Agreements

Data processing addendum

How we process personal data in your environments on your behalf, as your Processor under the GDPR.

Version
1.0
Effective
5 November 2026
Last updated
5 November 2026

  1. 1.Scope and roles

    1.1

    This addendum forms part of the terms of service between Rykon Technologies Inc. and the Customer. It applies to Personal Data in Customer Data that we process for the Customer. The Customer is the Controller and we are its Processor.

    1.2

    It does not cover an Environment in the Customer’s own cloud account: there the cloud provider is the Customer’s own supplier, and we act only through the role or service account the Customer granted.

  2. 2.Details of the processing

    Subject matter
    Hosting and operating the Customer’s Environments and what runs in them.
    Duration
    While the Customer uses the service, and until deletion under the deletion clause.
    Nature and purpose
    Creating, running, stopping, saving, restoring and destroying Environments; storing their state, saved copies and logs; showing them to the Customer’s people.
    Personal Data
    Whatever the Customer puts into its Environments. We do not choose it and do not look at it except under the confidentiality clause.
    Data Subjects
    The Customer’s users, customers, staff and anyone else whose data the Customer processes in its Environments.

  3. 3.Instructions

    3.1

    We process Personal Data only on the Customer’s documented instructions: these Terms, and what the Customer’s people do in the console and the API. We tell the Customer if we believe an instruction breaks the law.

  4. 4.Confidentiality

    4.1

    Only people who need access to run or support the service have it, and they are bound to confidentiality. They read Customer Data only when the Customer asks in a support request, or where the security of the service or the law requires it.

  5. 5.Security measures

    • Each Environment has its own network, firewall, keys, database and bucket; its cloud control endpoint admits only Rykloud’s runner.
    • Infrastructure state and saved copies are encrypted before they leave the machine that wrote them, and stored encrypted at rest.
    • Rykloud’s services reach each other over mutual TLS with certificates from our own authority.
    • People sign in with one Rykon account, with second factors available, and single sign-out.
    • Every action is recorded on an append-only activity record with who, when, where from and what changed.
    • Nothing costing money is created without an owner’s approval of the exact price.
    5.1

    The trust page describes these as they are built. We hold no security certification today.

  6. 6.Subprocessors

    6.1

    The Customer authorises the subprocessors on the subprocessors page. We give 30 days’ notice by email and on that page before adding or replacing one; the Customer may object on reasonable data protection grounds, and if we cannot address the objection the Customer may end the affected service and receive a refund of prepaid fees for it.

    6.2

    We bind each subprocessor to data protection terms no less protective than these and remain responsible for it.

  7. 7.International transfers

    7.1

    An Environment’s data stays in the region the Customer chose for it. Rykloud’s own services run in Germany today, the current region. Where a subprocessor outside the EEA receives Personal Data, the transfer is under the Standard Contractual Clauses.

  8. 8.Assistance

    8.1

    We help the Customer answer Data Subjects’ requests, and with security, impact assessments and consultations with authorities, to the extent the service allows and the Customer cannot do so itself in the console.

  9. 9.Personal data breaches

    9.1

    We tell the Customer’s owners without undue delay, and within 72 hours of confirming a personal data breach affecting their Customer Data, with what we know, what we are doing, and a contact. We keep the Customer updated until it is resolved. Write to security@rykon.ai to report one to us.

  10. 10.Return and deletion

    10.1

    When the Organisation closes, its owners can take a copy of their data first. We then destroy its Environments in Rykloud’s accounts and delete their saved copies within 30 days. Encrypted database backups of Rykloud’s own records expire on their rolling schedule.

  11. 11.Information and audits

    11.1

    We make available the information needed to show we meet this addendum, on request to support@rykloud.com, and allow and contribute to reasonable audits on 30 days’ notice, at the Customer’s cost and without access to other customers’ data.

Change log

  1. Version 1.0
    5 November 2026

    First published.