prevails. If the Standard Contractual Clauses (section 13) conflict with anything else, the Standard Contractual Clauses prevail.

2. Roles

You are the controller of customer personal data, or a processor acting for your own customer. We are your processor, or your subprocessor where you are a processor yourself.

3. What we process

The subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects, are described in Annex I.

4. Your instructions

We process customer personal data only on your documented instructions. Your instructions are these Terms and this DPA, your configuration of your applications in the dashboard, and your requests to the Backend API. We may also process it where the law we are subject to requires it; in that case we tell you first, unless that law forbids it.

We tell you if we believe that an instruction breaks the GDPR or other data protection law.

You are responsible for your instructions being lawful and for having a legal basis for the processing.

5. Confidentiality

Only people who need access to customer personal data to run the service have it, and they are bound to keep it confidential. Today that is the operator alone.

6. Security

We protect customer personal data with the technical and organisational measures in Annex II. We may improve them over time, but we do not lower the level of protection they give.

7. Subprocessors

You give us general authorisation to engage subprocessors. Those we use today are listed in Annex III and on our Subprocessors page.
Before we add or replace a subprocessor, we update that page and tell the owners of your workspace by email at least 30 days in advance. You may object within that time on reasonable data protection grounds. If we cannot address your objection, you may end the Terms by deleting your applications and your workspace.
We impose on each subprocessor, by contract, data protection obligations that give at least the protection of this DPA, with two exceptions that the list marks: zSender is our own email-sending service, operated by us, so this DPA binds it directly; and Google Drive, used under Google’s standard terms, only ever receives backups encrypted on our server, which Google cannot read. We remain responsible to you for our subprocessors.

8. Requests from data subjects

The dashboard and the Backend API let you find, read, correct, export and delete your users’ data, so you can answer their requests yourself. If a data subject contacts us about customer personal data, we refer them to you and do not answer the request ourselves, unless you ask us to. We help you with requests the tools do not cover, as far as we reasonably can.

9. Other assistance

Taking into account the nature of the processing and the information we have, we help you with your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 GDPR).

10. Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we notify the owners of your workspace by email without undue delay. We tell you what we know: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and what we have done or propose to do about it. Where we cannot give all of it at once, we give it in phases as we learn more.

11. Deletion and return

While you use the service, you can read your users with the Backend API and delete them in the dashboard or with the API at any time.
When you delete an application, its users and all their data are deleted from our database within about an hour, and from our backups when those expire after 14 days. The same applies to the applications of a workspace you delete, and when the Terms end.
We keep customer personal data longer only where the law requires us to.

12. Audits

We make available to you the information you need to show that we meet our obligations under this DPA, and we answer your written questions about it. If that is not enough, or a supervisory authority requires it, you may audit us, or have an independent auditor bound by confidentiality do so, on 30 days’ written notice, at your own cost, at most once a year (unless after a personal data breach), and without access to other customers’ data.

13. Transfers outside the EU

Customer personal data is stored in Germany. We operate the service from Türkiye, which has no adequacy decision of the European Commission, so customer personal data is transferred to Türkiye whenever we access it. Some subprocessors are established or process data outside the EU (see Annex III).

Standard Contractual Clauses. For every such transfer of customer personal data that the GDPR covers, you (as data exporter) and we (as data importer) agree to the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914 (the official text) (“the Clauses”). They are incorporated into this DPA, as follows:

Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor.
Clause 7 (docking clause) applies.
Clause 9: Option 2, general written authorisation, as in section 7 of this DPA; we tell you of an intended change at least 30 days in advance.
Clause 11: the optional wording on an independent dispute resolution body does not apply.
Clause 13: the competent supervisory authority is the one set out in Annex I.C.
Clause 17: Option 1; the Clauses are governed by the law of Ireland.
Clause 18: disputes are resolved by the courts of Ireland.
Annexes I, II and III of the Clauses are Annex I, Annex II and Annex III of this DPA.

Module Two (or Three) covers only the transfer from you to us. Our onward transfers to subprocessors are not a separate module: they are made under Clause 8.8 (onward transfers) and Clause 9 (use of sub-processors) of the Clauses, to a subprocessor in a country with an adequacy decision or under appropriate safeguards.

KVKK. Where KVKK applies to customer personal data, we process it as a data processor (veri işleyen). Transfers of that data out of Türkiye rely on the standard contracts set by the Personal Data Protection Board under Article 9 of KVKK, and we notify the Personal Data Protection Authority of them as that article requires.

EU representative. We have not appointed a representative in the EU under Article 27 GDPR.

14. Liability

Each party’s liability under this DPA is subject to the limits in the Terms, except where the Clauses or the law do not allow it to be limited.

15. Duration

This DPA applies for as long as we process customer personal data for you.

Annex I

A. List of parties

Data exporter

Name and address: the customer, as named in the account of its Zautha workspace.
Contact person: the owners of the workspace, at the email addresses of their accounts.
Activities relevant to the transfer: using Zautha to authenticate the end users of its applications.
Role: controller (Module Two) or processor (Module Three).
Signature and date: given by accepting the Terms of Service, on the date they were accepted.

Data importer

Name: Zautha, operated by an individual based in Türkiye.
Country: Türkiye. No postal address is published; contact is by email.
Contact person: privacy@zautha.com.
Activities relevant to the transfer: providing the Zautha authentication service.
Role: processor (Module Two) or subprocessor (Module Three).
Signature and date: given by offering the Terms of Service, on the date the data exporter accepted them.

B. Description of the transfer

Categories of data subjects: the end users of the data exporter’s applications, and people invited to the applications or to their organizations.
Categories of personal data: email addresses; name and username; user, organization and invitation metadata the data exporter stores; credentials (passwords as Argon2id hashes, authenticator-app secrets encrypted, passkeys as public keys, backup codes as hashes); identifiers and email addresses from social sign-in providers; sessions and devices (IP address, browser and operating system, last activity); sign-in attempts, rate limits and lockouts; organization memberships and roles; the content of the emails sent to end users; the events sent to the data exporter’s webhook endpoints; which users signed in during a month.
Sensitive data: none is intended. The data exporter does not store special categories of data in metadata.
Frequency of the transfer: continuous, for as long as the service is used.
Nature of the processing: storing the data; authenticating end users and managing their sessions; sending emails to them; checking for bots; delivering webhook events; counting usage; making backups.
Purpose of the transfer and further processing: providing the authentication service to the data exporter.
Retention: until the data exporter deletes the data (section 11); audit log entries and webhook events 7 days on the Free plan and 90 days on Pro; the record of which users signed in during a month for three months after that month; backups 14 days.
Transfers to subprocessors: for the purposes, the data and the time set out in Annex III.

C. Competent supervisory authority

As Clause 13 of the Clauses provides: the supervisory authority of the EU member state where the data exporter is established; if the data exporter is not established in the EU but has appointed a representative under Article 27(1) GDPR, the authority of the member state where that representative is established; otherwise, the authority of the member state where the data subjects whose personal data is transferred are located.

Annex II

Technical and organisational measures, including those to ensure the security of the data:

Encryption in transit: every connection to the service uses TLS, and its domains require HTTPS (HSTS).
Encryption at rest: secrets the service keeps (authenticator-app secrets, signing keys, webhook signing secrets, social sign-in client secrets, queued emails) are encrypted with AES-GCM under a key kept outside the database.
Credentials: passwords are hashed with Argon2id and checked against known breaches; backup codes and secret keys are stored only as hashes; passkeys only as public keys. Session tokens are valid for 60 seconds.
Isolation: every table holding an application’s data is protected by PostgreSQL row-level security, so a request can only reach the data of its own application; a request for another application’s data finds nothing.
Access control: the server accepts connections only on the web ports and on SSH with key-based authentication; the database is not reachable from the internet; the service connects to it with separate, limited roles.
Protection against abuse: rate limits, lockout after repeated failed sign-ins, a bot check on sign-up and after failed sign-ins, and protection against finding out which email addresses have accounts.
Fail closed: when a security check cannot be completed (for example, rate limiting is unavailable), the request is refused. The only exception is the breached-password check, which is skipped when its service is unavailable.
Accountability: changes made in the dashboard or with a secret key are recorded in the workspace’s audit log; impersonation sessions are marked as such in their tokens.
Backups and recovery: the database is backed up every night; backups are encrypted before they leave the server, kept for 14 days, and a restore is tested automatically every week.
Minimisation: we keep only the data the service needs, delete it on the schedule in Annex I, and do not use customer personal data for any other purpose.

Annex III

The data importer uses these subprocessors to process customer personal data:

Subprocessor	Purpose	Personal data	Location
Hetzner Online GmbH	Hosts our servers.	All data the service holds, including the backups kept on the server.	Germany (EU)
zSender (operated by us)	Our own email-sending service, run by Zautha's operator on Hetzner servers: delivers the emails the service sends (verification codes, sign-in links, invitations and notices).	The recipient's email address and the email's content.	Germany (EU), Hetzner
Google (Google Drive)	Stores copies of our nightly backups, in a Google Drive account under Google's standard terms.	Backups of the database, encrypted on our server before they are uploaded: Google cannot read them.	Google's data centres, which may be outside the EU
Cloudflare	DNS for our domains, and Turnstile: the check that a sign-up on a live application, or a sign-in after repeated failed attempts, comes from a person and not a bot.	For Turnstile, the IP address and information about the browser and device: the browser sends them to Cloudflare, and our server sends the IP address to confirm the result.	Cloudflare's global network; Cloudflare, Inc. is in the United States
Zoho Mail	Receives and stores the email sent to our addresses, such as support@zautha.com and privacy@zautha.com.	What you write to us, and your email address.	Zoho's EU data centre

Our other providers, such as Polar for the billing of workspaces, process no customer personal data. The full list is on our Subprocessors page.