Data Processing Addendum
Effective: 24 August 2026.
This DPA forms part of the agreement between the customer ("Customer") and the provider identified in the applicable ServerOpsMCP order or invoice ("Provider") when Provider processes Personal Data on Customer's behalf. Controller, Processor and Personal Data have the meanings given by applicable data-protection law, including the GDPR where applicable.
1. Roles and scope
For Customer Personal Data processed from Customer-controlled servers, logs, files, repositories or operational systems to perform requested actions, Customer is the Controller (or Processor for another Controller) and Provider is the Processor (or Sub-processor). Provider's independent controller processing for billing, account administration, security and legal compliance is governed by the Privacy Policy.
2. Documented instructions
Provider will process Customer Personal Data only to provide, secure and support ServerOpsMCP in accordance with the agreement, Customer's configuration and documented instructions, unless applicable law requires other processing. If Provider reasonably believes an instruction violates applicable data-protection law, it may suspend affected processing and inform Customer where permitted.
3. Confidentiality
Provider will restrict access to Customer Personal Data to personnel and contractors who need it to operate/support the service and who are subject to appropriate confidentiality obligations.
4. Security
Provider will maintain technical and organizational measures appropriate to the risk, which may include strict host-key verification, least-privilege access, server-side secret handling, authenticated MCP/API access, explicit authorization/security modes, transport encryption, administrative logging, dependency/vulnerability management, backup controls and incident-response procedures. Customer remains responsible for target-server security, account privileges, credential lifecycle and backups.
5. Sub-processors
Customer authorizes Provider to use sub-processors for infrastructure hosting, storage, security/observability, support and other functions required to operate the service. Provider will impose materially comparable data-protection duties and remains responsible to the extent required by law. Material new sub-processors may be communicated through documentation or Customer contact; Customer may raise a reasonable data-protection objection within 14 days.
6. Customer-selected systems
Servers, GitHub repositories, cloud APIs and other systems Customer directs ServerOpsMCP to access are Customer-selected third parties or Customer systems and are not automatically Provider sub-processors. Customer is responsible for ensuring it has authority and a lawful basis to process data through those systems.
7. Data-subject requests
Taking into account the nature of processing, Provider will reasonably assist Customer with requests to exercise data-subject rights where Customer cannot fulfill them without Provider's help. Provider may refer requesters to Customer for Customer-controlled data.
8. Personal Data Breaches
Provider will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data and provide reasonably available information to support Customer's notification obligations. Notification is not an admission of fault or liability.
9. DPIAs and regulators
Provider will provide reasonable information and assistance, based on the processing and information available to Provider, for Customer's data-protection impact assessments and consultations with supervisory authorities related to ServerOpsMCP.
10. Deletion and return
At the end of services, Provider will delete or return Customer Personal Data according to Customer's available controls and documented request unless law requires retention. Data in protected backups may remain until normal backup rotation expires and will not be restored for routine use.
11. International transfers
Where GDPR-, UK GDPR- or Swiss-protected Customer Personal Data is transferred to a country without an applicable adequacy decision, the parties will use a lawful transfer mechanism. Where appropriate, the 2021 EU Standard Contractual Clauses are incorporated by reference using the module matching the parties' roles; UK-protected transfers will use the applicable UK addendum or successor mechanism.
12. Audit information
Provider will make available information reasonably necessary to demonstrate compliance with this DPA. If insufficient, Customer may request a reasonable audit no more than once annually, or following a material incident, subject to confidentiality, security, scope and scheduling safeguards. Audits must not expose other customers' data or materially disrupt service.
13. Customer obligations
Customer is responsible for lawful instructions, data minimization, required notices, account permissions, role-based access, secure credential configuration, retention choices and ensuring that use of AI agents for infrastructure operations complies with applicable employment, privacy, security and sector rules.
14. Liability and precedence
Liability under this DPA is subject to the agreement's liability provisions except where law requires otherwise. This DPA controls over conflicting agreement language specifically regarding Customer Personal Data processing.
Annex I — Processing details
Subject matter: controlled server/infrastructure operations exposed through MCP. Duration: service term plus configured audit/backup/legal retention. Data subjects: Customer personnel, application users, customers and other individuals whose data exists in Customer-controlled systems. Data categories: identifiers, server/account metadata, commands/tool arguments, filenames/paths, logs, health/process data, repository/deployment metadata, requested file contents, audit events and support data. Sensitive data: not intentionally required; Customer must avoid or appropriately protect special-category, secret or regulated data unless expressly agreed.
Annex II — Security measures
Measures may include host-key verification, least-privilege SSH users, explicit security modes, protected secrets, authenticated MCP/OAuth access, audit logging, network encryption, operational access controls, dependency review, backup/recovery practices and incident response.
Annex III — Sub-processor information
Provider may use infrastructure hosting, storage, security/observability and operational-support providers. Payment providers may independently process billing data. An up-to-date operational sub-processor list can be requested through the support contact shown in the service or purchase receipt.