# Data Processing Addendum

This addendum is part of the [Terms of Service](/legal/terms) between the customer
("you") and Runtime LLC ("Runtime", "we"). It applies automatically, with no
signature, whenever we process personal data for you that is covered by data
protection law. This includes the GDPR, the UK GDPR, the Swiss FADP and United States
state privacy laws. Where it conflicts with the rest of the terms about personal
data, this addendum takes precedence.

## 1. Roles

For personal data inside Your Content ("Customer Personal Data"), you are the
controller, or a processor for your own customers, and we are your processor. You
are responsible for having a lawful basis and for your instructions to us being
lawful. The [Privacy Policy](/legal/privacy), not this addendum, covers data where
we are the controller, such as your account.

## 2. What we do with it

We process Customer Personal Data only on your documented instructions. The terms,
this addendum and your use of the Services are those instructions. We will tell you if we think an instruction breaks the law. If the law compels us to process Customer Personal Data otherwise than on your instructions, we tell you before we do, unless that law forbids it. We do not sell Customer Personal Data. We do not share it for advertising. We do not use it for any purpose other than providing, securing and supporting the Services and meeting our legal obligations. The AI model that handles support requests runs on Anthropic's commercial API. Its terms bar Anthropic from training models on what we send it. We do not retain, use, disclose or combine it outside our direct business relationship with you. We will tell you if we can no longer meet these obligations.

The subject matter, duration, nature and purpose of the processing, and the types
of data and people concerned, are in Annex 1.

## 3. Data you must not send

The Services are general-purpose compute and we do not know what you put in them.
As the [Acceptable Use Policy](/legal/acceptable-use) says, you must not use them
for protected health information, ever. You must also not use them for payment card numbers,
government identifiers or special categories of personal data, unless you encrypt the
data and we have agreed in writing first.

## 4. People and security

Everyone we authorize to handle Customer Personal Data is bound to keep it
confidential. We maintain the security measures in Annex 2 and may improve them,
but will not materially weaken them. You are responsible for using the Services
securely: your keys, your code, what you expose, and your own backups.

## 5. Subprocessors

You authorize us to use the subprocessors listed at
[/legal/subprocessors](/legal/subprocessors). We hold each of them to data
protection terms no weaker than these, and we remain responsible for what they do. We add a new subprocessor to that page before it starts handling Customer Personal Data. You may object to it on reasonable data protection grounds by writing to legal@withruntime.com. If we cannot resolve it, your remedy is to close your account. We will refund purchased credit you have not spent, unless it has expired under section 6 of the terms.

## 6. Helping you

Taking the nature of the Services into account, we give you reasonable help to
answer requests from people exercising their rights, and with impact assessments
and consultations with regulators that the law requires of you. The Services let
you read, export and delete Your Content yourself. If a person sends a request
about your data to us, we point them to you.

## 7. Breaches

If we become aware of a breach of security that leads to the accidental or unlawful
destruction, loss, alteration, disclosure of or access to Customer Personal Data,
we tell you without undue delay, and within 72 hours of becoming aware of it, by
email to your account's owners. We tell you what we know: what happened, the kinds
and rough number of people and records concerned, the likely consequences, what we
have done and will do about it, and who to contact. We update you as we learn more,
and help you meet your own duty to notify. Telling you is not an admission of fault.

## 8. Return and deletion

You can export and delete Your Content at any time while your account is open.
When the agreement ends, or a retention period under the terms runs out, we delete Customer Personal Data. Exporting it before then is how it is returned to you. When your organization closes, we first destroy its encryption key. This makes the off-server copies of its volumes and snapshots, which that key alone opens, unreadable immediately. Then we delete what it runs and stores, including job output, and within 30 days after that, the rest, such as stored secrets. Our servers' own nightly backups, encrypted with each server's key, expire within a further 44 days. The encrypted nightly copies of our database expire within 30. On request, we confirm the deletion in writing. We keep only copies the law requires us to keep, which stay
protected by this addendum.

## 9. Audits

Once a year, on written request, we give you the information reasonably needed to
show that we comply with this addendum. Once we hold an independent SOC 2 report,
that information includes our latest report, under a confidentiality agreement. That report is how we meet this section, unless the law or a supervisory authority requires
more. If it does, you may audit us on at least 30 days' notice, during business
hours, under a confidentiality agreement, without access to other customers' data,
and at your cost.

## 10. Transfers

We process Customer Personal Data in the United States. Where a transfer of
personal data from the European Economic Area to us is restricted by law, the
European Commission's standard contractual clauses of 4 June 2021 (Decision
2021/914) are incorporated into this addendum. Module Two applies where you are a
controller, and Module Three where you are a processor. For those clauses, you are the
exporter and we are the importer. Clause 7 does not apply. Clause 9 uses general
written authorization, with changes to the list made as section 5 says. The optional paragraph
of Clause 11 does not apply. Irish law governs, and the Irish courts have
jurisdiction. Annexes 1 and 2 below complete the clauses' annexes. The
competent supervisory authority is the one for your place of establishment.

For transfers from the United Kingdom, the Information Commissioner's International
Data Transfer Addendum to those clauses applies, completed with the same
information. Either party may end it under its Table 4. For transfers from
Switzerland, the clauses apply with references to the GDPR read as references to the
Swiss FADP, and the Swiss Federal Data Protection and Information Commissioner as
the authority. Where the clauses and this addendum conflict, the clauses take precedence.

## 11. Liability

Each party's liability under this addendum, including under the standard
contractual clauses as between the parties, is subject to the limits in the Terms
of Service. Nothing here limits what either party owes directly to an individual
under data protection law.

## Annex 1: the processing

- **Exporter:** the customer named on the account, contact as given on the account.
- **Importer:** Runtime LLC, 1500 N Grant St Ste N, Denver, CO 80203, United
  States; legal@withruntime.com. Role: processor.
- **Subject matter and nature:** hosting, running, storing and transmitting Your
  Content to provide the Services.
- **Purpose:** providing, securing and supporting the Services.
- **Duration:** while your account is open, and then until deletion under the
  terms.
- **Frequency:** continuous.
- **People concerned:** whoever you decide, typically your staff, your customers
  and your users.
- **Types of data:** whatever you decide to put in the Services, within the limits
  of section 3. This includes the output of scheduled jobs and the secrets you store,
  which are sealed. For resources that serve the internet, it includes the connection records
  our ingress keeps: client IP address, time and request line, for a bounded
  period. No special categories.
- **Subprocessors:** as listed at /legal/subprocessors, for the same subject
  matter, nature and duration.

## Annex 2: security measures

- Every sandbox runs in its own Firecracker virtual machine with its own guest
  environment, on servers we operate. Host credentials and control interfaces are
  not reachable from a sandbox.
- Sandboxes reach the public web only. Private and internal addresses are refused.
  Connections are limited per sandbox, and any sandbox's network access can be cut
  immediately.
- Data is encrypted in transit, and connections to the database verify the
  server's certificate.
- Customers are separated in the database by row-level rules tied to the
  organization. Each part of the system connects with its own database role,
  holding only the permissions that part needs.
- API keys are scoped to named operations and can be revoked at any time.
- Access to production systems is limited to authorized people, and actions on
  customer resources are recorded.
- Outbound connections are attributable to one sandbox and one organization, so
  that abuse can be traced and stopped.
- Secrets you store are sealed and never returned by the API. They are never placed in a
  sandbox. The sandbox sees a placeholder that our network replaces on the way out.
- Every backup is encrypted before it leaves the server. Copies of your volumes
  and snapshots use a key that belongs to your organization alone. Each server's
  nightly backup uses that server's own key. Both use AES-256-GCM. The nightly
  copy of our database uses a key held offline. The storage provider holds none of
  these keys.
- Backups of sandbox data are restored in automatic weekly drills, and failures
  alert.
- Every change to our software is tested and recorded before it reaches
  production. Servers run only releases we have signed, one server first, and roll
  back on failure. Dependencies are checked daily against published advisories, and
  each change is scanned for leaked keys.
- Security events are reviewed automatically every 10 minutes. Security logs
  are kept in write-once storage for at least 400 days.
- We handle security incidents under a written procedure. It includes preserving
  evidence and notifying affected customers within the time in section 7.
- Everyone with access is bound to confidentiality and to our written security
  policies.