Data processing agreement

1. Roles and scope

Customer is the controller (or a processor acting for its own customer) of the personal data in Customer Data, and Stableship is its processor (or subprocessor). Annex I describes the processing. This DPA covers processing under the GDPR and UK GDPR, the Swiss FADP, and US state privacy laws such as the CCPA ("Data Protection Laws").

2. Instructions

Stableship processes personal data only on Customer’s documented instructions, which are the Terms, this DPA and Customer’s use and configuration of the Service, unless the law requires otherwise (in which case Stableship tells Customer first where the law allows). Stableship will tell Customer if it believes an instruction breaks Data Protection Laws.

3. Confidentiality

Everyone at Stableship and its subprocessors who can access personal data is bound to keep it confidential.

4. Security

Stableship maintains the technical and organizational measures in Annex II, and may improve them but will not reduce the overall protection they give.

5. Subprocessors

Customer authorizes Stableship to use the subprocessors in Annex III. Stableship binds each to data protection terms at least as protective as this DPA and remains responsible for them.

Stableship will email workspace owners and update the Subprocessors page at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that time; if we cannot resolve the objection, Customer may end the affected Service and receive a refund of prepaid fees for the unused period.

6. Helping Customer

Taking into account the nature of the processing, Stableship will help Customer answer requests from data subjects (the app’s export and deletion tools do most of this), and give reasonable help with security, breach notifications, data protection impact assessments and consultations with authorities.

7. Personal data breaches

Stableship will notify Customer without undue delay, and within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer’s personal data. The notice will say what is known (what happened, what data, likely consequences, what we are doing) and will be updated as we learn more.

8. Deletion and return

Customer can export and delete its workspace from the app at any time. When the Service ends, Stableship deletes Customer’s personal data, including from backups within the period in the Privacy Policy, unless the law requires it to keep some.

9. Audits

Stableship will make available the information needed to show it meets this DPA, first through written answers and documentation. If that is not enough, Customer may audit Stableship once a year, on 30 days’ notice, during business hours, at its own cost, through an auditor bound to confidentiality, and in a way that does not expose other customers’ data. Authorities may audit as the law requires.

10. Transfers out of Europe

Stableship processes data in the United States. Where Customer transfers personal data subject to the GDPR to Stableship, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply: Module 2 where Customer is a controller and Module 3 where it is a processor, with clause 7 (docking) included, the optional clause 11 wording left out, clause 13 supervision by the authority competent for Customer, clauses 17 and 18 choosing the law and courts of Ireland, and Annexes I to III of this DPA completing their appendix.

For data subject to UK data protection law, the UK International Data Transfer Addendum (version B1.0) applies to those clauses, with Table 1 to 3 completed from this DPA and Table 4 allowing either party to end it. For data subject to Swiss law, the clauses apply with the FDPIC as the authority and references to the GDPR read as the FADP.

11. US state privacy laws

Where Stableship processes personal information as a service provider or processor under the CCPA or similar laws, it will not sell or share it, will not use it outside the direct business relationship with Customer or for any purpose other than providing the Service, will not combine it with other data except as those laws allow, will comply with those laws and give the same protection they require, and will tell Customer if it can no longer meet them. Customer may take reasonable steps to stop unauthorized use.

12. Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or Data Protection Laws do not allow it. If this DPA and the Terms conflict on personal data, this DPA wins; if the Standard Contractual Clauses conflict with either, the Clauses win.

Annex I: The processing

• Parties: Customer (data exporter, as named in its workspace) and Stableship LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA (data importer). Contact: avery@versionseven.ai.
• Data subjects: Customer’s workspace members; and the people whose data appears in what Customer connects (for example names and emails in code, commit history, or approved settings tables).
• Categories of data: names, emails, account identifiers, GitHub identities; any personal data present in connected code or approved settings tables. Test copies contain made-up data. No special category data is required, and Customer should not connect it.
• Nature and purpose: reviewing code, testing private copies of Customer’s apps, holding deployments, reporting findings, and supporting Customer, as described in the Terms.
• Frequency: continuous, for as long as Customer uses the Service.
• Duration and retention: for the term of the Service, and as set out in the Privacy Policy’s retention list.
• Transfers to subprocessors: as in Annex III, for the purposes listed there.

Annex II: Technical and organizational measures

• Isolation of testing: every active test runs against a test copy built in Stableship’s own infrastructure (a temporary Supabase project in a separate organization, or a database inside the sandbox), filled with made-up data, and deleted when the run ends. Before active tests start, the agent confirms the copy is not connected to production.
• Sandboxes: each job runs on a fresh machine that can reach only an allowlist of hosts, holds no GitHub or provider token, fetches code through a 15-minute signed link, and is destroyed when the job ends.
• Least access: read-only scopes for Supabase (projects, database structure, Edge Functions list); no write access to customer repositories or live databases; live payment keys refused.
• Encryption: data is encrypted in transit (TLS) and at rest by our hosting providers; connection tokens, connection strings and test keys are kept in an encrypted vault and read only by the Stableship service. Agent, API and invitation tokens are stored only as one-way hashes.
• Access control: workspace roles (owner, admin, developer, approver, viewer) enforced by database row level security; members can be limited to selected apps; billing, members and connections are changed only by owners and admins.
• Accountability: an activity log of what people and agents did in each workspace; overrides recorded with the person’s name.
• Minimization and retention: rows are read only from the settings tables the Customer approves, and tables with people or customer accounts are refused; source copies are deleted a day after their run; evidence is deleted after 30 days by default; retention jobs run every six hours.
• Untrusted input: content from pull requests, issues, code comments and tested pages is treated as untrusted and cannot instruct the agents to act outside the run.
• Deletion: a workspace can be exported and deleted from the app; deletion revokes the access providers let us give back and removes the workspace’s data.

Annex III: Subprocessors

• Supabase, Inc.: Database, sign-in, file storage and encrypted secret storage for Stableship; also hosts the temporary test copies of your database, each deleted when its run ends. Location: United States (AWS us-east-1).
• Railway Corporation: Runs the service that coordinates audits and checks and serves the API at api.stableship.ai. Location: United States (Oregon).
• Fly.io, Inc.: Short-lived machines that build and test a private copy of your app, destroyed when the job ends. Location: United States (Ashburn, Virginia).
• Vercel Inc.: Hosts stableship.ai and app.stableship.ai. Location: Global edge network (static files only).
• Anthropic, PBC: The AI models that review code and drive the testing agents. Location: United States.
• Stripe, Inc.: Payments, invoices and the billing portal. Location: United States.
• Resend (Plus Five Five, Inc.): Sends Stableship’s email: sign-in links, alerts and notices. Location: United States.
• GitHub, Inc.: Repository access through the Stableship GitHub App you install, and sign-in with GitHub. Location: United States.
• Slack Technologies, LLC: Alerts and approvals in Slack, only if you connect it. Location: United States.
• VersionSeven: Runs Stableship’s support desk. It uses Resend for email, and Anthropic and OpenAI to draft replies that a person reviews before anything is sent. Location: United States.
• OpenAI, L.L.C.: Drafts support replies in the support desk, reviewed by a person before sending. Location: United States.
• PostHog, Inc.: Product analytics: how the site and the app are used, so we can see where setup is hard and what to improve. On stableship.ai it sets no cookies. Location: United States.