Data processing addendum

This data processing addendum (DPA) supplements your obsrv agreement and applies when obsrv processes personal data on your behalf. To execute a DPA, contact legal@obsrv.tech.

Roles

obsrv acts as a processor with respect to customer data submitted through the service. The customer is the controller for personal data contained in trace payloads.

Subject matter and duration

obsrv processes personal data only as necessary to provide the service, for the duration of the agreement.

Security

obsrv implements appropriate technical and organizational measures to protect customer data, including TLS in transit, encryption at rest, tenant-scoped storage paths, and least-privileged access controls.

Subprocessors

The current subprocessor list is published at /subprocessors. We give notice before adding a new subprocessor.

International transfers

obsrv supports the EU Standard Contractual Clauses for transfers of personal data outside the EEA. Customers can pin storage to EU regions on Pro and Enterprise plans.

Audits

obsrv provides a SOC 2 Type II report annually under NDA.