Some company details on this page are still placeholders in [brackets]. The operator sets them in the server configuration.
Data processing agreement
Under Article 28 GDPR. Effective 2026-11-09
This agreement is between the customer named in the team's account ("controller") and [Company name and legal form], [Street and number, postcode, city, country] ("processor"). It forms part of the terms of service and applies as long as the processor processes personal data for the controller.
1. Subject, duration, nature and purpose
Subject: hosting and operating Standdown, an asynchronous update tool, for the controller's team.
Duration: the term of the contract, plus the deletion period in section 9.
Nature and purpose: storing, transcribing, summarising and displaying team members' updates; creating tasks and digests; sending emails, chat messages and tasks to services the controller connects.
2. Personal data and data subjects
Data subjects: the controller's team members and invited people; people mentioned in updates.
Types of data: names, work email addresses, roles, time zones; written updates; voice and video recordings and their transcripts; tasks, blockers and who is waiting on whom; usage records (days active); technical logs.
The controller will not upload special categories of personal data under Art. 9 GDPR.
3. Instructions
The processor processes personal data only on documented instructions from the controller. The contract, this agreement and the controller's use of the service's settings are the controller's instructions. If the processor believes an instruction infringes data protection law, it informs the controller without delay. The processor processes data outside these instructions only where EU or member-state law requires it, and informs the controller beforehand unless that law prohibits it.
4. Confidentiality
The processor ensures that everyone authorised to process the personal data is bound to confidentiality.
5. Security
The processor implements the technical and organisational measures in Annex 2 and keeps them up to date with the state of the art (Art. 32 GDPR). It may replace measures with equivalent or better ones.
6. Sub-processors
The controller gives general authorisation for the sub-processors in Annex 1. The processor informs the controller by email at least 30 days before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds within that period; if no solution is found, the controller may terminate the affected service. The processor imposes data protection obligations on each sub-processor that are no less protective than this agreement, and remains liable for them.
Transfers to countries outside the EU/EEA take place only under Chapter V GDPR, in particular based on an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.
7. Assistance
Taking into account the nature of the processing, the processor assists the controller with:
- responding to data subject requests (Arts. 15–22 GDPR), in particular through the export and deletion functions in the service;
- security, breach notification, data protection impact assessments and prior consultation (Arts. 32–36 GDPR).
The processor forwards data subject requests it receives to the controller.
8. Personal data breaches
The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data. The notice includes the information available under Art. 33 (3) GDPR.
9. Deletion and return
The controller can export its data at any time. When the team is deleted or the contract ends, the processor deletes the controller's personal data within 30 days, including backups within their regular rotation of no more than 30 further days, unless law requires storage. Recordings are deleted automatically 90 days after upload.
10. Audits
The processor makes available the information needed to demonstrate compliance with this agreement. The controller may carry out audits, including inspections, after reasonable notice, during business hours and without disrupting operations, or have them carried out by an auditor bound to confidentiality. The processor may charge reasonable costs for audits beyond one per year unless there are indications of a breach.
11. Liability and precedence
Liability follows Art. 82 GDPR and the terms of service. If this agreement conflicts with the terms of service on data protection, this agreement prevails.
Annex 1: Sub-processors
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, database, recordings | Finland (EU) | Not applicable (within the EU) |
| Anthropic, PBC, San Francisco, USA | Task extraction and weekly brief (model claude-sonnet-5-5) | USA | Standard contractual clauses |
| OpenAI, L.L.C., San Francisco, USA | Speech-to-text for recordings | USA | Data Privacy Framework or standard contractual clauses |
| Resend, Inc., San Francisco, USA | Transactional and digest emails | USA | Data Privacy Framework or standard contractual clauses |
| Stripe Payments Europe, Ltd., Dublin, Ireland | Billing data only (no team content) | EU / USA | Data Privacy Framework |
Anthropic and the transcription provider receive data only for teams on plans with AI and recording features. Services the controller connects itself (Slack, Microsoft Teams, Jira, Linear, Asana) are not sub-processors of the processor; the controller instructs the transfer to them.
Annex 2: Technical and organisational measures
Confidentiality
- Servers in an ISO 27001-certified data centre with access control, video surveillance and staff on site.
- Administrative access only through SSH keys, for named people, with the principle of least privilege.
- Passwords stored as salted scrypt hashes; sessions as random tokens, stored only as SHA-256 hashes.
- Credentials for connected tools encrypted at rest with AES-256-GCM.
- Each team's data is separated logically; every request checks that the signed-in user belongs to the team.
- Recordings are served only to signed-in members of the owning team.
Integrity
- All connections encrypted with TLS; HTTP Strict Transport Security enabled.
- Content Security Policy, frame protection and request-origin checks against cross-site attacks.
- Inputs validated on the server; outgoing requests to customer-entered URLs restricted to public HTTPS addresses.
Availability and resilience
- Daily database backups kept for 30 days and copied to storage separate from the production server.
- Monitoring of the health endpoint; operating system security updates applied promptly.
Data minimisation and deletion
- Recordings deleted automatically after 90 days; unattached uploads after 24 hours.
- Account and team deletion available to customers in the product.
- No tracking or advertising cookies.
Review
- Measures are reviewed at least once a year and after any security incident.