Data Processing Agreement.

Last updated: September 2026

Scope and roles

This page summarises the Data Processing Agreement ("DPA") that forms part of the Terms of Service. The Customer is the data controller for personal data submitted to or generated within the Service. Spot Cloud B.V., registered in the Netherlands, acts as data processor on the Customer's instructions. The DPA covers personal data processed in a Customer Environment through Spot Suite products. The written agreement follows Article 28 of the General Data Protection Regulation (GDPR) for processor terms.

Processing location

Customer Data is stored as follows. xEvolve and Automate Certificates keep their database records in the European Union, in a shared Supabase Postgres project on AWS in Paris with one schema per customer. Product files of xEvolve sit in Cloudflare R2 in Western Europe, Cloudflare's default location, and are not pinned to an EU jurisdiction. ClearScreen and Guardrail Ledger trials use the same project; a paid ClearScreen or Guardrail Ledger workspace has its own Supabase project in the region chosen at purchase (Frankfurt for the EU, otherwise London, N. Virginia, Montréal, Singapore or São Paulo). Spot Suite's own control plane (accounts, billing, audit log) runs on Cloudflare (Workers, D1, KV, R2 and Durable Objects) with no jurisdiction pinned, so it can be processed anywhere on Cloudflare's global network. A workspace bought through a cloud marketplace counts as a paid workspace and follows the same rules. Spot Cloud B.V. does not move Customer Data at rest out of the region shown above unless the Customer gives prior written instruction and any required safeguards are in place. Backups of a Supabase-hosted workspace are kept with the database, in the same Supabase project.

Subprocessors

Spot Cloud B.V. uses the subprocessors on the subprocessor list, which states what each one receives and where. The infrastructure subprocessors are Cloudflare (hosting and content delivery), Supabase on AWS (Postgres databases) and, for purchases through Azure Marketplace, Microsoft Azure. Customers are notified in advance of subprocessor changes and may object on grounds relating to data protection, as set out in the full DPA.

Security measures

Customer Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or newer. Each Customer Environment is separated at the tenant level, with its own database schema (or, for a paid ClearScreen or Guardrail Ledger workspace, its own Supabase project; the same for a marketplace purchase) and tenant-scoped access. Customer users sign in through OIDC single sign-on via Microsoft Entra or with an emailed one-time code. Spot Cloud does not enforce multi-factor authentication for Customer users: Entra sign-ins follow the Customer's identity provider policies. Spot Cloud staff access is role-based, limited to what is required for support and operations, and logged for administrative actions.

Breach notification

Spot Cloud B.V. notifies the Customer without undue delay after becoming aware of a personal data breach that affects their Customer Environment. The notice includes the information the Customer needs to meet its own obligations under Article 33 GDPR, including the nature of the breach, categories of data involved, and measures taken or proposed to address the incident.

Audit rights

Customers may request audit evidence, including the control-mapping documentation, under NDA. On-site or remote audits can be arranged under the conditions, notice periods, and confidentiality terms in the signed DPA. Spot Cloud B.V. may satisfy some requests through third-party attestations where they cover the controls in scope.

Data return and deletion

On termination of the subscription, the Customer can export Customer Data during the wind-down window stated in the order form or product documentation. After that window closes, Spot Cloud B.V. deletes Customer Data from production systems and schedules removal from backups according to the retention schedule in the full DPA. Deletion certificates are available on written request.

Contact

The full signed DPA is available to customers and prospects under NDA. Requests may be sent to hello@spot-suite.com or through the contact page at spot-suite.com/contact.

Spot Cloud B.V., KvK 89708873, VAT NL865071536B01, Netherlands. General enquiries: hello@spot-suite.com.