Data processing

This agreement is part of the terms of service and applies to every organisation from the moment it exists, without a signature. An organisation that needs a signed copy asks for it at legal@pupitre.studio and receives it back, signed.

Parties and roles

The organisation is the controller of the personal data it brings to the platform. The processor is React Consulting SARL AU, a company established in Morocco, represented by its manager Jordan Monier, which publishes Pupitre. Where the applicable law calls those roles differently, the obligations below apply all the same.

Scope

The agreement covers the personal data we process on behalf of your organisation when you use the console, the app and the platform: your members’ accounts and sessions, their devices, the public halves of their keys and the approvals those devices sign for one another, the journal of the organisation, the metadata of your machines and the references of your backups listed in the privacy policy.

It does not cover the data that lives on your machines, nor your backups, nor the storage they live in. We have no access to it and no technical means of obtaining it: for that data, we are not your processor, and you are the only one at the controls, with the provider of that storage.

Details of the processing

• Subject matter and nature: hosting, keeping and displaying that data to run the console, the app and the platform.
• Duration: as long as the organisation exists, then until the deletion described below.
• Data subjects: the members of the organisation and the people it invites.
• Categories of data: email addresses, names, language, sign-in methods, IP addresses and devices of sessions, names and public keys of devices, key approvals signed by devices and the fingerprints of the keys each machine trusts or waits for, roles, the journal of the organisation, and what the terms list about machines and backups. No special category of data is expected; the platform asks for nothing of the kind.

Instructions

We process that data only to provide the service, on your documented instructions — these terms and what you do in the console — and for nothing else. We do not sell it, we do not share it for anyone’s own purposes, and we train no model on it. If an instruction seemed to us to break the law, we would tell you before acting on it.

Confidentiality

The people who can read the platform’s data are the members of the Pupitre organisation, each bound to confidentiality, and each reading of a sensitive thread is journaled.

Security measures

Encryption in transit and at rest. Sign-in by link, passkey or second factor. Sessions bound to the device that opened them. Access to production systems limited to the people who need it, and journaled. Secrets kept out of the code, injected by a password manager. Agent distributed as a signed binary, verified before installation. No inbound connection to your machines, no command executed on them, no file read on them. Dependencies watched for published vulnerabilities and updated within the day for the ones that sign you in.

Sub-processors

Sub-processor	Purpose	Region
Cloudflare, Inc.	Hosting of the site and the console, platform database (accounts, organisations, servers, licences, journal), storage of binaries and attachments, inbound and outbound email, audience measurement without a cookie or an identifier (Web Analytics)	United States company, global network; the database and the files in eastern North America
Stripe, Inc.	Merchant of record for licences beyond the free servers, the day they are sold; nothing is sent to it today	United States and Ireland

The same list, dated, lives on the sub-processors page. You are told by email before a sub-processor is added, and you may object to it; if we cannot meet the objection, you may delete your organisation before the change takes effect.

Transfers

All the data this agreement covers — accounts, sessions, devices, the organisation and its journal, the metadata and heartbeats of your machines, backup references, emails and the platform’s technical logs — is stored and processed by Cloudflare, a United States company; the database and the files are in Cloudflare’s Eastern North America region. The processor reads them from Morocco. This is a transfer outside Morocco and outside the European Union.

Every member of your organisation, when creating their account, gives their explicit consent to their data being stored and processed by Cloudflare in the United States. The processor records that consent with its date and the version of the text agreed to, and asks again when the text changes; a member withdraws it by deleting their account. Under Moroccan law 09-08, that consent is the basis of the transfer.

For an organisation established in the European Union or the United Kingdom, the transfer to the processor relies on the standard contractual clauses adopted by the European Commission by decision 2021/914, module two (controller to processor), which this agreement incorporates by reference with the organisation as data exporter and the processor as data importer, together with the United Kingdom addendum where it applies. The transfer to each sub-processor relies on the clauses and guarantees that sub-processor publishes in its own data processing terms.

Assistance and breaches

We help you answer requests from data subjects and meet the obligations that fall on you, within what the platform allows. We tell you without undue delay, and within seventy-two hours of learning it, about a personal data breach that affects your organisation, with what we know of its nature, its scope and the measures taken.

Audits

The documents evidencing our measures are provided on request. Once a year, and on thirty days’ notice, you or an auditor you mandate may verify them; the audit is at your cost and touches nothing that concerns another organisation.

Deletion

When you delete your organisation, or your account with the organisations where you were the only member, its data is deleted at once; a deletion we perform at your request is scheduled seven days ahead, then carried out. Before that, an export of your organisation’s data is handed to you on request. What accounting law will require us to keep, the day invoices exist, is kept for that reason and that duration only.

Getting a signed copy

Write to legal@pupitre.studio from the address of an owner of the organisation. You receive this agreement, dated and signed, with the standard contractual clauses completed for your organisation.