Data processing addendum

Contents

• 1. Scope, incorporation, and order of precedence
• 2. Definitions
• 3. Roles of the parties
• 4. Processing on documented instructions
• 5. Confidentiality of personnel
• 6. Security measures
• 7. Subprocessors
• 8. Assistance with data subject requests and assessments
• 9. Personal data breach notification
• 10. Return and deletion
• 11. Audits and information
• 12. Location of processing and international transfers
• 13. CCPA service provider terms
• 14. Liability
• 15. Term
• Annex 1: Details of processing
• Annex 2: Technical and organizational measures
• Annex 3: Subprocessors
• Contact

1. Scope, incorporation, and order of precedence

This DPA is between Tovio, LLC and the customer that has accepted the Terms of Service. It forms part of the Terms and is accepted together with them. It needs no separate signature and applies to every customer.

This DPA applies when Tovio processes Customer Personal Data on the customer's behalf in providing TOVIO Cloud, to the extent Data Protection Laws apply to that processing.

The TOVIO client software (the CLI, desktop app, IDE extensions, MCP server, and SDKs) runs on the customer's own machines. This DPA does not cover data that the client software processes on those machines and does not send to TOVIO Cloud.

If this DPA conflicts with the rest of the Terms, this DPA controls with respect to the processing of Customer Personal Data. On every other matter, the rest of the Terms control, including their order of precedence. Tovio may update this DPA in the same way it updates the Terms.

2. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Terms. In this DPA:

• "Data Protection Laws" means, to the extent each applies to the processing: the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the GDPR as it forms part of the law of the United Kingdom, together with the UK Data Protection Act 2018 ("UK GDPR"); and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA").
• "Service" means TOVIO Cloud, the hosted commercial service of Tovio, LLC, including the hosted Forge at forge.tovio.dev and the dashboard at app.tovio.dev.
• "Customer Content" means the repository content and history, AI session transcripts, and other data that the customer, its users, or AI agents it authorizes submit to the Service.
• "Customer Personal Data" means the personal data described in Annex 1 that Tovio processes on the customer's behalf in providing the Service.
• "Subprocessor" means a third party that Tovio engages and that processes Customer Personal Data.
• GDPR terms: "controller," "processor," "data subject," "personal data," "personal data breach," "processing," "special categories of personal data," and "supervisory authority" have the meanings given in the GDPR or the UK GDPR, as applicable.
• CCPA terms: "business," "business purpose," "consumer," "personal information," "sell," "service provider," and "share" have the meanings given in the CCPA. Where the CCPA applies, "personal data" includes "personal information."

3. Roles of the parties

Customer as controller

For Customer Personal Data, the customer is the controller. If the customer acts as a processor for another controller, the customer confirms that the controller has authorized the customer's instructions to Tovio, and Tovio acts as the customer's subprocessor.

Tovio as processor and service provider

For Customer Personal Data, Tovio is the customer's processor and, where the CCPA applies, its service provider.

Tovio as controller

Tovio is the controller of the personal data it collects to run its own business, including account identifiers (email address, handle, and the identity-provider identifiers used for sign-in), sign-in credentials and sessions, device public keys, IP addresses and security audit records, billing identifiers, and website and dashboard analytics. The Privacy policy governs that data, not this DPA.

Customer responsibilities

The customer is responsible for having a lawful basis for the Customer Personal Data it submits, for giving any notices it must give to data subjects, and for making sure its instructions comply with Data Protection Laws.

The client software captures AI session transcripts by default when a commit is made and syncs them with the repository. The customer can turn capture off with the provenance.observed_capture = off setting, or for a single commit with the --no-session flag. The customer decides whether transcripts are captured and sent to the Service, and is responsible for informing its users.

4. Processing on documented instructions

Tovio processes Customer Personal Data only on the customer's documented instructions. The customer's documented instructions are the Terms, this DPA, and the customer's use and configuration of the Service, including actions taken by its users, administrators, and the AI agents it authorizes.

Tovio may process Customer Personal Data otherwise only where the law that applies to Tovio requires it. In that case, Tovio will tell the customer about that legal requirement before processing, unless that law prohibits it.

Tovio will tell the customer promptly if, in its opinion, an instruction infringes Data Protection Laws. Instructions beyond those described in this section require written agreement between the parties.

5. Confidentiality of personnel

Tovio ensures that the persons it authorizes to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Tovio limits access to Customer Personal Data to persons who need it to provide the Service.

6. Security measures

Tovio implements the technical and organizational measures described in Annex 2 to protect Customer Personal Data, as required by Article 32 of the GDPR. Tovio may change these measures as long as the change does not materially reduce the overall security of the Service.

The customer is responsible for the security of its own use of the Service. This includes protecting its account credentials, devices, and recipient keys; choosing which repository paths are policy-protected; managing access grants; and choosing its transcript capture settings. The shared-responsibility model describes how these responsibilities divide.

7. Subprocessors

General authorization

By accepting the Terms, the customer gives Tovio general written authorization to engage Subprocessors to process Customer Personal Data.

Obligations of Subprocessors

Tovio will impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, to the extent they apply to the services the Subprocessor provides. Tovio remains responsible to the customer for each Subprocessor's performance of those obligations, subject to Section 14.

Subprocessor list and changes

Tovio publishes its Subprocessors on the subprocessors page. When Tovio adds a Subprocessor, it updates that page. Tovio does not give advance notice of changes, and this DPA gives the customer no right to object to a change. The customer can review the page at any time.

8. Assistance with data subject requests and assessments

Data subject requests

Taking into account the nature of the processing, Tovio will give the customer reasonable assistance, through appropriate technical and organizational measures where possible, in responding to requests from data subjects to exercise their rights under Data Protection Laws. The customer can retrieve Customer Content at any time with the client software.

If Tovio receives a request directly from a data subject about Customer Personal Data, Tovio will tell the data subject to contact the customer. Tovio will not otherwise respond to the request unless the law requires it.

Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to Tovio, Tovio will give the customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that relate to the customer's use of the Service. Tovio will generally do this by providing information about the Service, including this DPA and its annexes.

9. Personal data breach notification

Tovio will notify the customer of a personal data breach affecting Customer Personal Data without undue delay and no later than 72 hours after becoming aware of it. Tovio will send the notification to contact details associated with the customer's account.

To the extent the information is known, the notification will describe the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and reduce its effects; and a contact point for more information. Where Tovio cannot provide all of this information at once, it may provide it in phases without undue further delay.

Tovio will take reasonable steps to contain and investigate the breach. A notification under this section is not an admission of fault or liability.

The customer is responsible for any notifications it must make to supervisory authorities or data subjects. The customer should report any suspected security incident involving the Service to security@tovio.dev.

10. Return and deletion

Return

While the customer has access to the Service, including before it closes its account or its subscription ends, it can retrieve its repository content and history, including attached AI session transcripts, with the TOVIO client software, for example by cloning or syncing a repository to its own machines. Tovio does not provide a separate self-service export.

Deletion

Closing an account ends access and revokes active sessions. To have Customer Personal Data deleted, the customer emails privacy@tovio.dev. Tovio completes deletion within 30 days of the request, subject to legal holds and to records Tovio must keep for billing, tax, security, or legal obligations.

Any Customer Personal Data that Tovio keeps under those exceptions remains subject to this DPA, and Tovio processes it only for the purpose for which it is kept. Security audit records, which Tovio holds as a controller, are handled under the Privacy policy.

Separately, the Service includes an obliterate operation that removes content and leaves a tombstone record, and for which an organization can require step-up confirmation. Unreachable repository history is removed after the plan's history period (90 days on Free, 180 days on Personal, 365 days on Business, and 730 days on Enterprise), unless an open proposal still references it or a legal hold applies.

11. Audits and information

Tovio will make available to the customer the information necessary to demonstrate compliance with Article 28 of the GDPR and the UK GDPR, including this DPA and its annexes. The customer may request this information by emailing privacy@tovio.dev.

Tovio will allow for and contribute to audits, including inspections, conducted by the customer or another auditor mandated by the customer. The customer must give reasonable written notice to legal@tovio.dev. Audits are at the customer's cost and are limited to what is necessary to verify Tovio's compliance with this DPA.

Any auditor must be bound by appropriate confidentiality obligations. Audits must be carried out in a way that does not compromise the security of the Service or the data of other customers.

12. Location of processing and international transfers

Tovio, LLC is based in the United States. The Service runs on Cloudflare. Repository objects are stored in Cloudflare R2 buckets created with a location hint for eastern North America; Cloudflare applies that hint when a bucket is created and does not guarantee it. Other Service data is held in Cloudflare Durable Objects with no jurisdiction restriction, and requests are handled at Cloudflare data centers on its global network, which may be outside the United States. Subprocessors process data as described on the subprocessors page. By using the Service, the customer instructs Tovio to process Customer Personal Data in these locations.

This DPA does not include a mechanism for transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland. The customer is responsible for determining whether its use of the Service meets the transfer rules that apply to it.

13. CCPA service provider terms

Where the CCPA applies to Customer Personal Data, Tovio acts as a service provider, and the business purpose for processing is providing the Service under the Terms and this DPA. Tovio will not:

• sell or share Customer Personal Data;
• retain, use, or disclose Customer Personal Data for any purpose other than that business purpose, including any commercial purpose other than providing the Service, or as the CCPA otherwise permits;
• retain, use, or disclose Customer Personal Data outside the direct business relationship between Tovio and the customer; or
• combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits.

Tovio will comply with the obligations that apply to it under the CCPA and will provide the same level of privacy protection the CCPA requires. Tovio will notify the customer if it determines that it can no longer meet its obligations under the CCPA. On notice, the customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

15. Term

This DPA takes effect when the customer accepts the Terms. It remains in effect for as long as Tovio processes Customer Personal Data, including after the Terms end. The governing law and dispute resolution provisions of the Terms apply to this DPA.

Annex 1: Details of processing

Annex 2: Technical and organizational measures

This annex describes the measures that are built into the Service today. It does not describe measures that have not been built.

Encryption and integrity

• Client-side encryption of protected paths: When the customer marks a repository path as policy-protected, the client software encrypts its content before it enters a tracked snapshot. Content is encrypted with AES-256-GCM, and its data-encryption key is wrapped to each authorized recipient's X25519 key. Recipient private keys are kept in the client keystore on the customer's devices, not in synced storage. The Service stores content in protected paths as ciphertext.
• Transcripts: Before a commit stores an AI session transcript, the tovio CLI scans it for secrets and refuses to store it if it finds one. When the commit touches policy-protected paths, the transcript is stored sealed, encrypted to the same recipients as that content.
• Content addressing: Repository objects are identified by their BLAKE3-256 content hash, and the implemented read and receipt paths verify addressed bytes.
• Transport security: Every response from the hosted Forge sets HTTP Strict Transport Security with a one-year maximum age that includes subdomains, along with nosniff, a no-referrer Referrer-Policy, a restrictive Permissions-Policy, and X-Frame-Options DENY. The dashboard and the websites set the same HSTS policy.

Authentication and access control

• Sessions: Sign-in sessions are stored only as a domain-separated BLAKE3 digest, never as the raw token. A session expires after 8 hours without renewal and after at most 30 days in total. Sessions stored in an older raw-token form are treated as expired and removed in bounded passes.
• Personal access tokens: Tokens are stored as a BLAKE3 hash, together with their name, prefix, last four characters, and scopes. A token lasts at most 1 year.
• Step-up confirmation: An organization can require a request-bound passkey (WebAuthn) confirmation for policy changes, access grants and revocations, key rotation, obliteration, capability token issue and revocation, administrator role assignment, member removal, billing changes, and network and MFA policy changes. A request-bound passkey confirmation is always required for platform administrator account-lifecycle actions and identity-provider changes, and for self-service account closure when the account has a registered passkey. When closing its own account, an account without a registered passkey must instead have signed in within the last 5 minutes.
• Network restrictions: A customer organization can set a network policy that restricts repository access by source IP address.
• Operator access: Prelaunch and staging surfaces are restricted through Cloudflare Access to individually named email addresses (operators and, on the staging dashboard, invited testers) and CI service tokens, with no bypass, open-access, or whole-domain rules.

Logging and audit

• Tamper-evident audit log: Audit entries form a per-actor, append-only hash chain in which each entry links to the previous one and is signed. The Service signs administrative and operational entries with its own signing key. Entries record the source IP address of the request.

Abuse prevention and input handling

• Rate limiting: Three layers apply: a web application firewall rule, an edge limit per IP address, and counters kept per authenticated principal, network address, session or token, or account, including a limit on how often access tokens can be issued. Rate limiters are designed to fail open so that a limiter outage does not block the Service.
• Request size limits: Request bodies are capped at 32 MiB, 256 KiB, or 64 KiB depending on the route. These caps fail closed.
• Webhook verification: Incoming payment and directory-sync webhooks are verified with an HMAC over the raw body and a bounded timestamp before they are parsed. If the verification secret is missing, the Service refuses the webhook. Outgoing webhooks to customer endpoints are signed with HMAC-SHA256.

Secrets handling

• Service secrets, including the signing key, payment and directory provider credentials, webhook signing secrets, and the administrative token, are kept in the hosting provider's secret store, not in configuration files, and are not written to logs.
• Administrative surfaces are disabled when their secret is not configured.
• Key material is never stored in the synced object store.
• Error responses do not disclose internal details.

Retention and deletion

• Reachable repository history is kept. Unreachable repository history is removed after the plan's history period (90 days on Free, 180 days on Personal, 365 days on Business, and 730 days on Enterprise), unless an open proposal still references it or a legal hold applies.
• Uploaded data that no repository references is removed after 1 hour, and upload sessions expire after 6 hours.
• Deletion on request is handled as described in Section 10.

Current limits of these measures

• Client-side encryption does not cover repository metadata or content outside policy-protected paths. The policy manifest is readable by design.
• In the Tier-1 model, the Key Authority is trusted to compile policy into the correct recipient set.
• Encryption does not keep plaintext from a user, client, runner, or AI model that is authorized to receive it.
• Backup, restore, storage-loss, and regional-failure exercises on a live account have not yet been completed.
• An independent security review of the Service has not yet been completed.

Annex 3: Subprocessors

Tovio publishes the Subprocessors that process Customer Personal Data on the subprocessors page and updates that page when it adds a Subprocessor, as described in Section 7. The service providers Tovio uses for data it holds as a controller are described in the Privacy policy.

Contact

• Privacy and data protection, including deletion requests: privacy@tovio.dev
• Legal and audit notices: legal@tovio.dev
• Security incidents: security@tovio.dev
• Mailing address: Tovio, LLC, 1300 South Boulevard STE 35425, Charlotte, NC 28203, United States