# Data processing agreement

The agreement for the personal data Brewless can reach in your accounts when it works on your instruction.


> [!NOTE]
> Version of 22 October 2026.

## 1. Why this agreement exists

Your application and its data live in your own cloud accounts. Brewless is not in the path of your visitors and keeps no copy of your application's data. Still, with the keys you connect, Brewless can reach your accounts, and some of what it does there on your instruction can touch personal data of the people your application serves. For that, you are the controller and Coding Agency, Blankenstein 131, 7943 PE Meppel, the Netherlands ("Brewless") is your processor, and this agreement applies.

For the personal data of you and your team that Brewless holds itself (accounts, sign-ins, the audit trail), Coding Agency is controller; that is described in the [privacy statement](/legal/privacy).

## 2. What Brewless does with personal data on your behalf

| What you ask | What Brewless can come across | What is kept by Brewless |
| --- | --- | --- |
| Show the logs of an environment | Log lines of your application, which may hold personal data | Nothing: they are read from your provider and shown to you |
| Run a one-off command in an environment | Whatever the command prints | Which command ran and who ran it, in the audit trail; not its arguments and not its output |
| See, change or push variables through the console or the command line | The values, on their way from or to your Secret Manager | The names and a checksum, never a value; that someone looked, in the audit trail |
| Deploy, roll back, scale, add a domain | The configuration of your resources | References and settings of the resources; no application data |
| Show failed jobs | Which job failed and when, never why | Nothing |

The nature of the processing is therefore reading and passing on, on your instruction, for as long as you use Brewless. The people it concerns are the users and visitors of your application; which kinds of personal data depends on what your application logs and prints, which you decide.

## 3. Instructions

Brewless handles this data only to do what you instruct through the dashboard, the command line client or the API, and as this agreement describes. If we believe an instruction breaks the law, we tell you.

## 4. Confidentiality and security

Only people who need it to keep Brewless running can reach its systems, and they are bound to secrecy. The technical and organisational measures we take are listed in the [annex](#annex-security-measures) below and are part of this agreement.

## 5. Sub-processors

You agree to the sub-processors listed in the [privacy statement](/legal/privacy#who-else-handles-this-data). We tell you by mail at least 30 days before adding or replacing one, so you can object. Each is bound to the same obligations as this agreement puts on us.

Your own providers (Scaleway, bunny.net, as far as you use them in your own accounts) are not our sub-processors: you have your own agreements with them.

## 6. Where

Brewless handles this data inside the European Economic Area only.

## 7. Helping you

We help you answer requests from people about their data and meet your own obligations on security, data breaches and impact assessments, as far as what we can see and do allows. A request that reaches us about your application's data, we pass on to you.

## 8. Data breaches

If personal data we handle for you is lost or reaches someone it should not, we tell you without undue delay and at the latest within 48 hours after we found out, with what we know: what happened, what data, what we did about it.

## 9. Audits

On request we show you how we meet this agreement, first with a written explanation or an existing report. If that is not enough, you may have it checked once a year by an independent auditor bound to secrecy, at your own cost, announced 30 days ahead.

## 10. When it ends

This agreement lasts as long as you use Brewless. When you stop, we remove what we hold of your organisation as the terms describe; your application's data was never with us and stays in your accounts. Disconnecting a provider removes its key from Brewless at once.

## 11. The rest

The [terms of service](/legal/terms) apply, including what they say about liability and Dutch law. Where this agreement and the terms differ about personal data, this agreement decides.

## Annex: security measures

- **Hosting.** Brewless runs at Scaleway in Paris (`fr-par`), inside the European Union.
- **Separation.** Every organisation has its own database and its own subdomain.
- **Provider keys.** The keys of your provider accounts are stored encrypted, and removed from Brewless as soon as you disconnect the provider.
- **Your application's secrets.** Brewless never stores or logs their values; it keeps only the names and a checksum. The values stay in your own Secret Manager. One exception: when an environment lets the application ask Brewless for databases of its own (`databases:` in `brewless.yml`), Brewless keeps that one signing key, encrypted, only to check those requests. It is never logged or shown.
- **Signing in.** There are no passwords: you sign in with a passkey or with a code or link sent by mail. A code or link works once and for 15 minutes, only a hash of it is stored, and attempts to guess one are limited.
- **Tokens.** Tokens for the command line client and pipelines are stored only as a hash and can be revoked at any time.
- **Connections.** All traffic uses HTTPS, with HSTS; session cookies are sent over HTTPS only.
- **Audit trail.** Every sign-in and every change in your organisation is written to an audit trail that you can read.
- **People.** Only people who need it to keep Brewless running have access to its systems, and they are bound to secrecy.