Data processing agreement

1About this agreement

This Data Processing Agreement ("DPA") is between the customer named in the Sustain account ("Customer") and Yuvi Co. LLC, a Florida limited liability company that operates as Zetesis ("Zetesis"). It forms part of the Sustain Terms of Service ("Terms") and applies whenever Zetesis processes Customer Personal Data to provide Sustain.

2Definitions

Data Protection Laws

The laws on privacy and personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws, each where it applies.

Customer Personal Data

Personal data that Zetesis processes on the Customer's behalf through Sustain, as described in Annex I.

Subprocessor

A third party that Zetesis engages to process Customer Personal Data.

Security Incident

A breach of security leading to the accidental or unlawful destruction, loss or alteration of Customer Personal Data, or to its unauthorized disclosure or access.

SCCs

The standard contractual clauses approved by the European Commission in Decision 2021/914, together with the UK International Data Transfer Addendum and the changes Swiss law requires.

"Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR.

3Roles and instructions

The Customer is the controller of Customer Personal Data, or a processor acting for its own client. Zetesis is the Customer's processor, or a subprocessor where the Customer is itself a processor.

Zetesis processes Customer Personal Data only on the Customer's documented instructions. Those instructions are the Terms, this DPA, and the Customer's configuration of Sustain, including the systems it connects, its plan, and the rules and thresholds it sets. Zetesis will tell the Customer if it believes an instruction breaks Data Protection Laws.

The Customer is responsible for having a lawful basis for the processing and for the instructions it gives. Where an agency connects its clients' systems, the agency is responsible for making sure its configuration reflects its clients' instructions.

4People

Zetesis limits access to Customer Personal Data to the people who need it to operate, secure and support Sustain, and binds them to confidentiality. Sustain is automated, and no one at Zetesis writes or ships changes to the Customer's app.

5Security

Zetesis maintains the technical and organizational measures in Annex II. It may update them over time, as long as the overall level of protection doesn't go down.

6Subprocessors

The Customer authorizes Zetesis to use the Subprocessors listed in Annex III.

Zetesis will email the Customer at least 30 days before adding or replacing a Subprocessor, and will keep the current list on its trust page. The Customer may object on reasonable data protection grounds within that period. If the parties can't resolve the objection, the Customer may end the affected part of the service and receive a refund of fees prepaid for the time after it ends.

Zetesis puts data protection terms in place with each Subprocessor that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance.

7Helping the Customer

Zetesis will help the Customer respond to requests from data subjects, mainly through Sustain's export and deletion tools, and will pass on any request it receives directly without responding to it itself.

Zetesis will give reasonable help with data protection impact assessments and with consultations with supervisory authorities, where they relate to Sustain.

8Security incidents

Zetesis will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include what Zetesis knows at the time: what happened, the data and people likely to be affected, the likely consequences, and the steps taken so far. Zetesis will update the Customer as it learns more and take reasonable steps to contain the incident.

Notifying the Customer of a Security Incident isn't an admission of fault.

9Deletion and return

During the subscription, the Customer can export and delete its data with Sustain's tools. When the subscription ends, the Customer can export its data for 30 days. Zetesis then deletes Customer Personal Data within 30 days, unless the law requires it to keep some of it. Deleted data can remain in backups for up to 7 days until they roll off.

When the subscription ends, Zetesis also deletes the credentials it stored and stops using the access the Customer granted.

If the Customer takes a refund and exit under section 17 of the Terms, Zetesis deletes the stored credentials at once and Customer Personal Data within 30 days, without the export period, unless the law requires it to keep some of it.

10Audits

Zetesis will make available the information reasonably needed to show that it meets this DPA, including answers to a reasonable security questionnaire once a year.

Where Data Protection Laws require an audit beyond that, or after a Security Incident, the Customer may audit Zetesis with at least 30 days' notice, during business hours, at its own cost and under confidentiality.

11International transfers

Where Customer Personal Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the SCCs are incorporated into this DPA: Module 2 where the Customer is a controller, and Module 3 where it is a processor. Annex I gives the details the SCCs require. The UK International Data Transfer Addendum applies to transfers from the UK, and the SCCs apply to transfers from Switzerland with the changes Swiss law requires.

12US state privacy laws

Where US state privacy laws apply, Zetesis acts as a service provider or processor. It won't sell or share Customer Personal Data. It won't keep, use or disclose it outside the direct business relationship with the Customer, or for any purpose other than providing Sustain. It won't combine it with personal data from other sources, except as those laws allow.

13AI and code processing

Sustain sends Customer Personal Data to AI model providers only as a task needs it, such as summarizing a finding or preparing a fix. Before anything is sent, Sustain removes text that matches a stored secret or a known key format.

Zetesis doesn't use Customer Personal Data to train or fine-tune AI models.

Customer code is processed only inside isolated sandboxes that are destroyed after each run.

14Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA wins. If the SCCs conflict with either, the SCCs win.

15Term

This DPA lasts for as long as Zetesis processes Customer Personal Data.

Annex IDetails of processing

Subject matter

Providing Sustain to the Customer.

Duration

The subscription, plus the export and deletion periods in section 9.

Nature of processing

Reading data from the systems the Customer connects, storing it, analyzing it with rules and AI models, preparing changes in the Customer's repositories, sending alerts and reports, and deleting it.

Purpose

Monitoring the Customer's app, reporting on it, preparing and shipping fixes, writing handoff briefs, and applying safety brakes, as the Customer's plan and settings allow.

Data subjects

The Customer's staff and authorized users, and those of an agency's clients. Developers and contributors who appear in the Customer's repositories, pull requests and CI. End users of the Customer's app, where their data appears in crash reports, error reports, logs or configuration the Customer connects. People whose data appears in connected billing accounts, such as the Customer's own customers in Stripe events.

Personal data

Names, email addresses, usernames and account identifiers. Commit and pull request authorship. IP addresses and device and user identifiers in crash and error data. Customer names, email addresses and payment metadata in Stripe events. Any other personal data present in code, configuration or logs the Customer connects.

Special category data

Not intended. The Customer should not connect systems to Sustain in order to send special category data.

Frequency

Continuous while the subscription is active, at the check frequency of the Customer's plan.

Data exporter

The Customer, as controller or processor.

Data importer

Yuvi Co. LLC, operating as Zetesis, United States. Contact: yuvi@zetesis.dev. Role: processor.

Supervisory authority

As set by clause 13 of the SCCs.

Annex IISecurity measures

Access and least privilege

• Delegated access wherever a provider offers it: GitHub App installations, a cross-account AWS role with an external ID unique to each customer organization, and roles granted to a Sustain service account on Google Cloud.
• A read-only GitHub App on Watch. A separate write app is installed only on Maintain and Autopilot.
• Safety brake permissions held by a separate service account and a separate App Store Connect key, requested only on Autopilot and removed on downgrade.
• Each connection shows its scope and flags any access broader than Sustain uses.
• Two-factor authentication on every administrative account Zetesis uses.

Encryption and keys

• TLS for data in transit, and encryption at rest by the hosting providers.
• Stored credentials envelope encrypted with AWS KMS, with a fresh data key for each secret.
• Split keys: the web-facing service can encrypt credentials but not decrypt them. Only background jobs can decrypt, and only at the moment of use.
• Every decrypt written to the audit log.

Separation and audit

• Row-level security on every database table, with automated tests proving that one organization can't read or write another's data.
• An append-only audit log, with updates and deletes revoked and each row hash-chained to the one before it. Entries are kept for 13 months, then removed by a nightly job that records where each chain continues, so it still verifies.
• Request IDs on every API log line.

Code and agent controls

• Customer code is processed only in sandboxes created for one run and destroyed after it. Each sandbox holds a short-lived token for one repository and no Zetesis secrets, and its network access is limited to package registries and GitHub where the sandbox provider supports it.
• Agent tool permissions are enforced in code and never granted by a prompt. Repository content is treated as data, so instructions inside it can't widen the agent's access.
• Global and per-app kill switches are checked before every write.
• Every change goes from a branch to a pull request, through CI and staging. Sustain never pushes to a default branch or runs a production deploy.
• Safety brakes run as deterministic code with thresholds the Customer can see and change.

AI data handling

• Text matching a stored secret or a known key format is removed before any prompt is sent.
• Model calls run only from background jobs.
• Each model call is logged with its task, provider, model and cost.

Operations

• A strict Content Security Policy on the dashboard, and webhook signatures verified before anything is stored.
• Error monitoring, dependency audits and secret scanning in CI.
• Point-in-time recovery for the production database, with a tested restore.
• Tested export and deletion of customer data.
• Written incident runbooks.

Annex IIISubprocessors