Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the Terms of Service (the “Agreement”) between Logiciel D’identité Skycloak inc., doing business as Skycloak (“Skycloak,” “we,” “us”), and the customer that agreed to the Agreement (the “Customer,” “you”). It sets out how we process personal data on your behalf when you use Skycloak.

This DPA applies automatically, with no signature needed, whenever we process Customer Personal Data that is subject to Data Protection Laws. If your procurement process needs a signed copy, email legal [at] skycloak.io with your company’s legal name and address and we will send you one countersigned.

1. Definitions

Terms used but not defined here have the meaning given in the Agreement or in the GDPR. In this DPA:

• “Account Owner” means the user shown as the owner of your account in the Skycloak dashboard.
• “Customer Personal Data” means personal data that we process on your behalf in providing the Service, mainly the data held in your Keycloak realms: the users who sign in through them, their credentials, attributes, sessions and events, and the content of webhooks, exports and backups that contain this data.
• “Data Protection Laws” means the laws on the protection of personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Personal Information Protection and Electronic Documents Act (Canada), Quebec’s Act respecting the protection of personal information in the private sector, Australia’s Privacy Act 1988, and the California Consumer Privacy Act as amended (the “CCPA”).
• “GDPR” means Regulation (EU) 2016/679.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while it is in our systems or those of our Subprocessors.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “Service” means the managed Keycloak service and the Skycloak dashboard and API provided under the Agreement.
• “Subprocessor” means a company we engage that processes Customer Personal Data.

2. Roles and scope

You are the controller of Customer Personal Data, or a processor acting for your own customers. We are your processor, or your subprocessor where you act as a processor. You are responsible for having a lawful basis for the processing and for the instructions you give us.

This DPA does not cover the data about your Skycloak account itself, such as the names, email addresses and billing details of the people who manage your account. We are the controller of that data, and our Privacy Policy describes how we handle it.

Annex I describes the processing: its subject matter, nature and purpose, the categories of data and data subjects, and its duration.

3. Processing on your instructions

We process Customer Personal Data only on your documented instructions, unless a law we are subject to requires otherwise, in which case we tell you before processing unless that law forbids it. Your instructions are the Agreement, this DPA, the way you configure and use the Service (for example the region you choose, the realms, clients and identity providers you set up, and the webhooks, exports and backups you turn on), and any other written instructions we agree with you.

We tell you promptly if we believe an instruction infringes Data Protection Laws.

4. Confidentiality

We give access to Customer Personal Data only to staff and contractors who need it to provide, support or secure the Service, and each of them is bound by a duty of confidentiality.

5. Security

We maintain the technical and organizational measures described in Annex II to protect Customer Personal Data against a Personal Data Breach. We may update these measures over time, as long as an update does not lower the overall level of protection.

You are responsible for the security settings you control in the Service, such as password and multi-factor authentication policies in your realms, the clients and redirect URIs you register, and who on your team has access to your Skycloak account.

6. Subprocessors

You give us general authorization to engage Subprocessors. Our current Subprocessors, what each does, and where each processes data are listed on our Subprocessors page, which forms Annex III.

Before we add or replace a Subprocessor, we update that page at least 30 days in advance. To also receive these notices by email, ask us at legal [at] skycloak.io and we send them to the address you give us. You may object on reasonable grounds related to data protection by emailing legal [at] skycloak.io within that notice period. We will then work with you in good faith on an alternative. If we cannot find one, you may terminate the affected part of the Service, and we will refund any fees you prepaid for the period after termination.

We impose on each Subprocessor data protection obligations that offer at least the same protection as this DPA, and we remain responsible to you for its performance of those obligations.

7. Personal Data Breaches

We notify the Account Owner without undue delay after we become aware of a Personal Data Breach.

Each notice describes, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures we have taken or propose. Where we cannot give all of this at once, we give it in stages as we learn more.

We take reasonable steps to contain the breach and limit its effects, and we help you meet your own obligations to notify supervisory authorities and data subjects. Our notice is not an admission of fault.

8. Assistance

The Service lets you act on most data subject requests yourself: you can find, export, correct and delete users and their data through the Keycloak admin console, the Keycloak admin API and the Skycloak dashboard. Where you cannot do so, we help you respond to requests from data subjects exercising their rights under Data Protection Laws. If a data subject contacts us directly about Customer Personal Data, we refer them to you and do not answer the request ourselves unless you ask us to.

Taking into account the nature of the processing and the information available to us, we also give you reasonable help with data protection impact assessments and prior consultations with supervisory authorities that concern the Service.

9. International transfers

You choose the region where your Keycloak clusters run. The Subprocessors page lists every location where Customer Personal Data is processed, including processing outside that region: for example, traffic passes through Cloudflare’s global network, webhook delivery and the dashboard run in our US East region, and Amazon Web Services keeps the database backups of the US regions in the United States. Skycloak itself is established in Canada.

Where Data Protection Laws require a transfer mechanism for a transfer of Customer Personal Data to us or by us to a Subprocessor, and the transfer is not covered by an adequacy decision, the following apply and are incorporated into this DPA by reference:

• EEA transfers: the SCCs, Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor. Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorization) applies, with the notice period set out in Section 6. The optional wording in Clause 11 does not apply. Under Clause 13, the supervisory authority is the one competent for you under the GDPR. Under Clauses 17 and 18, the SCCs are governed by the laws of Ireland and disputes are resolved by the courts of Ireland. Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.
• UK transfers: the SCCs as amended by the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018. Its Tables 1 to 3 are completed with the information in this DPA, and under Table 4 either party may end the Addendum as set out in its Section 19.
• Swiss transfers: the SCCs, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and the term “member state” read to include Switzerland so that data subjects there can enforce their rights in their place of habitual residence.

If the SCCs and this DPA conflict, the SCCs prevail.

10. Audits

We make available the information needed to show that we meet our obligations under this DPA. On request, and under a non-disclosure agreement, we provide our most recent third-party audit reports and penetration test summaries through trust.skycloak.io, and we answer reasonable security questionnaires.

You may also audit our compliance with this DPA, yourself or through an independent auditor bound by confidentiality. To keep an audit focused, it covers what the reports and answers above do not. You give us at least 30 days’ written notice, the audit takes place during business hours and no more than once in any 12 months, unless a Personal Data Breach or a supervisory authority makes another one necessary, and it does not reach the data of our other customers. Each party bears its own costs of an audit.

11. Return and deletion

You can export your Customer Personal Data at any time while the Agreement is in force and for 60 days after it ends, for example with realm exports from the Skycloak dashboard, and we help you do so on request. At the end of those 60 days, we permanently delete Customer Personal Data from the Service. Backups that contain it expire on their retention schedule, at most 30 days later, and until then they stay encrypted and are not used for any other purpose. A free trial that ends without a paid subscription is the exception: its data is deleted on the shorter schedule the Agreement sets for trials. These deletions do not apply where a law we are subject to requires us to keep the data, in which case we keep protecting it under this DPA.

12. US state privacy laws

Where the CCPA or a similar US state privacy law applies, we act as your service provider or processor. We do not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service under the Agreement, use it outside our direct business relationship with you, or combine it with personal data we receive from anyone else, except as those laws allow. We certify that we understand these restrictions and will comply with them, and we provide the same level of privacy protection those laws require of you. We tell you if we can no longer meet these obligations. You may take reasonable and appropriate steps to ensure we use Customer Personal Data in line with those laws, and, after notice to us, to stop and remediate any unauthorized use.

13. Canadian privacy laws

Where Canadian privacy laws apply, including Quebec’s Act respecting the protection of personal information in the private sector, we protect Customer Personal Data with safeguards suited to its sensitivity, use it only for the purposes of the Agreement, and tell you of any confidentiality incident involving it without undue delay, so that you can meet your own obligations.

14. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow such a limitation. If this DPA and the Agreement conflict on the processing of Customer Personal Data, this DPA prevails. If you have signed a separate data processing agreement with us, for example as part of a signed enterprise agreement, that agreement applies instead of this DPA. A countersigned copy of this DPA is not a separate agreement: it stays this DPA and changes under Section 15.

15. Term and changes

This DPA lasts for as long as we process Customer Personal Data for you. We may update it to reflect changes in Data Protection Laws or in the Service. We will not make a change that materially lowers the protection of Customer Personal Data without notice to the Account Owner at least 30 days before it takes effect, and the date at the top of this page shows when it last changed.

Annex I: Description of the processing

A. The parties

Data exporter: the Customer, as identified in its Skycloak account. Contact: its Account Owner. Activities: use of the Service under the Agreement. Role: controller, or processor for its own customers.

Data importer: Logiciel D’identité Skycloak inc. (Skycloak), 2001 Blvd Robert-Bourassa, Suite 1700, Montreal, Quebec H3A 2A6, Canada. Contact: legal [at] skycloak.io. Activities: providing the Service under the Agreement. Role: processor.

Each party signs this Annex by agreeing to the Agreement, or by signing a copy of this DPA.

B. The processing

Item	Description
Categories of data subjects	The end users who sign in through, or are registered in, the Customer’s Keycloak realms, such as the Customer’s own users, customers, employees and partners, and anyone else the Customer chooses to add.
Categories of personal data	Identifiers and profile data such as usernames, names and email addresses; credentials, stored as salted hashes, and one-time password and passkey registrations; any user attributes the Customer configures; group and role memberships; links to external identity providers; session and token data; IP addresses, user agents and authentication events; and personal data in webhooks, exports and backups that contain any of the above.
Sensitive data	The Customer decides what data it stores in its realms, including in user attributes. If that includes special categories of personal data, such as health data, the measures in Annex II apply, together with any Business Associate Agreement the parties sign.
Frequency of the transfer	Continuous, for as long as the Customer uses the Service.
Nature of the processing	Hosting and operating Keycloak for the Customer: storing, authenticating against, and serving identity data; sending events and webhooks; making backups; and support and maintenance.
Purpose of the processing	Providing, securing and supporting the Service under the Agreement.
Duration	The term of the Agreement, then until deletion under Section 11.
Transfers to Subprocessors	As listed in Annex III, for the purposes and in the locations described there, for the duration above.

Annex II: Technical and organizational measures

Area	Measures
Encryption	Data at rest is encrypted with AES-256, with hardware-backed key management and automated key rotation. Data in transit is encrypted with TLS, and traffic between our internal services uses mutual TLS. Backups and snapshots are encrypted.
Network protection	Cloudflare in front of every region for DDoS mitigation, web application firewall rules, rate limiting and TLS termination. Production regions are connected over a private, encrypted network.
Access control	Least-privilege access to production, reviewed every quarter. Multi-factor authentication is required on all internal systems.
Personnel	Confidentiality obligations for everyone with access to Customer Personal Data, and mandatory annual security awareness training.
Availability and recovery	Regular encrypted database backups, held by the providers and in the locations listed on the Subprocessors page, and documented disaster recovery procedures.
Vulnerability management	Keycloak upgrades and tracking of security advisories, and annual third-party penetration testing following the OWASP Testing Guide.
Monitoring and incident response	Monitoring and alerting on the production regions, with on-call paging, and a documented incident response process with defined notification timelines.
Customer controls	Realm settings the Customer controls, including password policies, multi-factor authentication, brute-force detection, session timeouts and event logging, described in our documentation.

Our Security page describes these measures in more detail.

Annex III: Subprocessors

The Subprocessors authorized under Section 6 are the companies marked “End-user and account data” on our Subprocessors page, as updated under that Section, with the services they provide and where they process data. The other companies on that page handle only account, billing or website visitor data, which this DPA does not cover.

Contact

For questions about this DPA, or to ask for a signed copy, contact us at legal [at] skycloak.io.