Processor role: You retain controller authority; Tritonium processes strictly under documented instructions.
Data-processing terms: Read our processing terms and contact privacy@tritonium.com with questions about international transfers.
Transparent operations: Published subprocessor list, change notifications, and a contact for questions about currently verified evidence.
Your rights: Data subject requests, deletion and return at exit, all handled by our team on request.

What this agreement covers

Purpose-limited processing to deliver and improve contracted Tritonium services; no secondary monetization.
No combination with third-party datasets without your written consent.
Data residency honored when technically feasible; transfers governed by SCCs/UK Addendum with supplementary safeguards.
Return or deletion on exit can be requested; confirm scope, timing, backup handling, and any available completion records.

Our commitments to you

Tritonium acts as your processor; you remain controller with full instruction rights.
EU SCC Module 2 and the UK Addendum executed by default for international transfers.
Confidentiality obligations for all personnel with role-based access and enforced MFA.
Records of processing and DPIA support. Per-region isolation remains a roadmap item.

Categories of personal data processed under this agreement.

Names, work emails, roles, MFA configurations, authentication, and administrative audit logs.
Billing contacts and configuration metadata required for invoicing, support, and compliance.

App reviews, ratings, crash text, attachments, metadata, and custom payloads you ingest.
Workflow tags, enrichment, and insights generated by Tritonium to operate the platform.

Usage analytics, performance diagnostics, and change history needed to protect the Service.
Security events, incident artifacts, and compliance evidence maintained for auditability.

Encryption in transit (TLS 1.2+) and at rest (AES-256); keys isolated per environment.
Least-privilege access with enforced MFA and quarterly access recertification.
Immutable audit logging for admin actions, with security event review and incident response procedures.
Business continuity and disaster recovery testing for critical services with RPO/RTO targets.
No completed SOC 2 certification is claimed. Independent test scope, dates, findings, and report availability must be confirmed.

24x7 monitoring with on-call escalation; triage and containment runbooks executed on detection.
Notice to customers without undue delay and within contractual SLA, including initial impact summary.
Joint investigation, forensics support, available incident records, and final root cause analysis with preventive actions.

Current list of subprocessors engaged to provide the Service. Subscribe for change notifications.

Subprocessor	Purpose	Location	Data categories	Safeguards
Amazon Web Services, Inc.	Hosting, compute, storage, networking, message queues, databases	USA (us-east-1)	All customer data stored or processed through the Service	SOC 2, ISO 27001, encryption at rest/in transit, regional isolation
Stripe, Inc.	Billing and payment processing for Tritonium subscriptions	USA	Billing contact information, payment method tokens (no full card numbers stored)	PCI-DSS Level 1, SOC 2, TLS encryption
Customer.io / Mailgun Technologies	Transactional email delivery (alerts, account notices)	USA	Email addresses, notification metadata, message content	SOC 2, TLS in transit, dedicated sub-accounts with scoped keys

Access, rectification, erasure, restriction, objection, and portability supported for covered data.
Opt-outs for certain automated processing where applicable; human review available for edge cases.
Deletion or return upon termination is handled on request; confirm scope, timing, backup handling, and available completion records.

Handled by our team

Data subject requests: Email privacy@tritonium.com and we verify your identity, search across data domains, and respond within 24 hours.
Retention & deletion: We retain data while your subscription is active. Deletion and legal hold are handled by our team on request.
Evidence on request: Ask which penetration-test, continuity, disaster-recovery, access-review, or SOC 2 evidence is currently verified and available for your requested scope.

Our standard DPA includes EU SCCs, UK Addendum, and covers all Tritonium services.

Enterprise customers can request custom terms and additional addenda.

Execute DPA Read privacy policy