Data Processing Agreement
This Data Processing Agreement ("DPA") is entered into between AxosHub GmbH, acting as data processor ("Processor"), and the customer subscribing to the AxosHub cloud productivity workspace, acting as data controller ("Controller"). It forms part of the Terms of Service at /terms and takes precedence over any conflicting provisions therein with respect to the processing of personal data on behalf of the Controller.
1. Subject-matter and duration
The Processor processes personal data on behalf of the Controller for the sole purpose of providing the AxosHub cloud productivity workspace (the "Service") to the Controller and to its authorised users, in accordance with the Terms of Service. The processing continues for the duration of the subscription and terminates upon effective cancellation of the subscription in accordance with section 11 of the Terms.
2. Nature and purpose of processing
The nature of the processing consists in the storage, transmission, replication, indexing and display of the Controller's personal data through the notes, tasks and calendar surfaces of the Service, as well as authentication, session management, billing, and support-related processing incidental to operating the Service.
3. Types of personal data
The Processor processes the categories of personal data listed in section 2 of the Privacy Policy at /privacy: identification data, content data, billing data, session data and support data.
4. Categories of data subjects
The data subjects are the Controller's authorised users (workspace members) and the individuals whose personal data the Controller stores inside its workspace (contacts referenced in notes, calendar attendees, task assignees).
5. Controller instructions
The Processor processes personal data only on documented instructions from the Controller, including transfers of personal data to a third country or international organisation, unless required to do so by Union or Member State law to which the Processor is subject. The Terms of Service, the Privacy Policy and the configuration options of the workspace constitute the Controller's documented instructions.
6. Confidentiality
The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7. Security of processing
The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in the security whitepaper at /security-whitepaper. These measures include, among others: per-workspace 256-bit AES-GCM encryption at rest, TLS 1.3 in transit with modern cipher suites, role-based access control aligned with ISO 27001, immutable audit logging (365 days on Business plans), continuous replication to two additional availability zones within the home region, hourly point-in-time snapshots with 30-day retention, coordinated vulnerability disclosure programme, SOC 2 Type II certification with annual renewal.
8. Sub-processors
The Controller authorises the Processor to engage sub-processors. The current list of sub-processors is published below and is updated whenever it changes. The Processor notifies the Controller by email to the workspace address at least 30 days before onboarding a new sub-processor. The Controller may object to the new sub-processor within 30 days; if no reasonable alternative is available, the Controller's sole remedy is to cancel the subscription with a pro-rated refund of any pre-paid period.
Current sub-processor list
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Primary infrastructure (Frankfurt, Amsterdam) | Germany |
| OVH SAS | Sync region (Paris) | France |
| Atman S.A. | Sync region (Warsaw) | Poland |
| Stripe Payments Europe Ltd | Payment processing | Ireland |
| Postmark (ActiveCampaign LLC) | Magic-link email delivery | USA (SCCs in place) |
| Sentry GmbH | Error monitoring | Germany |
9. Assistance to the Controller
Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to data-subject requests under Articles 12 to 23 GDPR. The Processor further assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.
10. Personal-data breach notification
The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data. The notification is sent to the workspace admin email address and includes, to the extent then available, the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences and the measures taken or proposed to address the breach.
11. Deletion or return of personal data
Upon termination of the subscription, the Processor, at the choice of the Controller, deletes or returns all the personal data processed on behalf of the Controller, and deletes existing copies, unless Union or Member State law requires storage of the personal data. Return is effected via the workspace export function at /account. Deletion is effected via the erasure procedure at /workspace-deletion, subject to the 30-day grace period.
12. Audits and inspections
The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. In practice, the Processor makes available its SOC 2 Type II report under NDA on request, and answers written audit questionnaires within reasonable timeframes.
13. International transfers
The Processor does not transfer personal data outside the European Economic Area except (i) to sub-processors listed above and located in the USA, and (ii) as required by binding legal order. Transfers under (i) are governed by the standard contractual clauses adopted by the European Commission on 4 June 2021 (Decision 2021/914), with the supplementary measures documented in the security whitepaper.
14. Governing law
This DPA is governed by the law of the Federal Republic of Germany. The place of jurisdiction is Berlin, subject to the mandatory rules of the Controller's country of habitual residence for consumer contracts.
15. Technical and organisational measures — annex
The following table summarises the technical and organisational measures (TOMs) implemented by AxosHub in support of Article 32 GDPR. It is a summary; the full TOMs document is available under NDA on written request.
| Category | Measure |
|---|---|
| Access control (physical) | Data centres are operated by ISO 27001-certified sub-processors (Hetzner Frankfurt, OVH Paris, Hetzner Amsterdam, Atman Warsaw) with badge access, mantrap, CCTV and 24×7 on-site security. |
| Access control (logical) | Role-based access control aligned with ISO 27001, principle of least privilege, mandatory multi-factor authentication on every production console, quarterly access reviews. |
| Pseudonymisation | Workspace email addresses are hashed with argon2id and stored alongside a workspace UUID; plaintext is only held transiently while composing outbound emails. |
| Encryption at rest | Per-workspace AES-256-GCM keys derived from a master key stored in an HSM-backed KMS. Note bodies, task descriptions, calendar bodies and attachments encrypted. |
| Encryption in transit | TLS 1.3 only, X25519 + AES-256-GCM + SHA-384 cipher suite, HSTS with 12-month max-age and preload-list enrolment. |
| Confidentiality | Written confidentiality obligations on every AxosHub employee and every sub-processor. Ongoing security awareness training with annual refresh. |
| Integrity | Content-addressed intent objects, deterministic reconciliation, per-workspace hash verification on every fan-out apply, immutable 365-day audit log on Business plans. |
| Availability | Continuous replication to two additional availability zones per region, hourly point-in-time snapshots with 30-day retention, cross-region nightly snapshots on Business (90-day retention), 99.9 % target SLA. |
| Resilience | Automated failover between availability zones within a region, quarterly disaster-recovery drills documented in the SOC 2 Type II report. |
| Testing and evaluation | Continuous static analysis, dependency scanning, weekly automated penetration testing and annual external penetration testing by a third party. |
16. Data-subject request handling — timelines
Data-subject requests received by the Processor via /workspace-deletion (erasure), via the /account export flow (portability) or directly at dpo@axoshub.org (any other right) are processed within the following target timelines: access — five working days, rectification — three working days, erasure — the workspace is suspended within one working day and full erasure completes on day 30 as described in the blog post on erasure, restriction — one working day, portability — the export ZIP is produced within one hour, objection — three working days.
17. Notification of data-processing incidents
A personal-data breach is notified to the Controller without undue delay after AxosHub becomes aware of it, and in any case within 24 hours in accordance with our internal incident-response runbook. The notification includes, at minimum: the nature of the incident, the affected workspace(s) or the fact that all workspaces are affected, the categories and approximate number of data subjects concerned, the likely consequences, the measures already taken and the measures proposed, and a contact point (typically the DPO office). Subsequent updates are shared as the investigation progresses.
18. Contact
Notifications and requests under this DPA should be sent to dpo@axoshub.org. Postal address: AxosHub GmbH — Data Protection Officer, Chausseestraße 22, 10115 Berlin, Germany. Response targets: acknowledgement within one working day, substantive response according to the timelines above.