Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Solture S.R.L. (VAT: IT05078680237) ("LogTide", the "Processor") and the customer using the cloud-hosted LogTide service (the "Customer", the "Controller"). It applies to personal data contained in the log data, traces, metrics and configuration the Customer submits to the Service ("Customer Personal Data"). It does not apply to self-hosted deployments, where LogTide does not process your data.

For personal data about the Customer's own account holders (such as email address and display name), LogTide acts as a controller, as described in the Privacy Policy.

1. Roles

The Customer is the controller (or a processor acting on behalf of its own controller) of Customer Personal Data. LogTide is the processor, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR"). The Customer decides what is sent to the Service and is responsible for having a lawful basis for it.

2. Subject Matter, Nature and Purpose

• Subject matter: provision of the LogTide Cloud log management and SIEM service
• Nature of processing: ingestion, storage, indexing, querying, alerting, correlation and deletion of the data the Customer sends
• Purpose: solely to provide the Service to the Customer as described in the Terms and the Customer's documented instructions
• Duration: the term of the Customer's subscription, plus the deletion period in section 9

3. Categories of Data and Data Subjects

The Customer controls the content of its logs. Depending on the Customer's use, Customer Personal Data may include IP addresses, user identifiers, email addresses, request metadata and any other personal data written to logs. Data subjects may include the Customer's employees, end users and customers. The Customer must not send special categories of data (GDPR Art. 9) unless it has taken appropriate measures such as PII masking before ingestion.

4. Instructions

LogTide processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service features and API. If LogTide believes an instruction infringes data protection law, it will inform the Customer without undue delay.

5. Confidentiality

LogTide ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations.

6. Security

LogTide implements appropriate technical and organisational measures under GDPR Art. 32, including the following.

6.1 Technical measures

• Encryption of all connections in transit via TLS/HTTPS
• Passwords stored only as bcrypt hashes
• API keys stored only as SHA-256 hashes
• Organization-level tenant isolation enforced on every query
• Role-based access control (owner, admin, member)
• Audit log of administrative actions
• Optional PII masking rules applied to incoming data before storage
• Rate limiting on authentication and ingestion endpoints
• Optional email verification
• Data stored in the European Union (Strasbourg, France)

6.2 Organisational measures

• Access to production systems is limited to authorised personnel on a need-to-know basis and bound by confidentiality
• Credentials and access are reviewed when personnel change
• Security updates are applied to systems in a timely manner
• Personal data breaches are notified to the Customer without undue delay after LogTide becomes aware of them (section 10)
• Data is deleted at the end of the service as described in section 9

7. Subprocessors

The Customer gives general authorisation for LogTide to engage the subprocessors listed on the Subprocessors page. LogTide imposes on each subprocessor data protection obligations no less protective than those in this DPA and remains liable for their performance.

LogTide will notify the Customer by email or through the Service of any intended addition or replacement of a subprocessor at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected subscription.

8. Assistance

Taking into account the nature of the processing, LogTide will assist the Customer, by appropriate technical and organisational measures, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). The Customer controls retention through its plan and can delete projects, or request deletion of data by contacting [email protected]. LogTide will also assist with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation (GDPR Arts. 32 to 36), considering the information available to LogTide.

9. Deletion and Return

• Log data is deleted automatically when it exceeds the retention period of the Customer's plan
• On downgrade or cancellation, data beyond the retention of the resulting plan is deleted after 14 days' notice by email, as described in the Terms
• The Customer can export its data (for example log export from the search page) while the account is active, including during the 14-day notice before that deletion
• After termination, access to the Service ends and LogTide deletes Customer Personal Data within 30 days, unless law requires retention

10. Personal Data Breach

LogTide will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to help the Customer meet its notification duties under GDPR Art. 33.

11. Audits

LogTide will make available to the Customer the information necessary to demonstrate compliance with Article 28 and will contribute to audits, on the following terms:

• Audits are first satisfied through documentation: a security questionnaire, a description of the measures in section 6, and the hosting provider's certifications
• An on-site inspection takes place only when the documentation is insufficient, or when a supervisory authority requires it
• Inspections require at least 30 days' notice, may take place at most once per year, during business hours, at the Customer's expense, under confidentiality, and without access to other customers' data
• The hosting provider's data centers are covered by the provider's own certifications and are not inspected by customers

12. International Transfers

LogTide infrastructure is hosted in Strasbourg, France, and Customer Personal Data is not transferred outside the EU/EEA. Billing data processed by Stripe is the only data that may be transferred outside the EU/EEA, under the transfer mechanisms listed on the Subprocessors page.

13. Liability and Governing Law

The limitations of liability in the Terms apply to this DPA to the extent permitted by law. This DPA is governed by the same law and jurisdiction as the Terms.

14. Contact

• Solture S.R.L. - VAT: IT05078680237
• Email: [email protected]

No Data Protection Officer has been appointed. Data protection questions can be sent to the contact above. This DPA applies automatically when the Customer accepts the Terms.