Audkit
DPA

Data Processing Agreement

Effective 10 September 2026

This DPA forms part of the Terms of Service and applies where Audkit processes personal data on your behalf. It takes effect automatically when you create an account; a countersigned copy is available on request at legal@audkit.dev.

1. Roles

You are the controller of the audit data your application sends to Audkit. Audkit is the processor, and processes that data only on your documented instructions — your use of the API and dashboard constitutes those instructions. Audkit is a separate controller for account data, governed by the Privacy Policy.

2. Subject matter and duration

Audkit processes audit data for as long as your account is open and your configured retention window requires. Processing consists of receiving, sealing, encrypting, storing, indexing, and returning audit events, and producing cryptographic proofs about them.

3. Categories of data and data subjects

The categories are determined by you, not by Audkit. Typically they comprise identifiers and activity records for the users, staff, agents, and systems of your application. The free-form metadata field may contain any personal data you choose to send. Audkit does not currently perform automatic PII detection or redaction, so you should not send special-category data unless you have satisfied yourself that the arrangements described here are adequate for it.

4. Security measures

Audkit implements the technical and organisational measures described on the Security page, which forms part of this DPA. In summary: encryption in transit and at rest with per-event keys, nonce-blinded payload commitments, database-level append-only enforcement, scoped and revocable API credentials, and independently verifiable Merkle commitments anchored to a public transparency log.

5. Subprocessors

You give general authorisation for Audkit to engage the subprocessors listed on the Security page. That list is the authoritative record. Audkit will publish material additions there and notify account owners by email; you may object on reasonable data protection grounds, and if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund.

6. International transfers

Audit data is processed in both the United States and the European Union. Transfers out of the UK/EEA rely on the Standard Contractual Clauses together with the UK Addendum where applicable, incorporated here by reference. Contact us before sending production data if you require processing confined to a single jurisdiction.

7. Data subject requests

Audkit will assist you in responding to data subject requests, taking into account the nature of the processing. One limit must be stated clearly, because it is a design property and not an oversight: Audkit is append-only and provides no endpoint to edit or delete an individual event. That is what makes the record evidential.

Erasure is therefore delivered through:

  • Retention. Setting a shorter window causes expired events to be crypto-shredded — the encrypted payload and its key are destroyed, leaving a skeleton that proves an event existed at a sequence without revealing what it was.
  • Project deletion, which removes the payloads for that project.

If your obligations require per-subject erasure on demand and faster than your retention window, the appropriate control is to avoid placing directly identifying data in event metadata — using a pseudonymous identifier you can resolve in your own system, and destroying that mapping instead.

8. Personal data breach

Audkit will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting your audit data, and will provide the information reasonably required for you to meet your own notification obligations.

9. Audits

Audkit will make available the information necessary to demonstrate compliance with this DPA. Audkit is not currently SOC 2 certified; pending that, the substitute we offer is stronger than a questionnaire answer — you can verify the integrity of your own log yourself, at any time, using the open-source audkit CLI and roots published to a log we do not control. Reasonable additional audit requests can be arranged on notice.

10. Deletion and return

On termination you may export all audit data for 30 days, after which it is deleted. Tree roots previously anchored to the public transparency log are permanent and cannot be withdrawn; they contain an opaque project identifier, an event count, a root hash, and a timestamp, and no event content.