Data processing addendum

Roles and instructions

The customer is the controller of personal data in its workspaces, repositories, chats and Rooms (“customer data”), and CoDev is its processor. CoDev processes customer data only to provide the service, following the customer's documented instructions: the terms, the customer's use and settings in the product, and written requests. We tell the customer if we believe an instruction breaks the law.

Confidentiality and staff access

Everyone at CoDev who can access customer data is bound by confidentiality. Their access is limited by our staff access policy, which also governs records of access, notice to the customer and requests from governments and courts.

Security

We maintain the technical and organizational measures described on the Security and privacy page, including encryption of saved credentials with managed keys, isolated accounts for agents and Git pushes, least-privilege access for workspace processes and an audit log of administrator changes. We may improve these measures but will not materially weaken them.

Subprocessors

The customer authorizes CoDev to use these subprocessors. Each is bound by written terms that protect customer data at least as well as this addendum, and CoDev remains responsible for them.

• Microsoft Azure: Hosting the web app, workspace machines and disks, Redis and key management
• Supabase: PostgreSQL database (hosted on Amazon Web Services)
• Cloudflare: Network proxy, DNS and workspace lifecycle jobs
• Anthropic: AI models paid with CoDev credits; classifying error reports
• OpenAI: AI models paid with CoDev credits
• GitHub: Repository access and filing bug reports and feedback
• Stripe: Payments and invoices
• Resend: Transactional email
• ImprovMX: Forwarding inbound support email

We update this list at least 30 days before a new subprocessor starts handling customer data and email customers who ask to be notified. A customer may object on reasonable data-protection grounds; if we cannot address the objection, the customer may end the affected service and receive a refund of prepaid fees for it.

AI providers, Git hosts and other services the customer or its members connect with their own accounts act under the customer's own terms with them, not as CoDev's subprocessors.

Assistance and requests

We help the customer answer requests from people exercising their data rights, carry out data-protection impact assessments and consult regulators, as far as the nature of the service allows. If a person asks CoDev directly about customer data, we refer them to the customer.

Security incidents

We notify the customer without undue delay, and no later than 72 hours after confirming a security incident affecting customer data, with what we know about its nature, the data involved, its likely consequences and the steps taken. We update the customer as we learn more and help it meet its own notification duties.

Deletion and return

The customer can export its work and delete workspaces and accounts at any time, as described in data retention. When the service ends, we delete customer data from active systems, and from backups as they expire, unless the law requires us to keep it.

Audits

We make available the information needed to show compliance with this addendum: this page, the Security and privacy page, answers to a reasonable security questionnaire once a year, and independent audit reports once we have them. Where the law requires more, the customer may audit with 30 days' notice, at its own cost, under confidentiality.

International transfers

CoDev and its subprocessors process customer data in the United States and other countries. For personal data from the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (modules two and three), the UK International Data Transfer Addendum and the Swiss amendments apply where needed and are incorporated by reference.

Details of processing

• Purpose: hosting workspaces, running agents and collaboration features, and related support and billing.
• Duration: while the customer uses the service, and until deletion as described above.
• People: the customer's members, collaborators, and anyone whose information appears in its code, chats or files.
• Data: account details, source code, files, chats, prompts, agent output, terminal and Git activity, and anything else the customer puts into the service.

Precedence

If this addendum conflicts with the terms of service on the processing of customer data, this addendum prevails. Liability under it is subject to the terms of service.