Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between Devin ApS and the customer organisation ("you"). It applies whenever Devin processes personal data on your behalf while providing the Services. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).

You accept this DPA when you accept the Terms of Service. If you need a signed copy for your records, email support@devin.fm.

1. Roles

• You are the controller of the personal data in your Customer Data. You decide what goes into Devin and why.
• Devin ApS is the processor. We process that data only to provide the Services to you.
• Devin ApS, Nørrebrogade 45D, 2200 Copenhagen N, Denmark, CVR/VAT DK44636638.

For data we use for our own purposes, such as account management, billing, security and marketing, we are the controller. Our Privacy Policy covers that data, not this DPA.

2. What we process

Annex 1 describes the processing: its purpose, the kinds of personal data, and whose data it is.

In short: record data and container data in your FileMaker files are not processed in Devin Cloud. They stay on your servers. Devin Cloud processes the information shown in the Devin App and empty clones of your files (schema, scripts, layouts and other structure, without records).

Exception for beta test servers. If you ask us to host a FileMaker server for you during a beta, the files you place on it, including any records, are stored in our own data centre in Denmark. The Beta and Early Access Terms apply: those servers are meant for test data, are not backed up, and you are responsible for any real data you choose to put on them.

3. Our obligations

We will:

1. Follow your instructions. We process personal data only on your documented instructions. These Terms, this DPA and the way you configure and use Devin are your instructions. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.
2. Keep it confidential. Everyone at Devin who can access personal data is bound by confidentiality.
3. Keep it secure. We use the technical and organisational measures in Annex 2 to protect personal data, as Article 32 GDPR requires.
4. Help with requests. If someone asks to use their data protection rights, we will help you respond, taking into account what Devin does. If a request comes to us directly, we will pass it on to you.
5. Help with compliance. We will give you reasonable help with security, breach notifications, data protection impact assessments and consultations with authorities, based on the information available to us.
6. Report breaches. If we become aware of a personal data breach that affects your data, we will tell you without undue delay, and no later than 48 hours after we become aware of it. As far as we know them at the time, we will tell you what kind of data and how many people are affected, the likely consequences, and what we are doing about it. We will keep you updated as we learn more.
7. Delete or return data. When the Services end, we delete your personal data within 90 days, unless the law requires us to keep it. Within 30 days of the end, you can ask us to return it or export it yourself where export is available.
8. Show compliance. We will give you the information you reasonably need to show that we meet this DPA:
   • Documents first. Once a year, at your written request, we will answer a reasonable written security questionnaire and share relevant documentation about our processing. You must keep these confidential.
   • Audits and inspections. If documents are not enough, or a supervisory authority or the law requires it, or after a personal data breach affecting your data, you or an independent auditor bound by confidentiality may audit us, including by inspection. Audits need at least 30 days' written notice, take place during business hours, and must not disrupt our operations or other customers' data.
   • Costs. Each party pays its own costs. If an audit takes more than one working day of our time, we may charge a reasonable fee, which we will tell you about in advance. If an audit shows that we have materially breached this DPA, we pay our own costs.

4. Sub-processors

You give us general permission to use sub-processors. Annex 3 lists our current sub-processors.

• Before adding or replacing a sub-processor, we will tell you by email or in the Devin App at least 30 days in advance.
• If you have a reasonable data protection objection, you can object within that period. We will try to find a solution. If we cannot, you can cancel the affected Services and get a refund of any prepaid fees for the remaining period.
• Every sub-processor is bound by data protection terms at least as protective as this DPA. We remain responsible for their work.

5. Where data is stored and international transfers

Devin Cloud stores Customer Data in the region that matches your location. Customers in the EU have their Customer Data stored only in our European region, in Amazon Web Services data centres in Frankfurt, Germany or Stockholm, Sweden.

During beta, early access and other pre-release testing, we may store Customer Data in our own data centre in Denmark, with backups stored with Amazon Web Services in the EU (Frankfurt or Stockholm). Our Beta and Early Access Terms apply to that processing.

If personal data is transferred outside the EU/EEA, for example when a sub-processor provides support, we make sure the transfer is protected. Usually that means the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Your obligations

You are responsible for:

• having a lawful basis for the personal data you put into Devin, and informing the people concerned;
• deciding what data goes into Devin, for example not adding personal data to script comments unnecessarily;
• making sure your instructions to us follow data protection law.

7. Liability and term

The liability rules in the Terms of Service apply to this DPA, as far as the GDPR allows. This DPA lasts as long as we process personal data on your behalf.

If this DPA conflicts with the Terms of Service, this DPA takes priority on matters of personal data. It is governed by Danish law.

Annex 1: Description of processing

Annex 2: Security measures

• All data in transit is encrypted with TLS.
• Devin Cloud's database and file storage are encrypted at rest. The database is not reachable from the internet, and file storage blocks public access.
• Customer Data is kept separate for each customer, with access checks on every request.
• Passwords are stored only as bcrypt hashes. Access keys for Devin Server are scoped to your team.
• In Devin 2, Devin Server makes outgoing connections to Devin Cloud. Your FileMaker Server does not need to accept incoming connections from the internet.
• Access to production systems is limited to authorised staff who need it, and access rights are removed when they are no longer needed.
• Automated daily backups of the Devin Cloud database, kept for 7 days. Remote backups are stored with Amazon Web Services in the EU.
• Security updates are applied regularly. Changes to Devin Cloud are tested automatically before release.
• Staff are bound by confidentiality and trained in data protection.

Annex 3: Sub-processors