This document is not yet effective. Everock’s operator details and final legal terms must be completed before it is used as an agreement or production notice.
Draft status and parties
This is a proposed DPA framework, not an executed data-processing agreement. Everock’s operator identity, contact, actual subprocessors, processing locations, retention schedule, and any required transfer terms must be completed before it is used for production personal data.
The intended arrangement is that the customer determines the purposes of application monitoring and Everock processes customer personal data on documented instructions. A customer may itself be acting for another controller. Account administration and service security may involve separate responsibilities described in the Privacy Policy.
Processing details
| Item | Proposed scope |
|---|---|
| Purpose | Ingest and organize application evidence, show issues and sessions, provide authorized agent access, and deliver configured notifications. |
| Activities | Receive, validate, store, organize, retrieve, transmit, troubleshoot, and delete data as needed for the configured services. |
| People | Application visitors and users, customer personnel, and individuals whose identifiers the customer chooses to include. |
| Data | Runtime metadata, errors, logs, session or device identifiers, optional replay, and authorized integration or support information. |
| Duration | The agreed service period and a specifically documented retention, export, and deletion schedule. |
| Excluded information | Secrets and sensitive regulated data unless separately assessed and expressly covered by a suitable agreement. |
Instructions and confidentiality
Proposed instructions include the agreed service scope and the customer’s authorized collection, integration, retention, and agent-access settings. Processing outside those instructions would require a valid legal basis and any required notice.
Access should be limited to authorized persons who need it for service delivery, support, or security and who are subject to appropriate confidentiality obligations. The proposed terms prohibit advertising use, sale of customer telemetry, and general-purpose model training with that data.
Customers remain responsible for their right to submit the data, lawful notices and consent, and the permissions they grant to their own external agent. Selecting an agent does not make every agent provider an Everock subprocessor.
Technical safeguards
Implemented product controls include authenticated project scoping, revocable project credentials, SDK redaction and filtering, separate replay controls, and bounded ingestion. Some saved integration secrets use application-level encryption. These controls do not certify the complete hosted environment.
Production hosting must separately validate transport security, storage and backup protection, privileged access, restoration, monitoring, and incident procedures. The final security schedule must describe actual deployed measures and their scope.
Subprocessors and transfers
A binding schedule must identify each engaged subprocessor, its purpose and locations, the applicable provider agreement, and a clear change-notification and objection process. The compliance page lists integration categories, not a completed subprocessor register.
Required international transfer safeguards must be selected and completed for the actual parties and destinations. This draft does not automatically execute Standard Contractual Clauses, a UK addendum, or any other transfer instrument.
Requests and security incidents
The proposed process is to assist the customer with applicable individual-rights requests and security investigations using information reasonably available to the operator. Requests about application-user data should be directed to the responsible customer unless a different response is legally required.
A final agreement must designate monitored contacts, escalation procedures, and notification requirements for a confirmed personal-data breach. Information may need to be supplied in stages as an investigation develops. No unstaffed 24/7 commitment or invented breach deadline is established here.
Return, deletion, and evidence
A final agreement must state how a customer requests an export or deletion, how long an export window lasts, when active copies are deleted, and how residual backups and legally required records are handled. Each retained category should have a purpose and limit.
Available technical documentation can support a review. Independent audit reports, certifications, and specific deletion attestations must not be represented as available until they actually exist. This draft grants no fictional certification or completed audit right.
Before signing
Complete the parties, service scope, privacy contacts, processing and provider schedules, retention commitments, security measures, transfer instruments where needed, effective date, and any governing agreement. Resolve mandatory-law requirements and document precedence through legal review.
