This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Customer”, the data controller) and Autonomy, operator of Descant (the data processor), and governs our processing of personal data contained in your Customer Content. It is available here at any time without manual request, and we will execute a countersigned copy on request.
Roles of the parties
The Customer is the controller of any personal data within Customer Content. Descant acts as the processor. Descant processes personal data in Customer Content on the Customer’s documented instructions to provide the services described in the Agreement. Those instructions include the work, settings and features the Customer authorizes.
Subject matter and duration
The subject matter is the processing necessary to provide Descant. Processing continues for the duration of the Customer’s use of the service and until Customer Content is deleted or returned as described below.
Nature and purpose of processing
Descant accesses repositories the Customer connects and runs automated agents that plan, implement, and review changes to the Customer’s code. Processing is limited to what is necessary for that purpose.
Categories of data and data subjects
Customer Content includes connected repository content, code and configuration, issue and pull-request text, task instructions, and related working context and outputs. Depending on what the Customer supplies, it may contain personal data about the Customer’s personnel and other individuals referenced in that content.
Processor obligations
- Process personal data only on the Customer’s documented instructions.
- Ensure personnel authorized to process the data are bound by confidentiality.
- Implement appropriate technical and organizational security measures, including tenant isolation so a run uses only its tenant’s credentials and never reaches another tenant’s repository. These measures are summarized in Schedule 1.
- Assist the Customer in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations.
- Delete or return Customer Content at the end of the service, save where retention is required by law.
Personal data breaches
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer’s behalf, and provide information and reasonable assistance required under applicable data-protection law.
To raise a concern about personal data, email [email protected]. To report a security vulnerability, use our contact form.
Return and deletion
At the end of the service, we will delete or return Customer Content as set out in Processor obligations, save where retention is required by law. Closing an organization stops its work and starts its data-handling process; deletion is completed through our erasure process.
Automated database backups are kept for seven days. A final snapshot taken if a database cluster is retired has no automatic expiry. Temporary run files expire within one to seven days, and service logs after 30 days.
Subprocessors
The Customer authorizes Descant to engage subprocessors to provide the service. Each subprocessor is bound by data-protection obligations no less protective than this DPA. Our subprocessor list identifies the subprocessors we engage, including our AI model providers, the services they provide and the types of data involved. We will provide notice of changes so the Customer may object.
International transfers
Where personal data is transferred across borders, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.
Audit
On reasonable request, we will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits conducted by the Customer or an appointed auditor, subject to confidentiality and security constraints.
Liability
Each party’s liability under this DPA is subject to the limitations set out in the Terms of Service.
Schedule 1: Technical and organizational measures
| Area | Measure |
|---|---|
| Access | Short-lived repository credentials scoped to the repository being worked on, with separate authoring and review identities. API access is scoped to the Customer’s organization and permitted operations. |
| Run isolation | Each authoring run uses its own temporary compute environment and repository checkout. Commands and tests execute in a separate sandbox from the services that call models and access repositories. |
| Encryption | The primary database, cache and run-artifact storage are encrypted at rest. Public access to run-artifact storage is blocked. |
| Network | The customer-code execution network uses private service endpoints, restricted DNS and controlled dependency sources. Services that reach GitHub and AI model providers operate under a separate network policy with outbound filtering. |
| Logging | Infrastructure activity is logged. |
| Recovery | Automated database backups, kept for seven days. |
| Retention and erasure | Records follow defined retention schedules. Deletion or anonymization is completed through the erasure process. |
| Incidents | Notification and assistance as set out in Personal data breaches. |
Contact us
To request a countersigned DPA or to ask about data processing, email [email protected]. Descant is a product of Autonomy — meetautonomy.com.