This Data Processing Agreement ("DPA") is entered into between Aureus Hosting Technologies, Inc. ("Aureus", "Processor") and the customer ("Controller") and forms part of the Master Service Agreement or Order Form governing your use of Aureus services.
1. Definitions
"Controller" means the entity that determines the purposes and means of the processing of personal data (the customer).
"Processor" means the entity that processes personal data on behalf of the Controller (Aureus Hosting Technologies, Inc.).
"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable data protection law, including the GDPR and CCPA.
"Processing" means any operation performed on Personal Data, including collection, storage, retrieval, disclosure, or destruction.
"Sub-processor" means any third-party engaged by Aureus to process Personal Data on behalf of the Controller.
"Services" means the dedicated infrastructure, managed DevOps, and related services described in the applicable Order Form or Master Service Agreement.
2. Scope and purpose
This DPA applies to the processing of Personal Data that may be contained within customer data stored on Aureus-managed infrastructure. Aureus processes such data solely to provide the Services and only on documented instructions from the Controller.
Aureus does not sell, share for advertising purposes, or otherwise exploit Personal Data processed under this agreement.
3. Controller obligations
The Controller represents and warrants that:
- It has a lawful basis for processing Personal Data under applicable law
- It has provided all required notices and obtained all required consents from data subjects
- Its instructions to Aureus comply with applicable data protection law
- It will notify Aureus promptly if it becomes aware of any data subject complaint, regulatory inquiry, or data breach involving the Services
4. Processor obligations
Aureus agrees to:
- Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law
- Ensure that personnel authorised to process Personal Data are subject to binding confidentiality obligations
- Implement and maintain appropriate technical and organisational measures to protect Personal Data (see Section 6)
- Assist the Controller in responding to data subject rights requests to the extent technically feasible
- Notify the Controller without undue delay (and in any case within 72 hours) upon becoming aware of a Personal Data breach
- Provide all information reasonably necessary to demonstrate compliance with this DPA
- Delete or return all Personal Data upon termination of the Services, at the Controller's election, within 30 days
5. Sub-processors
Aureus may engage sub-processors to assist in providing the Services. Aureus maintains a current list of authorised sub-processors and will notify the Controller at least 30 days before adding or replacing any sub-processor. Current sub-processors include:
| Sub-processor | Purpose | Location | |---|---|---| | Bare metal infrastructure provider | Physical server infrastructure | European Union | | Cloudflare, Inc. | DDoS protection, DNS, network edge | United States | | Sentry (Functional Software, Inc.) | Application error monitoring (Aureus platform only) | United States |
The Controller may object to the use of a new sub-processor within 14 days of notification. If no agreement can be reached, the Controller may terminate the Services without penalty.
Aureus imposes data protection obligations on sub-processors equivalent to those set out in this DPA.
6. Technical and organisational security measures
Aureus implements and maintains the following measures to protect Personal Data:
Infrastructure isolation
- Dedicated physical servers per customer — no shared hardware with other tenants
- Network-level isolation between customer environments
- No shared kernel, hypervisor, or storage layer
Encryption
- All data at rest encrypted with AES-256
- All data in transit encrypted with TLS 1.3 minimum
- Backup archives encrypted before transmission and at rest
Access controls
- Privileged access to customer infrastructure limited to authorised Aureus staff
- Multi-factor authentication required for all internal systems
- Access logs maintained and reviewed
Backup and recovery
- Continuous WAL archiving with RPO < 5 minutes
- Daily base backups retained for 30 days
- Weekly automated restoration tests
Vulnerability management
- Continuous dependency scanning for known CVEs
- Security patches applied within defined windows based on CVSS severity
- Annual penetration testing of infrastructure
Full details of Aureus security practices are available at aureus.cx/security.
7. Data transfers
Where Personal Data is transferred outside the European Economic Area (EEA), Aureus ensures that such transfers are subject to appropriate safeguards under applicable law, including Standard Contractual Clauses (SCCs) as adopted by the European Commission.
Customers with data residency requirements should contact Aureus before onboarding to confirm applicable infrastructure regions.
8. Data subject rights
Aureus will assist the Controller in fulfilling data subject rights requests (access, rectification, erasure, restriction, portability) to the extent technically feasible given the nature of the Services. Requests should be directed to the Controller in the first instance. Aureus will respond to Controller requests for technical assistance within 10 business days.
9. Audit rights
The Controller may, upon 30 days' written notice and at its own expense, conduct an audit of Aureus's data processing activities, or commission an independent auditor to do so. Audits are limited to once per calendar year unless a Personal Data breach has occurred. Aureus may require the auditor to sign a confidentiality agreement before disclosing any information.
As an alternative to on-site audits, Aureus will provide copies of relevant certifications, security assessments, or audit reports upon request.
10. Liability
Each party's liability under this DPA is subject to the limitations set out in the Master Service Agreement. This DPA does not expand the maximum liability of either party beyond what is specified in the governing agreement.
11. Term and termination
This DPA is effective for the duration of the Services and terminates automatically upon expiry or termination of the Master Service Agreement. Sections relating to confidentiality, security, and post-termination data deletion survive termination.
12. Governing law
This DPA is governed by the laws of the State of California, United States, without regard to conflict of law principles. For customers subject to GDPR, this DPA is intended to satisfy the requirements of Article 28 of Regulation (EU) 2016/679.
13. Contact
For questions about this DPA or to exercise rights under applicable data protection law:
Aureus Hosting Technologies, Inc.
548 Market Street, Suite 62392
San Francisco, CA 94104-5401
[email protected]