Last updated: November 8, 2026
Data Processing Agreement
This Data Processing Agreement ("DPA") supplements the Terms of Service and is entered into between the customer identified below ("Controller") and FairForge LLC ("Processor", "Stored") pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Contents
- Definitions and Roles
- Processing Purposes
- Processor Obligations
- Security Measures
- Sub-processors
- Breach Notification
- Audit Rights
- Data Return and Deletion
- International Transfers
- Term and Termination
- Countersignature
Definitions and Roles
- Controller: The customer who determines the purposes and means of processing personal data by using the Stored service.
- Processor: FairForge LLC (Stored), which processes personal data on behalf of the Controller solely to provide the object storage service.
- Data Subjects: Individuals whose personal data is stored as objects or metadata within the Controller's Stored account.
Processing Purposes
The Processor processes personal data solely for the following purposes, as instructed by the Controller:
- Storage, persisting objects uploaded by the Controller via the S3-compatible API.
- Delivery, serving objects to authorized requesters via API or CDN.
- Caching, temporarily caching object metadata for performance optimization.
The Processor does not access, analyze, profile, or otherwise process the content of stored objects beyond the technical operations listed above.
Processor Obligations
The Processor shall:
- Process personal data only on documented instructions from the Controller.
- Ensure that personnel authorized to process personal data are bound by confidentiality obligations.
- Implement appropriate technical and organizational security measures.
- Assist the Controller in responding to data subject requests (access, portability, erasure, rectification).
- Assist the Controller with data protection impact assessments where required.
- Delete or return all personal data upon termination of the service, at the Controller's choice.
- Make available all information necessary to demonstrate compliance with Article 28.
Security Measures
The Processor implements the following technical and organizational measures:
- Encryption in transit, all API and dashboard traffic is encrypted via TLS 1.2 or higher.
- Encryption at rest, available under Controller-supplied keys (SSE-C) or client-side encryption; server-managed encryption at rest (SSE-S3) is implemented but not yet enabled in production. Objects held by storage sub-processors are subject to those providers' own at-rest encryption.
- Access controls, production access is limited to authorized personnel via SSH key authentication. Customer data access requires S3 credentials (access key + secret key) or authenticated dashboard session.
- Authentication, passwords hashed with bcrypt (cost 10), TOTP two-factor authentication available, session tokens are cryptographically random, dashboard accounts lock for 15 minutes after 10 failed sign-ins.
- Monitoring, S3 access logs retained 30 days, developer request records 7 days, event and usage records 90 days, public-link access logs 2 days after aggregation, webhook delivery records 30 days, agent connection records (an AI agent's registration with our sign-in service 30 days after its last use, the internet address it was registered from 2 days, its one-time sign-in codes 24 hours), team and family invitations 30 days after they were accepted or expired, payment-provider event records 90 days, data-export files 7 days (all purged automatically by a nightly job); the payment ledger (amounts, periods bought, receipt numbers) is kept as the accounting record and, on an account erasure, loses every link to the account and any cryptocurrency address or transaction id; every sign-in outcome, credential change and administrative action is written to an audit log; authentication-failure bursts page the operator.
- Backups, database backups: a daily copy kept 7 days on the production host and 30 days off it, encrypted, and a continuous encrypted archive for point-in-time recovery reaching back 28 days; object data itself lives with the storage sub-processors, not in these backups.
Sub-processors
The Controller authorizes the Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| iDrive Inc. | Object storage, Standard tier, for a bucket in a region other than the default; a second copy of default-region objects, in the United States, when one is kept | United States / EU / United Kingdom / Japan / Singapore (the bucket's region) |
| Seagate Technology (Lyve Cloud) | Object storage, Standard tier in the default region, resilient tier, failover; the parity second copy of Vault-tier objects | United States |
| Geyser Data Inc. | Tape archive, Vault tier (all regions) | United States (Los Angeles) |
| Cloudflare Inc. | CDN, DDoS protection, TLS; the bytes of uploads to the S3 endpoint s3.stored.cloud in transit through its edge; R2 storage for public-read buckets and the encrypted point-in-time archive of the database | Global (edge network) / United States |
| Microsoft Corporation | Cloud storage infrastructure: internal parity copies, when enabled | United States |
| Sync.com Inc. | The encrypted off-site copy of the database backups; a standby location for the parity copies of Vault-tier objects | Canada |
| Blomp | A second encrypted off-site copy of the database backups | United States |
| Stripe Inc. | Payment processing | United States |
| Resend Inc. | Transactional e-mail, when enabled | United States |
| Google LLC / GitHub Inc. | OAuth sign-in (only if used) | United States |
The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor, giving the Controller the opportunity to object.
Breach Notification
In the event of a personal data breach, the Processor shall:
- Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach.
- Provide details of the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate the breach.
- Cooperate with the Controller in notifying the relevant supervisory authority and affected data subjects where required.
Audit Rights
The Controller has the right to audit the Processor's compliance with this DPA. Audits may be conducted:
- No more than once per calendar year, with at least 30 days' written notice.
- During normal business hours, at the Controller's expense.
- By the Controller or a mutually agreed independent third-party auditor bound by confidentiality.
The Processor will provide reasonable cooperation, including access to relevant documentation, facilities, and personnel.
Data Return and Deletion
Upon termination of the service agreement:
- The Controller may export all stored data via the S3-compatible API or the data export feature in account settings.
- After the 30-day grace period following an account deletion request, the account is closed, the subscription is cancelled and the Processor's automated deletion job erases the Controller's objects, metadata and account records from production on that date; database backups age out within 30 days of the erasure. Large objects are stored in deduplicated blocks: the blocks of the Controller's objects are released on that date and deleted by the storage collector once its seven-day safety period has passed, except a block that is byte-for-byte identical to one another Controller stores, which remains as that Controller's data.
- The Processor will provide written confirmation of deletion upon request.
International Transfers
Where personal data is transferred outside the European Economic Area, the Processor ensures adequate protection through Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Implementing Decision (EU) 2021/914). The applicable SCCs are incorporated by reference into this DPA.
Term and Termination
This DPA takes effect when the Controller begins using the Stored service and remains in effect for the duration of the service agreement. The data protection obligations in this DPA survive termination of the service agreement until all personal data has been deleted or returned.
Countersignature
To execute this DPA, please complete the following and send a signed copy to privacy@stored.cloud:
| Customer Name: | ________________________________________ |
| Customer Address: | ________________________________________ |
| Authorized Signatory: | ________________________________________ |
| Signature Date: | ________________________________________ |
For FairForge LLC:
| Entity: | FairForge LLC |
| Address: | Salt Lake City, Utah, United States |
| Contact: | privacy@stored.cloud |