Legal
Data processing agreement
Our commitments as a processor in the cloud version.
This is not legal advice. It describes what the product actually does and can be used as a
starting point, but assessing your obligations is your counsel's job. The technical claims are
documented in detail in the
privacy documentation.
Scope
This page summarises what Vitrus commits to as a processor when you use the cloud version.
If you self-host, it does not apply — the data never reaches us.
Commitments
- Processing on instruction. We process the data only to provide the service.
- Purpose limitation. Your data is never used for advertising, sold or shared.
- Confidentiality. Staff with access are under confidentiality obligations.
- Sub-processors. Listed below; we notify you before that list changes.
- Deletion. On termination we delete the data on request. Session recordings are deleted
automatically after the retention you set, and you can delete any of them at any time.
- Session recordings only on your instruction. Replay is off until you enable it for a
site; text and input values are masked in the visitor's browser before transfer, and input
values are masked again on arrival.
- Breach notification. If we become aware of a breach we tell you without undue delay.
Sub-processors
| Who | Where | For what |
|---|
| Hetzner Online GmbH | Germany / Finland | Server hosting |
| Cloudflare, Inc. | Global | CDN, TLS, DDoS protection |
| Paddle.com Market Ltd. | United Kingdom | Payments and invoicing |
| Resend | US / EU | Transactional email |
LLM providers are deliberately absent from this list, because none are enabled by default.
If you turn one on, that provider becomes your sub-processor.
A signed copy
If you need a countersigned DPA, get in touch.