Data Processing Agreement
Effective date: April 15, 2026
Last updated: October 13, 2026
This Data Processing Agreement ("DPA") is incorporated into and forms part of the SigmaShake Terms of Use between SigmaShake ("Processor," "we," "us") and the customer ("Controller," "you"). It applies when you use SigmaShake Pro or Enterprise services that involve the processing of personal data.
1. Definitions
- "Personal Data" — any information relating to an identified or identifiable natural person.
- "Processing" — any operation on Personal Data (collection, storage, use, disclosure, deletion).
- "Data Subject" — the individual to whom Personal Data relates.
- "Sub-processor" — a third party engaged by SigmaShake to process Personal Data on your behalf.
- "GDPR" — EU General Data Protection Regulation 2016/679.
- "CCPA" — California Consumer Privacy Act.
2. Scope and Nature of Processing
SigmaShake processes the following categories of data on your behalf:
| Category | Examples | Purpose |
|---|---|---|
| Agent tool-call metadata | Tool name, command fragments, timestamps | Rule evaluation, audit log |
| User identifiers | GitHub user ID, email (Pro/Enterprise only) | Authentication, plan enforcement |
| Rule evaluation results | Decision (allow/block/ask/force/log/shadow), matched rule ID | Dashboard display, audit export |
| Usage metrics | Evaluation count, latency | Quota enforcement, billing |
SigmaShake does not process:
- Content of files the agent reads or writes (only file paths and write-content fragments that trigger rules)
- Source code in its entirety
- Credentials or secrets (our rules block their transmission)
3. Controller Obligations
You agree to:
- Ensure you have a lawful basis for any Personal Data processed through SigmaShake
- Provide appropriate privacy notices to your data subjects
- Respond to data subject rights requests using the mechanisms in Section 5
4. Processor Obligations
SigmaShake agrees to:
- Process Personal Data only on your documented instructions
- Ensure that personnel authorized to process Personal Data are bound by confidentiality
- Implement the security measures described in Section 6
- Not transfer Personal Data to third countries without appropriate safeguards, except for the sub-processors marked "DPA pending" in Section 7 (Google, Cerebras and jsDelivr). For those, the DPA and transfer assessment are still in progress
- Notify affected customers by email from
[email protected]within 72 hours of confirmation of a Sev-1 incident that exposes customer data. Where you are the controller and SigmaShake is the processor, the target for notice of a Personal Data breach is without undue delay, within 36 hours of confirmed awareness. This 36-hour period is a target, not a guarantee
5. Data Subject Rights
To exercise data subject rights (access, rectification, erasure, portability, restriction), contact [email protected]. Our acknowledgement target is 1 business day and our completion target is 15 days. The legal deadline is 30 days (GDPR Art. 12(3)). We may extend it by up to 60 days and will give you notice if we do. These are targets, not guarantees. Erasure and portability requests are handled manually, and no automated deletion cascade or portability export exists. For erasure, we delete data from active systems except where retention is required by law. Automated deletion jobs are not yet verified for account profile, authentication factor, support, and billing data, and deletion from secondary stores is planned.
6. Security Measures
SigmaShake implements the following technical and organizational measures:
- Encryption in transit: TLS 1.3 only on the SigmaShake Worker hostnames; the Cloudflare edge rejects TLS 1.2 and older there.
docs.sigmashake.com(Cloudflare Pages) also accepts TLS 1.2 - Encryption at rest: AES-256 for D1 database storage via Cloudflare
- Access control: Role-based access; production data access limited to authorized engineers
- Audit logging: All administrative access to production systems is logged
- Incident response: Documented breach response procedure; customer notice within 72 hours of confirmation; 36-hour target where the customer is the controller (see Section 4)
7. Sub-processors
The public list is at sigmashake.com/sub-processors. The live feed at compliance.sigmashake.com/api/v1/sub-processors.json is the current sub-processor annex. As of 2026-10-09, SigmaShake uses these sub-processors:
| Sub-processor | Purpose | Location | DPA status |
|---|---|---|---|
| Cloudflare, Inc. | Infrastructure: compute, storage, CDN, WAF, DNS, email routing, Workers AI | USA (SCCs apply for EEA data) | DPA on file |
| Stripe, Inc. | Payments and billing | USA | DPA on file |
| GitHub, Inc. | Source hosting and GitHub App / OAuth sign-in for staff and customers | USA | DPA on file (Microsoft umbrella) |
| Anthropic | AI inference (chat, rule drafting, support triage, sales classification) | USA | DPA on file |
| Resend | Outbound email | USA | DPA on file |
| Google LLC | Analytics (GA4 in Consent Mode v2, consent denied by default; no consent banner exists, so GA4 sets no cookies and sends cookieless pings only) and Google Fonts | USA — DPA and transfer assessment pending | DPA pending |
| Cerebras | AI inference for rule drafting | USA — DPA and transfer assessment pending | DPA pending |
| jsDelivr | CDN for browser libraries | Global CDN — DPA and transfer assessment pending | DPA pending |
The public list and the JSON feed above are the notice channel for sub-processor changes. Email notice of changes is planned and is not available today. No RSS or Atom feed exists. You may object to a new sub-processor on reasonable data-protection grounds within 30 days of the list update. SigmaShake will work with you in good faith to resolve the objection, including terminating the relevant Service if no resolution can be reached.
Note 2026-10-11: an earlier version of this section promised 30 days of advance notice by email. That mechanism does not exist. The 2026-10-09 list update added sub-processors that were already in use, and no email notice was sent.
8. International Data Transfers
For transfers of EEA Personal Data to the United States, the SCCs apply for Cloudflare, as the sub-processor table in Section 7 shows. The transfer mechanism for the other US sub-processors with a DPA on file (Stripe, GitHub, Anthropic and Resend) follows the terms of their DPAs. For Google, Cerebras and jsDelivr, the DPA and transfer assessment are pending. SigmaShake does not claim the SCCs as a general safeguard for all sub-processors, and no transfer impact assessment records exist yet. Contact [email protected] with questions about a transfer.
9. Audit Rights
Upon written request with reasonable notice, SigmaShake will provide information necessary to demonstrate compliance with this DPA. We may satisfy this obligation through third-party audit certifications (when available) or questionnaire responses.
10. Data Retention and Deletion
| Data type | Retention period |
|---|---|
| Audit log events (local-only use, no paid subscription) | Not stored in cloud |
| Audit log events, Hub (Pro) | Synced rows from the last 7 days can be read and exported. Older rows are hidden from those views, not deleted |
| Audit log events, Hub (Enterprise) | Synced rows from the last 90 days can be read and exported. Older rows are hidden from those views, not deleted |
| Audit log events, Fleet | Deleted by a daily purge at 02:00 UTC after the organization's audit_retention_days (default 90) for organizations with Fleet enabled |
| Identity-provider (SSO) audit events | Never deleted. A nightly export writes them to R2. A 7-year Object Lock on that export is an operator target, not a control in code |
| Account administrator audit log | Append-only. No deletion job exists |
| Audit log events on the customer's machine | Capped by row count (50,000 soft, 500,000 hard), not by days |
| Billing records | 7 years (legal requirement) |
| Account data | Until account deletion, then deleted (target: 30 days) |
SigmaShake does not enforce one audit-retention period across all stores. No cold tier exists. Dated note 2026-10-13: the audit-log rows above replace earlier text that said enforced day limits and immutability ship in a future release.
On termination of your subscription, our target is to delete your Personal Data within 30 days unless legally required to retain it. This is a target, not a guarantee. Automated deletion is not verified for every data category, and deletion from secondary stores is planned.
11. Contact
For DPA-related questions: [email protected]
For security incidents: [email protected]
Enterprise customers requiring a countersigned DPA should contact [email protected].