Terms and policies

Draft, not yet published

Data Processing Agreement

Draft for legal review. Keeta Workspace prepared this draft, and it has not yet been reviewed by counsel. Text in [square brackets] needs a decision from counsel. Remove this note when the document is published.

Last updated: [date of publication]

This Data Processing Agreement (the DPA) forms part of the Terms of Service, or any other agreement under which Keeta provides Keeta Workspace (the Agreement), between Keeta, Inc. (Keeta) and the customer that agreed to it (Customer). It applies whenever Keeta processes Customer Personal Data in providing Workspace. It needs no signature: it takes effect when the Agreement does. A customer that wants a countersigned copy can ask at support@keeta.ai.

1. Definitions

  • Data Protection Laws means all laws on the processing of personal data that apply to a party's processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (GDPR), the GDPR as it forms part of UK law with the UK Data Protection Act 2018 (UK GDPR), the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended (CCPA), and other US state privacy laws.
  • Customer Personal Data means personal data in Customer Data (as the Terms of Service define it) that Keeta processes for Customer in providing Workspace.
  • Subprocessor means a third party Keeta engages to process Customer Personal Data.
  • Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • Standard Contractual Clauses or SCCs means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
  • Controller, processor, data subject, personal data, processing and supervisory authority have the meanings Data Protection Laws give them; under the CCPA, "business" and "service provider" correspond to controller and processor.

2. Roles and scope

2.1 Customer is the controller (or a processor acting for its own controllers) of Customer Personal Data, and Keeta is its processor (or subprocessor). Annex 1 describes the processing.

2.2 Keeta is a controller of the personal data it processes to run its own business, such as account, billing and usage data, as its Privacy Policy describes. This DPA does not cover that data.

2.3 Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for the personal data it chooses to put into Workspace, to send to agents and models, or to bring in from connected tools.

3. Processing on instructions

3.1 Keeta processes Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Keeta tells Customer first unless the law forbids it. The Agreement, this DPA, and Customer's use and configuration of Workspace (including which agents, models and tools it connects and what it asks them to do) are Customer's complete instructions. Other instructions need written agreement.

3.2 Keeta tells Customer if it believes an instruction breaks Data Protection Laws.

3.3 Keeta does not sell or share Customer Personal Data (as the CCPA uses those words), does not retain, use or disclose it for any purpose other than providing Workspace, or outside the direct business relationship with Customer, and does not combine it with personal data from other sources except as Data Protection Laws allow a service provider. Keeta does not use Customer Personal Data to train AI models.

4. Keeta's people

Keeta grants access to Customer Personal Data only to staff who need it to provide, secure or support Workspace, who are bound by confidentiality, and who are trained in data protection. Keeta's operators work in a separate console that the database itself limits to counts and account metadata; they cannot read the content of Customer's work, and every look is recorded in an append-only audit log. Content is accessed only when Customer asks for support or the law requires it.

5. Security

5.1 Keeta implements and maintains the technical and organizational measures in Annex 2, appropriate to the risk. Keeta may update them, as long as the overall level of protection does not go down.

5.2 Customer is responsible for its own security choices in Workspace: who it invites, the roles it gives, its sign-in setup, keeping agent keys and connect links secret, which agents and computers it connects, and which teams it marks confidential.

6. Subprocessors

6.1 General authorization. Customer authorizes Keeta to use Subprocessors. The current list, with what each processes, when, and where for each data region, is on the Trust page, which forms Annex 3.

6.2 Changes. Keeta will give at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating the Trust page and notifying Customer by email or in Workspace [Counsel: confirm the subscription mechanism]. Customer may object on reasonable data protection grounds within that period. The parties will then discuss it in good faith; if they can't resolve it, Customer may terminate the affected part of the Service and receive a refund of prepaid, unused amounts for it.

6.3 Obligations. Keeta imposes on each Subprocessor, by written contract, data protection obligations no less protective than this DPA, and remains liable for its Subprocessors' performance as for its own.

6.4 What Customer connects is not a Subprocessor. Agents Customer runs on its own computers and accounts, model providers Customer contracts with directly, tools Customer connects (such as GitHub, Slack, Notion, Google or DocuSign) under its own accounts, and other organizations' computers that run work Customer chose to send under the Spare Cycles Terms, act on Customer's instructions under Customer's own arrangements, not as Keeta's Subprocessors. Where the Trust page lists a tool, it describes Keeta's own processing in connecting to it.

7. Data subject requests

Workspace lets Customer find, export, correct and delete Customer Personal Data itself: the owner can export the organization's data, people can download and erase their own, and admins can remove members. Where Customer can't do something itself, Keeta will help with reasonable measures. If Keeta receives a request from a data subject about Customer Personal Data, it will pass it to Customer and will not answer it except to say so, unless the law requires otherwise.

8. Security Incidents

8.1 Keeta will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident, at the owner's email and in Workspace.

8.2 The notice will describe, as far as Keeta then knows, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Keeta will add information as it learns more, take reasonable steps to contain and remedy the incident, and help Customer meet its own notification duties.

8.3 Notifying a Security Incident is not an admission of fault.

9. Impact assessments and consultation

Keeta will give Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities about Workspace, taking into account the information available to Keeta.

10. Deletion and return

10.1 During the Agreement, Customer can export all of its data and delete it at any time.

10.2 When the Agreement ends, Keeta deletes Customer Personal Data as the Terms of Service describe: at once from the live service when the organization is deleted, and from backups within 30 days, unless the law requires Keeta to keep some of it, in which case Keeta keeps it confidential and processes it only for that purpose. Customer may export its data before then.

11. Audits

11.1 Keeta will make available to Customer the information reasonably needed to show compliance with this DPA, including on request a completed security questionnaire and, once available, Keeta's SOC 2 Type II report, under confidentiality.

11.2 If that information is not enough to meet a requirement of Data Protection Laws or a supervisory authority, Customer may audit Keeta's compliance, once a year unless a supervisory authority requires more or after a Security Incident, with at least 30 days' notice, during business hours, by Customer or an independent auditor bound by confidentiality, in a way that does not disrupt Keeta's operations or compromise other customers' data. Customer pays its own costs. The parties will agree the scope in advance.

12. International transfers

12.1 Where data is kept. Customer chooses at sign-up whether its organization's data lives in the United States region (Google Cloud, Iowa) or the European Union region (Google Cloud, Belgium). Keeta keeps Customer Personal Data in that region, apart from the Subprocessor processing the Trust page names for it.

12.2 EU transfers. To the extent Keeta, in the United States, or a Subprocessor processes Customer Personal Data subject to the GDPR outside the European Economic Area, in a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA, with Customer as data exporter and Keeta as data importer, as follows:

  • Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor;
  • Clause 7 (docking clause) applies;
  • Clause 9: Option 2 (general written authorization) applies, with the notice period in section 6.2;
  • Clause 11: the optional language does not apply;
  • Clause 13: the supervisory authority is the one competent for Customer, or, where Customer has no establishment in the EU, the one in the Member State where its representative is established [or, if none, the Irish Data Protection Commission];
  • Clause 17: the SCCs are governed by the law of Ireland;
  • Clause 18: disputes are resolved by the courts of Ireland;
  • Annex I is Annex 1 of this DPA, Annex II is Annex 2, and Annex III is the list in Annex 3.

12.3 UK transfers. For personal data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies, completed with the information in this DPA; either party may end it as its Section 19 allows.

12.4 Swiss transfers. For personal data subject to the FADP, the SCCs apply with these changes: the competent authority is the Swiss Federal Data Protection and Information Commissioner, references to Member States include Switzerland so data subjects there can bring claims in their place of habitual residence, and references to the GDPR mean the FADP.

12.5 Other transfer frameworks. If Keeta is certified under the EU-US Data Privacy Framework (or its UK and Swiss extensions), Keeta may rely on it instead, and the SCCs then apply only if it stops being valid. [Counsel: confirm whether Keeta will self-certify.]

12.6 Government access. Keeta will resist requests from public authorities for Customer Personal Data that are not legally binding, will tell Customer of a binding request unless forbidden, and will give only the minimum the request requires. Keeta has not received any such request to date.

12.7 Precedence. If the SCCs conflict with this DPA, the SCCs prevail.

13. Liability

Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the SCCs do not allow those limits.

14. General

This DPA lasts as long as Keeta processes Customer Personal Data. If it conflicts with the Agreement, this DPA prevails on data protection. Keeta may update this DPA to reflect changes in law or in Workspace, with notice as the Terms of Service describe; no update will lower the protection of Customer Personal Data.

Annex 1: Description of the processing

Data exporter: Customer, as identified in its Workspace account. Contact: the organization's owner. Role: controller or processor.

Data importer: Keeta, Inc., [registered address], support@keeta.ai. Role: processor or subprocessor.

Activities: providing Keeta Workspace under the Agreement.

Categories of data subjects: Customer's members and invitees; and people whose personal data appears in Customer Data, such as Customer's employees, contractors, customers, prospects, partners and correspondents, as Customer decides.

Categories of personal data: names, email addresses, roles and other contact and professional details; content of tasks, projects, knowledge, files, messages, decisions, code and documents; content brought in from connected tools (such as repositories, issues, pull requests, Slack messages in linked channels, linked Notion pages and Drive files, emails under Workspace's shared Gmail label, calendar events, CRM records, signature envelopes); and activity records within the organization.

Special categories of data: none intended. Customer should not put special category data or criminal offence data into Workspace unless it has a lawful basis and has configured Workspace appropriately (for example, a confidential team). If it does, the measures in Annex 2 apply.

Frequency: continuous, for as long as Customer uses Workspace.

Nature of the processing: hosting, storage, organization, retrieval and search, transmission to agents, models and tools Customer chooses, display, export and deletion.

Purpose: providing, securing and supporting Workspace for Customer as the Agreement describes.

Duration and retention: the term of the Agreement, then deletion as section 10 describes.

Transfers to Subprocessors: as listed in Annex 3, for the purposes stated there, for the duration of the Agreement.

Annex 2: Technical and organizational measures

Isolation

  • Every organization's data is kept apart by row-level security in the database itself, not only by the application. Daily automated checks confirm every table holding organization data has it.
  • Each data region is a separate deployment with its own database, file storage, backups, logs and secrets. Nothing is shared between regions.
  • Teams can be marked confidential, so their work is hidden from organization admins outside the team.

Access control

  • People sign in with Google, a passkey, or the organization's SAML identity provider; SCIM can provision and remove them.
  • Roles (owner, admin, member) and team membership limit what each person and agent can read. Each agent acts for a person and reads only what that person may read.
  • Risky actions, such as merging, can require approval with a passkey.
  • Keeta operators sign in separately with Google and a passkey, in sessions of at most 8 hours. Their database role can read no table and can only call functions that return counts and account metadata. Every operator read is written to an append-only audit log kept 24 months.

Encryption

  • All traffic is encrypted in transit with TLS.
  • Data at rest is encrypted by Google Cloud. Tool credentials and team secrets are also encrypted by Workspace with a separate key held in Secret Manager.

Availability and resilience

  • Daily backups, with point-in-time recovery to any moment of the last 7 days. Restores are tested in recorded drills.
  • Backups age out within 30 days.

Logging and monitoring

  • Each organization has an append-only activity trail of changes. Application logs are kept 400 days in the region.
  • Daily compliance checks cover organization isolation, operator isolation, append-only logs, retention and backups.

Secure development and change management

  • Every change goes through a pull request with automated tests and checks before it merges, and deploys only from the main branch through CI.
  • Dependencies are audited for known vulnerabilities on every change.

AI and agents

  • Model calls Keeta makes go through OpenRouter only to providers that neither keep nor train on what they are sent. The EU region uses OpenRouter's EU endpoint.
  • Values kept in Lockbox are scanned out of agent output, and agents get team secrets only where a team allows it.
  • Hosted Agents run in a separate sandbox for each session.

Incident response and vendor management

  • A documented incident response process, with customer notice within 72 hours.
  • Subprocessors are reviewed every year and bound by data protection terms.

People

  • Staff with access are bound by confidentiality, trained in security and data protection when they join and every year, and lose access when they leave; access is reviewed periodically.

Annex 3: Subprocessors

The list of Subprocessors, with the purpose, data categories, when each is used, and where each processes data for each region, with the transfer basis, is maintained at keeta.ai/trust.