PRODSovereign European BaaS platformOpen Dashboard →
GDPR Article 28 · Data Processing Agreement

Data Processing Agreement

GDPR contract establishing the legal framework for the processing of your personal data by Aurabase as a processor. Signable in one click from your Studio on the Pro plan.

Sign the DPA in one click
Studio → Settings → Compliance → "Sign DPA". Automatically counter-signed. Downloadable PDF, archived for 10 years.
Go to Studio
#
Parties

Who signs what

This DPA is an agreement between:

  • The Data Controller — you (or your company), the entity collecting and utilizing personal data via Aurabase.
  • The Data Processor — Aurabase SAS (Paris, France), which processes data on your behalf according to your instructions.
Info
The DPA template follows the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914). Customizable on Enterprise plans.
#
Purposes

What data, for what purpose

CategoryData concernedRetention period
End usersEmail, password hash, profile, sessions, IP, user-agentUntil account deletion
Application contentAll data stored in your Postgres tablesDuration of project + 30 days after deletion
FilesBinary objects stored in your Storage bucketsDuration of project + 30 days
Operational logsAggregated metrics, anonymized traces30 days (Pro) / 2 years (Enterprise)
BillingName, address, VAT number, payment history10 years (legal obligation)
#
Sub-processors

6 certified third parties

We utilize these sub-processors to deliver the service. Any sub-processor change is subject to a 30-day advance notice with the right to object.

Scaleway SASFrance (Paris fr-par-1, fr-par-2, fr-par-3)
Primary managed cloud hosting: Kubernetes Kapsule, PostgreSQL HA (RDB), S3 Object Storage, Redis, Load Balancer, and Cockpit
Safeguards: 100% EU Sovereign · ISO 27001, HDS, SecNumCloud-ready certifications · Scaleway DPA
Hetzner Online GmbHGermany (Nuremberg, Falkenstein)
Secondary compute infrastructure, Edge server nodes, and block volume storage
Safeguards: 100% EU Sovereign · ISO 27001 certification · Hetzner DPA
Mollie B.V.Netherlands (Amsterdam, EU)
Sovereign and secure payment processing (Credit Cards / Visa / Mastercard) and SEPA direct debits
Safeguards: 100% EU Sovereign · Dutch Central Bank (DNB) authorization · PCI-DSS Level 1 certification · Mollie DPA
Twilio Ireland LtdIreland (EU) / Global
SMS authentication routing and critical notification delivery
Safeguards: Twilio DPA · Binding Corporate Rules (BCR) · Standard Contractual Clauses (SCC)
Apple Inc. (APNs) & Google LLC (FCM)European Union & Global
Mobile push notification gateways for iOS and Android
Safeguards: End-to-end notification payload encryption · Standard Contractual Clauses (SCC)
Let’s Encrypt (ISRG)Global
Issuance and automatic renewal of TLS/SSL certificates
Safeguards: Open standard X.509 RFC 8555 (ACME)
#
Rights

Your rights as a data subject

  • Right of access — obtain a copy of your personal data in a structured format (JSON/CSV)
  • Right to rectification — correct your inaccurate data
  • Right to erasure — request deletion (subject to statutory legal obligations)
  • Right to data portability — receive your data in a machine-readable format
  • Right to object — reject specific processing activities (marketing, profiling)
  • Right to restriction — request temporary freezing of data processing during disputes
Astuce
Exercise these rights: privacy@aurabase.cloud — response within 30 days. For a full export, use the CLI command aura export --user <email> --format jsonl.
#
Notification

Data breaches

In the event of a breach affecting your data, we commit to:

  • Notify you without undue delay, and in any case within 48 hours
  • Detail the nature of the breach, the categories, and approximate volume of data affected
  • Share a comprehensive incident report within 5 business days
  • Cooperate with any mandatory legal notifications (CNIL, supervisory authorities)
#
Download

Get the complete PDF

PDF — Coming soonUnderstand your GDPR rights
The DPA will be available in PDF format shortly. Contact legal@aurabase.cloud for any inquiries.
ENTERPRISE?

A tailored DPA customized for your sector.

Specific clauses for healthcare (HIPAA), finance (PCI DSS), or defense. Contact our team.

No credit card required · 500 MB free · 50,000 MAU