Data processing agreement

This agreement is between you, the customer, as controller, and Siddhesh Sule (Zyloft), Lupfenstr. 12, 78532 Tuttlingen, Germany, as processor ("we"). It covers personal data contained in the webhooks and related data you send through HookStead ("customer data"). It does not cover your account data (name, email, billing details), which we process as controller under our privacy policy.

You conclude this agreement by accepting the terms of service. It runs for as long as we process customer data for you. Where it conflicts with the terms, this agreement prevails.

• Nature and purpose: receiving webhooks on URLs we provide, verifying, storing and encrypting them, forwarding them to the endpoints you configure, retrying failed deliveries, and showing, searching, replaying and monitoring them in the dashboard and API.
• Types of data: whatever your webhook senders include in headers and bodies, for example names, email addresses, postal addresses, phone numbers, order and payment references, account ids and IP addresses. You decide what is sent.
• Data subjects: your customers, users, employees and other people whose data appears in your webhooks.
• Special categories (Art. 9 GDPR) should not be sent. If you must send them, you are responsible for an adequate legal basis and for telling us first.
• Duration and deletion: customer data is deleted automatically after your plan's retention period (Free 3 days, Pro 14 days, Team 30 days), when you delete a workspace, or when your account closes. Backups containing it are overwritten within 14 days.

We process customer data only on your documented instructions: these terms, this agreement, and the settings you choose in HookStead (sources, destinations, retention by plan, replays). We tell you if we believe an instruction breaks data protection law. We process customer data for other purposes only where EU or German law requires it, and tell you beforehand unless the law forbids it.

Everyone with access to customer data is bound to confidentiality. We access customer data only where needed to run the service, to answer a support request you make, or to investigate abuse or security incidents.

• Location: application, database and backups run on a dedicated virtual server in Germany.
• Encryption: all traffic uses TLS (HTTPS). Original webhook payloads and all secrets are encrypted at rest with AES-256-GCM; keys are kept apart from the database and can be rotated.
• Data minimisation in the dashboard: sensitive fields are redacted for display; viewing an original payload needs the admin role and is recorded in the audit log.
• Access control: per-organisation isolation, roles (owner, admin, member, viewer), hashed API keys, verified email sign-in. Server access only by SSH key; root and password logins are disabled; a firewall allows only SSH, HTTP and HTTPS.
• Integrity: inbound signatures are verified, outbound deliveries are signed (Standard Webhooks), and changes to settings are audit-logged.
• Availability: events are stored before they are acknowledged; deliveries are retried from the database; the database is backed up nightly, and the restore procedure is documented and tested automatically.
• Logging: logs and error reports never contain webhook payloads, credentials or request headers.
• Review: we review these measures regularly and may update them, provided the level of protection does not decrease.

You authorise the sub-processors listed on the sub-processors page. We bind each one to data protection obligations equivalent to this agreement. We announce new or replaced sub-processors on that page and by email at least 30 days in advance; you may object on reasonable data protection grounds, and if we cannot address the objection, you may terminate the affected service before the change takes effect. We use sub-processors in the EU or EEA; any transfer outside it would rely on an adequacy decision or the EU standard contractual clauses.

Taking into account the nature of the processing, we help you answer data subject requests (access, correction, deletion, restriction, portability, objection), and with security, breach notifications, data protection impact assessments and consultations with authorities. Most requests you can handle yourself in the dashboard, for example by finding and deleting events. If a data subject contacts us directly, we forward the request to you.

We notify you without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting customer data. We describe what happened, the data and people likely affected, the likely consequences, and the measures taken or proposed, and provide further information as it becomes available.

When the service ends, we delete all customer data, unless law requires us to keep it. Before that, you can retrieve what you need through the API. Backups are overwritten within 14 days.

We make available the information needed to show compliance with Art. 28 GDPR, primarily this document and written answers to your questions. Where that is not enough, you may audit us, once a year and with 30 days' notice, during business hours, at your own cost, and bound by confidentiality, or through an independent auditor bound the same way.

Liability follows Art. 82 GDPR and the liability section of the terms. German law applies. Questions about this agreement: privacy@hookstead.dev. If you need a signed copy for your records, write to us and we will send one.