Data processing agreement

Template. Last updated 7 October 2026.

Under review by counsel. This is the data processing agreement Sheptra offers customers, published as the template our lawyers are reviewing. It is executed per customer on request, with the bracketed decisions filled in. To request one for your organization, write to contact@sheptracloud.com.

Parties and purpose#

This agreement is between the customer named on the order form (“Customer”) and Sheptra, Inc. (“Sheptra”). It forms part of the terms of service or the signed agreement between them (the “Agreement”) and governs Sheptra’s processing of personal data on Customer’s behalf in providing the service. Where it conflicts with the Agreement, this agreement prevails for the processing of personal data.

1. Definitions#

“Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the data protection law that applies to Customer — [counsel: the GDPR, the UK GDPR, the CCPA/CPRA and any other named law]. “Customer data” is the data Customer and its users put into the service, including the personal data in it. “Sub-processor” is a third party Sheptra engages to process customer data.

2. Roles#

Customer is the controller of customer data (or a processor acting for its own controllers, in which case Customer warrants it has the authority to instruct Sheptra as this agreement provides). Sheptra is a processor. Each party complies with the data protection law that applies to it.

3. Instructions#

Sheptra processes customer data only on Customer’s documented instructions, which are: the Agreement, this agreement, Customer’s use of the service and its configuration (including the retention windows set for its organization), and any further written instruction the parties agree. Sheptra tells Customer if, in its opinion, an instruction breaches data protection law, and may suspend that instruction until the question is resolved. Sheptra does not sell customer data, use it for its own purposes, or combine it with data from other sources.

4. Details of the processing#

Annex 1 states the subject matter, duration, nature and purpose of the processing, the categories of data subjects and the categories of personal data.

5. Confidentiality#

Sheptra ensures that every person it authorizes to process customer data is bound by a duty of confidentiality and processes it only as this agreement allows. Staff access to customer data is as the security overview describes: only with Customer’s written agreement, as the least-privileged user who can see the problem, visibly to Customer, and recorded in Customer’s own audit trail.

6. Security#

Sheptra implements and maintains the technical and organizational measures in Annex 2, which the security overview describes in full as it stands on its stated date, and keeps them appropriate to the risk of the processing. Sheptra may update the measures over time, but not in a way that materially reduces the protection of customer data during the term.

7. Sub-processors#

Customer gives general authorization for Sheptra to engage the sub-processors listed on the sub-processor page on its stated date (Annex 3). Sheptra imposes on each sub-processor data protection obligations no less protective than this agreement and remains responsible for their performance. Sheptra gives Customer at least [counsel: thirty days’] written notice before engaging a new sub-processor; Customer may object on reasonable data-protection grounds within that period, and if the parties cannot resolve the objection, Customer may terminate the affected service without penalty.

8. Data subject requests#

Sheptra tells Customer without undue delay if it receives a request from a data subject concerning customer data and does not respond to it except on Customer’s instruction or where the law requires. Taking into account the nature of the processing, Sheptra assists Customer with the tools in the service — export, audit trails, and the erasure procedure in section 11 — and otherwise as reasonably requested, at Customer’s cost where the assistance is more than minor.

9. Personal data breach#

Sheptra tells Customer without undue delay, and in any case within [counsel: 72 hours], after confirming a personal data breach affecting customer data, with the information Customer needs to meet its own notification obligations as far as it is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact. Sheptra supplements the notice as more becomes known. The incident response page describes how Sheptra detects and handles incidents.

10. Assessments and assistance#

Sheptra assists Customer, taking into account the nature of the processing and the information available to it, with data protection impact assessments and prior consultation with a supervisory authority where they concern the service.

11. Return and deletion#

During the term, Customer can export its data from the service at any time. At the end of the Agreement, or on Customer’s written request, Sheptra follows the procedure on the retention and deletion page: an export to a location Customer controls if requested, then deletion of Customer’s data from every plane of the service and from the archive, and deletion of Customer’s organization at the identity provider, with a written account of what was deleted and what was retained. Deleted rows persist in database backups for the backup window stated on that page (seven days on its stated date) and are not restored except to recover the service from a failure, in which case they are deleted again. Audit trails are retained as that page describes; [counsel: the legal basis for retaining audit rows after erasure, to be cited on the retention page as well].

12. Audits#

Sheptra makes available the information reasonably necessary to demonstrate compliance with this agreement: the trust pages, written answers to Customer’s security questionnaire, and, once they exist, third-party audit reports and penetration-test summaries under confidentiality. Where that information is not sufficient, Customer may audit Sheptra [counsel: once per year, on thirty days’ notice, during business hours, at Customer’s cost, by an auditor bound by confidentiality and not a competitor].

13. International transfers#

Sheptra processes customer data in the United States, as the data residency page states. Where Customer’s data protection law restricts transfers to the United States, the parties rely on [counsel: the EU standard contractual clauses (Module 2, controller-to-processor) and the UK international data transfer addendum, incorporated by reference with the choices stated here], and Sheptra provides the supplementary measures in Annex 2.

14. Liability#

Each party’s liability under this agreement is subject to the limitations and exclusions in the Agreement, [counsel: and any carve-out for data protection liability].

15. Term#

This agreement lasts as long as Sheptra processes customer data, and section 11 survives until that processing has ended.

Annex 1 — Details of the processing#

Subject matter	Provision of the Sheptra service: modeling, deploying and running Customer’s business processes, and operating them.
Duration	The term of the Agreement, and the deletion period in section 11 after it.
Nature and purpose	Storing, executing and displaying the process definitions, running instances, variables, tasks, forms and decisions Customer deploys; storing and operating Customer’s organization, members, roles and credentials; archiving and deleting execution data on Customer’s retention windows; keeping audit trails; operating and securing the service.
Categories of data subjects	Customer’s users (members of its organization); the individuals whose data Customer’s processes carry — [Customer to state: e.g. its customers, employees, suppliers].
Categories of personal data	For users: name, email address, role, identity-provider identifiers, actions taken in the service. For process data: whatever Customer’s definitions and workers put into process variables, forms and task assignments — [Customer to state]. Customer must not put special-category data into the service unless the order form provides for it.
Retention	Per Customer’s configured windows and the retention and deletion page.

Annex 2 — Technical and organizational measures#

The measures are those the security overview describes on its stated date, in summary: a service operated by Sheptra with no customer-side installation; identity through a dedicated provider with single sign-on, directory sync and per-action permissions; organization-level isolation enforced by database row-level security, with dedicated infrastructure available as described there; encryption at rest with the hosting provider’s keys and TLS in transit on every connection; an edge proxy as the only inbound path and per-cell database firewalls; secrets delivered only through the deployment pipeline; staff access to customer data only with written agreement, visibly and recorded; append-only audit trails; daily backups with a seven-day point-in-time window and a scripted restore drill; every change by reviewed pull request and automated pipeline; alerting with a runbook per rule. The overview also lists what is planned rather than in place.

Annex 3 — Sub-processors#

The sub-processor list on its stated date, incorporated by reference.