Data processing addendum
Last updated: 21 October 2026
This data processing addendum ("DPA") forms part of the terms of service between StackTether ("StackTether", "Processor") and the customer ("Customer", "Controller"). It applies when StackTether processes personal data on the Customer's behalf. Where the Customer is itself a processor for its own clients (as an MSP usually is), StackTether acts as the Customer's subprocessor, and "Controller" below includes the Customer acting for its clients.
1. Definitions
"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the terms, which may include the EU GDPR, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws. "Customer Personal Data" means personal data in Customer Data that StackTether processes for the Customer. Terms such as "personal data", "processing", "controller", "processor", "service provider" and "personal data breach" have the meanings given in the Data Protection Laws.
2. Details of the processing
| Subject matter | Providing the StackTether Service: connecting the Customer's vendor systems to the AI apps the Customer allows, and the portal, security controls and audit log that go with it. |
|---|---|
| Duration | The term of the agreement, plus the deletion periods in section 9. |
| Nature and purpose | Storing vendor credentials; reading records from the Customer's vendor systems when the Customer's users ask through an AI app; filtering, shortening and returning those records to that AI app; recording audit metadata; providing support and security. |
| Categories of data subjects | The Customer's users (staff); the Customer's clients and their staff and contacts whose details are in the Customer's vendor systems; any other person named in records in those systems (for example in ticket text). |
| Categories of personal data | Names, work contact details (email, phone), job titles, client and company names, business addresses, device and asset details (names, serial numbers, IP addresses), ticket and note text, time entries, technician names, user account and sign-in data, audit metadata (user, time, IP address, tool, outcome, record IDs). |
| Special categories and sensitive data | Not intended, but possible: free text in tickets and notes may contain anything the Customer's clients wrote, including health information (for example from medical or dental clients) or other sensitive data. StackTether's data rules hide structured fields such as passwords, payment and bank details, dates of birth and government ID numbers, but cannot detect everything in free text. StackTether does not currently sign HIPAA business associate agreements; the Customer must not use the Service where one is required. |
| Frequency | Continuous, on each request from the Customer's users and AI apps. |
| Retention | Vendor records are not stored; they pass through, except lookup lists (such as status and technician names) kept in server memory for at most 15 minutes. Audit and security logs: 1 year. Vendor credentials: until the connection is removed or the account is deleted. Other periods: see the privacy policy. |
3. Processing on instructions
- StackTether processes Customer Personal Data only on the Customer's documented instructions. The terms, this DPA and the Customer's use and configuration of the Service (for example which vendors are connected, which users have access and which AI apps are allowed) are the Customer's instructions.
- StackTether will tell the Customer if it believes an instruction breaks Data Protection Laws, unless the law forbids it.
- Under the CCPA and similar US laws, StackTether is a service provider (or processor). It will not sell or share Customer Personal Data, use it for targeted advertising, keep, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, or combine it with personal data from other sources except as the law allows. StackTether will comply with those laws and tell the Customer if it can no longer meet them.
- StackTether does not use Customer Personal Data to train AI models.
4. AI apps chosen by the Customer
When the Customer allows an AI app and its user approves the connection, StackTether sends tool answers to that AI app at the user's request. The AI app's vendor is chosen by and contracted with the Customer; it is not StackTether's subprocessor, and StackTether is not responsible for its processing. The Customer controls this with the per-business and per-person AI app switches, and can disconnect any AI app at any time.
5. Confidentiality of personnel
StackTether ensures that anyone it authorizes to process Customer Personal Data is bound by confidentiality and has access only as needed to provide, secure or support the Service.
6. Security measures
StackTether maintains technical and organizational measures appropriate to the risk, including:
- Access control: invite-only accounts; two-factor authentication required for every user and enforced in the database; per-person vendor access chosen by the Customer's admins (default: none); separate admin, technician and platform roles; step-up two-factor checks for sensitive actions; password lockouts and rate limits; a captcha on sign-in forms.
- Tenant isolation: each customer's data is separated by row-level security in the database, tested automatically; the tenant is always taken from the verified sign-in, never from a request's contents; the database only answers requests that come through StackTether's own servers.
- Credentials: vendor credentials stored encrypted in a secrets vault, written only after a successful test, never shown again and never sent to AI apps or written to logs.
- AI connections: OAuth 2.1 sign-in with a consent step under two-factor authentication; only allow-listed AI apps; short-lived tokens (15 minutes); approvals that expire and idle cut-offs; network pinning where an AI vendor publishes its addresses; call limits per user and per customer; an unusual-activity guard that warns, slows or pauses access; kill switches per customer and platform-wide.
- Data minimization: read-only tools; a data policy that hides sensitive fields before data reaches an AI app; output limits; vendor text marked as data, not instructions; error messages that never include vendor text or credentials.
- Encryption: TLS for data in transit (HTTPS with HSTS); encryption at rest by our hosting providers.
- Logging and monitoring: an append-only audit record of every tool call (metadata and record IDs only, never content), plus admin, platform and sign-in logs, kept 1 year; email notices to admins about security events.
- Secure development: automated tests for security rules on every change, code review, dependency checks, and security scans; secrets are never stored in source code.
- Resilience: managed hosting with backups provided by our database provider.
StackTether may update these measures as long as the overall level of protection is not reduced.
7. Subprocessors
- The Customer gives general authorization for StackTether to use the subprocessors listed on our subprocessors page.
- StackTether will give at least 30 days' notice of a new subprocessor by updating that page and notifying the Customer's admins. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may end the affected Service and receive a refund of prepaid fees for the remaining period.
- StackTether imposes data protection terms on each subprocessor that are at least as protective as this DPA, and remains responsible for its subprocessors' performance.
8. Personal data breaches
StackTether will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences, and the steps taken or proposed. StackTether will update the Customer as it learns more and will reasonably help the Customer meet its own notification duties. A notice is not an admission of fault.
9. Deletion and return
- While the agreement is in force, the Customer's admins can remove vendor connections (which deletes their stored credentials) and remove users.
- When the Customer's account is closed, StackTether deletes the Customer's data (users, vendor connections, credentials and settings) 30 days later, unless the Customer reopens the account in that time. Logs are deleted when their 1-year retention ends. Copies in backups are deleted when those backups expire.
- Before closing, the Customer's admins can view the audit log in the portal. Export tools will be offered when available; until then StackTether will provide a copy of the Customer's audit log on request through our contact form.
- StackTether may keep data where the law requires, protected under this DPA.
10. Assistance and data subject requests
StackTether will reasonably help the Customer respond to requests from data subjects and meet its obligations on security, breach notification, data protection impact assessments and consultations with authorities, taking into account the nature of the processing. If StackTether receives a request from a data subject about Customer Personal Data, it will pass it to the Customer and not respond itself, except to direct the person to the Customer.
11. Audits
StackTether will make available the information reasonably needed to show compliance with this DPA, including its security documentation and the results of independent security testing when available. If that is not enough, the Customer may carry out an audit, at most once a year (or after a breach, or when a regulator requires it), with at least 30 days' notice, during business hours, at its own cost, without access to other customers' data, and under confidentiality. StackTether does not currently hold a SOC 2 or ISO 27001 certification.
12. International transfers
StackTether processes Customer Personal Data in the United States. Where Customer Personal Data subject to the EU GDPR, UK GDPR or Swiss law is transferred to StackTether, the parties agree to the European Commission's Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor, as applicable), with the UK International Data Transfer Addendum and Swiss amendments where needed, which are incorporated into this DPA by reference. The completed annexes for these clauses (the parties, the description of the transfer and the security measures in section 6 of this DPA) are available on request through our contact form.
13. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the terms, unless the Data Protection Laws do not allow it. If this DPA conflicts with the terms, this DPA controls for the processing of Customer Personal Data; the Standard Contractual Clauses control over both where they apply.