Data processing agreement under Art. 28 GDPR
This is a convenience translation. The German version is legally binding. Deutsche Fassung
Between the customer under the IT4S terms (controller) and Silvertip IT-Solutions GmbH, Grabenweg 68, 6020 Innsbruck, Austria, FN 599795b (processor).
1. Subject and term#
The processor operates IT4S for the controller under the terms and processes personal data stored in the workspace by the controller, its users or connected apps, for the term of the main contract and as long as it processes such data.
2. Nature, purpose, data, data subjects#
Storing, organising, displaying, searching, transmitting (email notifications, webhooks, API/MCP at the controller's request), backing up, restoring, deleting; when AI features are enabled, transmission to Anthropic with the controller's own API key. Purpose: providing IT4S incl. support and backups. Data: names, emails, avatars, roles and memberships; content of issues, comments, documentation pages and files; time logs; activity history; presence; data from imports and integrations. Data subjects: the controller's users (staff, customers, partners, contractors) and people mentioned in content. No special categories (Art. 9 GDPR).
3. Instructions#
Processing only on documented instructions, given by the terms, this DPA and the admins' use of IT4S features and settings. The processor informs the controller if it considers an instruction unlawful.
4. Processor obligations#
Confidentiality of all staff; technical and organisational measures (Annex 2); staff access to content only through support access approved by a customer admin (max. 24 h, read-only by default, logged) or to handle an acute incident, with admins informed at once; assistance with data subject requests (primarily via IT4S features) and with Art. 32–36 GDPR; notification of personal data breaches without undue delay, where possible within 48 hours, to the workspace owner and admins.
5. Sub-processors#
The controller authorises those in Annex 3 (it4s.at/subprocessors). Changes are announced at least 30 days in advance; the controller may object on reasonable data protection grounds and, failing a solution, terminate at the date of the change. Sub-processors are bound by equivalent obligations. Services the controller chooses and connects itself (IT4S's AI features with the controller's own Anthropic API key, AI assistants via MCP, GitHub, own SMTP, webhook receivers, Jira/Confluence) are not sub-processors; the controller's own contract with each provider applies.
6. Transfers#
Workspace content, files, backups and operational logs (14 days) are stored in the EU (Google Cloud, Frankfurt). Operational logs can contain fragments of personal data or content, such as an email address in an error message or a one-time link in a requested address. Third-country transfers, such as support access by Google LLC, only under Art. 44 ff. GDPR (EU-US Data Privacy Framework or Standard Contractual Clauses) as listed in Annex 3.
7. Audits#
Primarily by this DPA, Annex 2, sub-processor certifications (e.g. Google Cloud ISO 27001, SOC 2) and information. On-site audits with 30 days' notice, during business hours, at most once a year, respecting other customers' confidentiality, at the controller's cost unless material breaches are found.
8. Deletion and return#
Full export available anytime. After termination or workspace deletion, all data incl. files and backups is erased after 30 days unless law requires retention, and remains in platform backups and logs expire at the latest 30 days after that; deletion confirmed on request.
9. Liability and final provisions#
Art. 82 GDPR and the terms apply; this DPA prevails over the terms; Austrian law, venue Innsbruck.
Annexes#
Annex 1 – contact: privacy@it4s.at, Silvertip IT-Solutions GmbH, Grabenweg 68, 6020 Innsbruck, Austria. The customer's contacts are the owners and administrators of the workspace.
Annex 2 – technical and organisational measures (Art. 32 GDPR), as of 4 November 2026. They describe how IT4S actually runs; the processor reviews them at least once a year and adapts them without lowering the level of protection.
Operations and location
- IT4S runs in a Google Cloud project used only for production, in the Frankfurt region (europe-west3): the application in Google Kubernetes Engine, the database in Cloud SQL (PostgreSQL), files and backups in Cloud Storage, operational logs in a log bucket in the same region.
- Google Cloud data centres with certifications including ISO 27001 and SOC 2; the processor runs no servers of its own. Physical access control by Google.
- Separate environments for development, pre-production and production; development and tests use test data, not customer data.
Confidentiality
- Users sign in with a password (stored only as an Argon2 hash) and optional or workspace-enforced two-factor authentication, or with Google. Sessions are valid only for their workspace's address and are stored only as hashes; so are API tokens and app connections (OAuth), which can be revoked at any time.
- Roles and permissions per workspace and project. Workspaces are separated in the database by row-level security; the application's database user cannot bypass it.
- The database is reachable only on a private network address, without a public address, and only over encrypted connections. Compute nodes have no public addresses.
- Administrative access to the production project only for named, authorised persons of the processor through Google Cloud IAM; deployments through a service account without stored keys (Workload Identity). Secrets are kept in Google Secret Manager; customers' integration secrets (including their Anthropic API keys) are additionally encrypted with AES-256-GCM.
- Platform administration by the processor's staff only with Google accounts of the company domains with mandatory 2-step verification, without separate IT4S passwords, with sessions of at most 8 hours (30 minutes idle). Access to a workspace's content only with support access approved by an administrator of the workspace: at most 24 hours, read-only by default, logged and visible to the workspace.
- Data at rest (database, files, backups, logs) encrypted by Google Cloud with Google-managed keys.
Integrity
- Transport only encrypted: TLS 1.2 or higher with modern ciphers, HTTP Strict Transport Security. Files only through signed, time-limited links; outgoing webhooks are signed.
- A complete history per issue and documentation page: who, when and through which channel (web app, API, app or AI agent).
- An audit log of all staff actions and billing events, append-only (the application can neither change nor delete entries), kept for 2 years.
Availability and resilience
- The web app and the API run in several instances; protection against overload by Google Cloud Armor and limits per workspace.
- Daily Cloud SQL database backups, 14 kept, with point-in-time recovery over 7 days; backups in the same region.
- A nightly backup of every workspace (data and files), kept 7 days on Free and 30 days on Team; restore by the customer. Deleted files remain recoverable for 7 days.
- Availability monitoring from several regions with alerting.
- Operational logs kept 14 days in the EU.
Regular review
- Every change goes through code review (pull request) and automated tests before delivery, including tests of tenant separation and of backup and restore per workspace; production receives a release only after it ran in pre-production.
- Ongoing updates of the managed platform: Kubernetes through a Google Cloud release channel, the database in a fixed maintenance window.
- Weekly automatic check of the libraries used for new versions and known vulnerabilities.
- A documented procedure for personal data breaches: detection, assessment, containment and preservation of evidence, notification under section 4, a log of all cases.
- Review of these measures at least once a year.
Annex 3 – sub-processors: see the sub-processor page.