Data processing agreement

In force since: 2026-10-02Version 1.1

When you connect a repository belonging to your organisation, you (or your company) are the controller of the personal data in its history — the names and emails of those who commit — and we act as processor. This page summarises the commitments we take on in that role. The signable document is available on request.

Subject matter and duration

We process the personal data you provide solely to deliver RepoFit to you, for as long as the service relationship lasts. On termination, we delete it according to the periods published in the privacy policy.

Only on your instructions

We do not process your data for purposes of our own other than providing the service. In particular, we do not sell it, we do not transfer it to third parties for commercial purposes, and we do not use it to train artificial intelligence models, ours or anyone else's.

Confidentiality

Anyone on our team who accesses your data is bound by a duty of confidentiality and accesses it only to the extent their work requires.

Security measures

Encryption in transit and at rest, password hashing, encryption of webhook secrets and refresh tokens, short-lived installation tokens, constant-time signature verification, and workspace isolation on every read and every action. The detail is on the security page.

Subprocessors

You authorise us to use the subprocessors published on the corresponding page, each bound by obligations equivalent to those in this agreement. Any addition is announced in advance and you may object.

Assistance and audit

We assist you in responding to data subject rights requests and with your impact assessments, and we make available the information needed to demonstrate compliance with these obligations.

Incident notification

If we detect a breach affecting your data, we notify you without undue delay, with what we know of the scope and the measures taken, so you can meet your own notification obligations.

Return and deletion

On termination of the service, and at your choice, we return or delete the personal data processed, except for anything we are legally required to retain.

Request the signable document

Write to us with your legal entity name, country, and who will sign, and we'll send the agreement for review and signature. If your organisation has its own template, we'll review that too.

support@repofit.ai