Data processing agreement for your projects.

1. Roles

If you store data about other people in your projects, such as your users, you are the controller and Beornwic AB (company no. 559602-9453, Sweden) is your processor. This is our data processing agreement under Article 28 of the GDPR. It is part of the terms and applies for as long as we host projects for you.

You are responsible for being allowed to process the data, for giving your users the information they are entitled to, and for answering them when they want to see, correct or delete their data. We are responsible for the hosting, as set out below.

2. What we do with your data

• We process the data in your projects only to run, secure and restore the project, and only on your instructions. The terms, this agreement and how you use the service are those instructions. If you want to give other instructions, write to us.
• We do not look inside your project except when you have asked for help in a support ticket, or when law or an authority's decision requires it. Then we do as little as possible and tell you, if we are allowed to.
• If we believe an instruction infringes the GDPR we say so before following it.
• The data is stored on our own servers in Sweden and does not leave the EU/EEA through us, except the parts that pass through the sub-processors in annex 3.

3. Security and who touches it

• We protect the data with the measures in annex 2. They are designed for projects that may contain sensitive data and data about children, without us knowing which projects those are. If you store such data, please tell us so we can take it into account.
• Everyone with access to operations is bound by confidentiality, and access is personal and logged.
• We only use the sub-processors listed in annex 3. They are bound by the same protection we promise you. If we want to engage a new one we notify you by email at least 30 days in advance. If you object and we cannot resolve it, you may terminate the agreement and take everything with you (terms, section 5).

4. Assistance, incidents and audits

• We help you answer your users when they exercise their rights, with what only we can do. Most of it you do yourself in the project's admin panel or with the GDPR building block.
• If you need a data protection impact assessment or a prior consultation with the supervisory authority, we provide the information about the hosting that you need.
• If we discover a personal data breach affecting your project we notify you by email without undue delay and at the latest within 24 hours of establishing it, with what we know at that point, and follow up as we learn more. Reporting to the supervisory authority is yours to do, unless the breach concerns our own account register.
• We provide the documentation you need to demonstrate that this agreement is followed. If you want to audit beyond the documentation, we agree on how, so that other customers' operations are not disturbed, and you bear the cost unless deficiencies are found.

5. When the agreement ends

When your project or account ends you get everything out through the export (terms, section 5). The data is kept for 30 days so you have time, then the project's storage volume is permanently deleted with all snapshots (terms, section 13). If you want a confirmation of deletion we email one, with the date.

6. Changes and versions

If this agreement changes we notify you by email at least 30 days before the change applies, and you accept the new version in the control panel. Which version you accepted, and when, is shown under Account. The current version and date are always shown at the top of this page. Swedish law applies; the Swedish text prevails over the English one.

Annex 1 · The processing

Annex 2 · Security measures

This is what exists, not what is planned. If it changes, the annex is updated.

• Encryption at rest: each project's storage volume is encrypted with AES-256. The key is not stored on the disks. Encryption protects against stolen or discarded disks, not against us as the operator.
• Encryption in transit: HTTPS to the projects via Cloudflare, an encrypted tunnel between Cloudflare and our server, and an encrypted tunnel from the server out to the internet.
• Isolation: each project runs as its own system user with its own limits for CPU, memory and processes, and cannot reach other projects or our internal network.
• Access: the server is reached only from inside our encrypted network, with a personal SSH key. Access is logged. We do not know your admin passwords.
• Snapshots: before every deploy and building-block change, with automatic rollback if the project does not respond afterwards. No continuous backups yet, see terms section 7.
• Deletion: 30 days after a project ends, the volume is permanently deleted. Deletion requires a yes from both the control system and the server.
• Updates: the operating system's security updates are installed automatically. The PocketBase version in production is the one we have tested the building blocks against and is changed in a controlled way.
• Monitoring: every project is health-checked continuously; if it does not respond it is restarted and you are alerted according to your settings.
• Physical: the server is in a locked space in Sweden that only we have access to.

Annex 3 · Sub-processors

These touch data in your projects. Providers that only touch your account with us are listed in the privacy policy.

Last changed: 2026-11-09. New sub-processors are announced as described in section 3.