Data Processing Agreement
Last updated
Effective date
This Data Processing Agreement ("DPA") forms part of, and is subject to, the Cloud Service Agreement or the Terms of Service (the "Principal Agreement") between the customer identified in the Principal Agreement ("Customer") and Duplicati Inc, 548 Market Street, PMB 28852, San Francisco, CA 94104, United States ("Duplicati"), together the "Parties". It applies to every Customer established in the European Economic Area, the United Kingdom, or Switzerland, and to any other Customer on whose behalf Duplicati processes personal data subject to Data Protection Laws, from the date Customer accepts the Principal Agreement. No signature is required; a countersigned copy is available on request to security@duplicati.com.
Recitals
Customer uses the Services (defined below) to back up and manage data on its own systems, and in doing so Duplicati processes certain personal data on Customer's behalf.
Customer acts as a controller (or as a processor on behalf of its own customers) and Duplicati acts as a processor (or sub-processor) of that personal data.
The Parties enter into this DPA to meet the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR, and other applicable Data Protection Laws.
Where Customer has also executed a HIPAA Business Associate Agreement with Duplicati, that agreement governs Protected Health Information and prevails over this DPA to the extent of any conflict in relation to it; this DPA governs all other personal data.
1. Definitions
1.1 Terms defined in the GDPR (including "controller", "processor", "data subject", "personal data", "personal data breach", "processing", and "supervisory authority") have the same meaning here.
1.2 In this DPA:
"Data Protection Laws" means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection or privacy law applicable to the processing of Customer Personal Data.
"Customer Personal Data" means personal data that Duplicati processes on Customer's behalf in connection with the Services, as described in Annex 1.
"Services" means the Duplicati Console, Duplicati Enterprise software, Duplicati-provided backup storage, the managed backup service, and related support, as provided under the Principal Agreement.
"Sub-processor" means any third party engaged by Duplicati to process Customer Personal Data.
"Confidential Organization" means an organization within Customer's Console account that was created in confidential processing mode or that Duplicati has converted to it at Customer's request, with the effects described in Annex 2, Part B; confidential processing cannot be switched off once set.
"Standard Contractual Clauses" means the clauses adopted by the European Commission in Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.
2. Processing on Customer's Instructions
2.1 Duplicati shall process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to third countries, unless required to do so by law to which Duplicati is subject, in which case Duplicati shall inform Customer of that legal requirement before processing unless the law prohibits such information.
2.2 Customer's instructions are set out in the Principal Agreement, this DPA, Annex 1, and Customer's use of the Services' configuration options. Additional instructions must be in writing and agreed by both Parties, and may be subject to additional fees where they go beyond the Services.
2.3 Duplicati shall inform Customer immediately if, in its opinion, an instruction infringes Data Protection Laws. Duplicati may suspend performance of that instruction until Customer confirms or modifies it.
2.4 Customer warrants that it has a lawful basis for the processing, that it has provided any notices and obtained any consents required, and that its instructions comply with Data Protection Laws.
2.5 Each Party shall comply with Data Protection Laws in relation to Customer Personal Data.
3. Personnel
Duplicati shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received appropriate training, and process Customer Personal Data only to the extent necessary for the Services. Duplicati's personnel are bound by its Workforce Confidentiality and HIPAA Compliance Agreement.
4. Security
4.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of natural persons, Duplicati shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate the measures referred to in Article 32(1) GDPR. The measures in force at the effective date are described in Annex 2.
4.2 Duplicati may update the measures in Annex 2 from time to time provided the updates do not materially reduce the overall level of protection.
4.3 Customer is responsible for the security of its own systems on which the Duplicati software runs, for choosing and safeguarding backup encryption passphrases, for configuring the Services appropriately for the data it backs up, and for deciding whether to use a Confidential Organization.
5. Sub-processors
5.1 Customer gives general authorisation for Duplicati to engage the Sub-processors listed in Annex 3 for the purposes stated there.
5.2 Duplicati shall give Customer at least 30 days' prior written notice of any intended addition or replacement of a Sub-processor that will process Customer Personal Data, by email to Customer's account owner or by a published list with a subscription mechanism. Customer may object on reasonable grounds relating to data protection within that period. If the Parties cannot resolve the objection in good faith, Customer may terminate the affected Services on written notice without penalty, and Duplicati will refund any prepaid fees for the period after termination.
5.3 Duplicati shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains liable to Customer for the Sub-processor's performance.
5.4 Storage providers that Customer selects and contracts with directly for its own backups are not Sub-processors of Duplicati.
6. Data Subject Rights
6.1 Taking into account the nature of the processing, Duplicati shall assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests from data subjects exercising their rights under Data Protection Laws. Because backup contents are encrypted with keys Duplicati does not hold, such assistance will ordinarily consist of deleting backup data or Console records on Customer's instruction, or providing Console account data.
6.2 Duplicati shall promptly notify Customer if it receives a request from a data subject relating to Customer Personal Data and shall not respond except on Customer's documented instructions or as required by law.
7. Personal Data Breach
7.1 Duplicati shall notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Duplicati becomes aware when the breach is known to Duplicati or its workforce; Sub-processors are independent contractors and their knowledge is not imputed to Duplicati until reported.
7.2 The notification shall describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and shall be supplemented as further information becomes available. Because Duplicati cannot read backup contents, identification of affected data subjects will ordinarily be made by Customer from the organizations and machines Duplicati identifies.
7.3 Duplicati shall cooperate with Customer and take reasonable steps as directed by Customer to assist in the investigation, mitigation, and remediation of the breach. Notification under this Section is not an admission of fault or liability.
8. Data Protection Impact Assessment and Prior Consultation
Duplicati shall provide reasonable assistance to Customer with any data protection impact assessment and any prior consultation with a supervisory authority that Customer reasonably considers required under Articles 35 or 36 GDPR, in each case solely in relation to the processing of Customer Personal Data by Duplicati and taking into account the information available to Duplicati.
9. Deletion or Return
9.1 On termination or expiry of the Services, or on Customer's written request, Duplicati shall, at Customer's choice, return Customer Personal Data to Customer or delete it, and delete existing copies, within 30 days, unless law requires storage. For backup data on Duplicati-provided storage, "return" means continued availability for download by Customer during the 30-day period, after which it is deleted; Customer's destruction of its encryption passphrase renders the data unreadable immediately.
9.2 On request, Duplicati shall confirm deletion in writing within 10 business days after the 30-day period.
9.3 Duplicati may retain Customer Personal Data to the extent required by law and only for as long as so required, applying the measures in Annex 2 to it.
10. Audit
10.1 Duplicati shall make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.
10.2 Duplicati will satisfy Section 10.1 in the first instance by providing its current security documentation, third-party audit reports or certifications where held (including any SOC 2 report), and written responses to reasonable questions. Where these do not reasonably satisfy Customer's requirements under Data Protection Laws, Customer may conduct an on-site or remote audit no more than once per 12 months (or more often following a personal data breach or at the request of a supervisory authority), on at least 30 days' notice, during business hours, subject to confidentiality obligations and at Customer's expense, and without access to other customers' data.
11. International Transfers
11.1 Customer Personal Data is stored and processed in the locations stated in Annex 3. Duplicati shall not transfer Customer Personal Data outside the EEA, the UK, or Switzerland, or permit a Sub-processor to do so, except as stated in Annex 3 or with Customer's prior written authorisation, and only where a valid transfer mechanism under Data Protection Laws is in place.
11.2 Duplicati Inc is established in the United States. To the extent Customer Personal Data is transferred to Duplicati (including by Duplicati's remote access to systems in the EEA):
(a) Data Privacy Framework. Duplicati is certified under the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (together the "DPF"), as listed at https://www.dataprivacyframework.gov, and shall maintain that certification and comply with the DPF Principles for the term of this DPA. Transfers of Customer Personal Data to Duplicati are made in reliance on the DPF. Duplicati shall notify Customer promptly if its certification lapses or is withdrawn.
(b) Fallback: Standard Contractual Clauses. If, and from the date on which, Duplicati's DPF certification lapses or is withdrawn, or the DPF is invalidated or ceases to be a valid transfer mechanism under Data Protection Laws, the Standard Contractual Clauses, Module Two (controller to processor), are incorporated into this DPA automatically and without further action by either Party, with Customer as data exporter and Duplicati as data importer; Clause 7 (docking) applies; Clause 9(a) Option 2 (general authorisation) applies with the notice period in Section 5.2; Clause 11 optional language does not apply; Clause 17 Option 1 applies with the law of Ireland; Clause 18 courts of Ireland; Annex I is completed by Annex 1 and the Parties' details; Annex II by Annex 2; Annex III by Annex 3. For transfers subject to the UK GDPR, the UK Addendum is incorporated with Table 4 permitting either Party to end it, and for Switzerland the Clauses are read with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.
11.3 Where Customer is itself a processor acting for its own customers, Customer confirms it is authorised to enter into this Section on their behalf.
12. General
12.1 Liability. Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Principal Agreement, except that nothing limits liability that cannot be limited under Data Protection Laws, including liability to data subjects under Article 82 GDPR.
12.2 Precedence. In the event of conflict, the Standard Contractual Clauses (where they apply) prevail over this DPA, this DPA prevails over the Principal Agreement in relation to Customer Personal Data, and the HIPAA Business Associate Agreement (where executed) prevails over this DPA in relation to Protected Health Information.
12.3 Changes in law. The Parties shall negotiate in good faith any amendment needed to maintain compliance with Data Protection Laws, including replacement of a transfer mechanism that is invalidated.
12.4 Changes to this DPA. Duplicati may update this DPA by publishing a new version; material changes take effect for existing Customers 30 days after notice, as provided in the Principal Agreement, and the version in force at any time is the one published at [URL].
12.5 Notices. Notices under Sections 5, 7, and 9 are sent to Customer's account owner email address and, for Customers who have designated one, their notice contact; Duplicati's notice address is security@duplicati.com. Duplicati has appointed Prighter Group as its representative in the EU under Article 27 GDPR (Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria), in the UK under Article 27 UK GDPR (Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom) and in Switzerland under Article 14 FADP (Prighter CH GmbH, Obergrundstrasse 17, 6003 Lucerne, Switzerland); supervisory authorities and data subjects may address Duplicati through them at https://app.prighter.com/portal/duplicati.
12.6 Term. This DPA takes effect when Customer accepts the Principal Agreement and continues for as long as Duplicati processes Customer Personal Data.
13. Governing Law
This DPA is governed by the law of, and subject to the courts of, the jurisdiction stated in the Principal Agreement, except where the Standard Contractual Clauses or Data Protection Laws require otherwise.
Annex 1. Details of Processing
Item | Description |
|---|---|
Subject matter | Provision of backup software, a hosted management console, optional backup storage, and optional managed backup of cloud productivity accounts |
Duration | The term of the Principal Agreement, plus the deletion period in Section 9 |
Nature and purpose | Receiving and storing encrypted backup data on Customer's instruction; receiving job metadata and (for non-Confidential organizations) log data from Customer's machines; relaying remote-management sessions; sending service notifications; providing support; billing; keeping immutable audit records of security-relevant operations |
Categories of data subjects | Customer's employees and administrators who use the Console; and, as content of backups, any persons whose data Customer backs up (Customer's employees, customers, patients, users). Backup content is encrypted and not accessible to Duplicati |
Categories of personal data | Console users: name, email address, identity-provider identifier, role, IP address, usage logs. Machines: hostnames, machine identifiers, operating system, backup configuration. Standard organizations: log messages and file paths that may contain personal data. Backup content: any category, as encrypted ciphertext. Managed backup: mailbox, calendar, and drive contents of Customer's users, processed in memory and stored encrypted |
Special categories | Not intentionally processed. Backup content may contain special-category data (including health data) as ciphertext; readable special-category data is processed only where Customer uses the managed backup service, and never for Confidential Organizations |
Frequency | Continuous for the term |
Retention | Per Section 9 and Duplicati's retention policy: backup data on Duplicati-provided storage for the subscription term and 30 days after; Console metadata and reports 36 months rolling or until the organization is deleted; application logs 30 days; account data 30 days after account closure; audit records of security-relevant operations (identifiers only) 6 years |
Annex 2. Technical and Organisational Measures
Part A, all customers
Client-side encryption. Backup data is encrypted on Customer's systems with AES-256 before transmission, using a passphrase Customer chooses. Decryption occurs only on Customer's systems. File names, directory structures, and contents are contained within the encrypted volumes; storage providers receive only encrypted blocks.
Key management. By default Customer alone holds the passphrase and neither Duplicati nor any Sub-processor can decrypt backup data. Where Customer elects to store a passphrase in the Console (not available for Confidential Organizations), it is encrypted at rest, protected by role-based access and multi-factor authentication, and used only for operations Customer requests.
Transport security. All connections between Agents, the Console, storage, and users use TLS 1.2 or higher.
Identity and access. Console sign-in is federated (GitHub, Apple, Google, Customer SSO, Azure B2C); Duplicati stores no passwords. Multi-factor authentication on all Duplicati vendor and administrative accounts; access limited to a named administrator; quarterly access reviews. A Duplicati administrator may impersonate a customer user for troubleshooting; impersonation can view Console metadata and stored reports but cannot open a remote-management session to a customer machine, obtain a storage key, or read backup data, and each impersonation is written to an immutable audit log with both identities. These limits are enforced in code for all organizations.
Logging and monitoring. Services log identifiers, timings, and reason codes only; no request bodies, payloads, or user-supplied strings. Security-relevant operations (organization creation with its confidential-processing setting, conversion of Confidential Organizations, storage key issuance and revocation, machine enrolment, rejected reports, remote-control access, impersonation, organization deletion) are written to an audit log under compliance-mode object lock that the application can write but not alter; administrative actions are alerted; logs are reviewed quarterly for personal data.
Change control. Production is deployed only from recorded tags by a manually triggered workflow that runs regression tests on the controls in Part B and blocks deployment if they fail; each run is independently timestamped and retained immutably for six years; changes to those controls carry a documented self-review and a 24-hour hold.
Vulnerability management. Automated dependency scanning with remediation targets by severity; monthly image rebuilds; public vulnerability disclosure policy.
Software integrity. Releases are signed (Authenticode on Windows, Apple notarisation on macOS, GPG on all files); the Agent verifies a signed manifest before download and the file hash after, rejecting any mismatch.
Infrastructure. Hosting with providers holding SOC 2 or ISO 27001 attestations; services run on DigitalOcean App Platform, which exposes only declared ports through its managed ingress; secrets held in platform configuration, not in code; Managed PostgreSQL with automated backups and point-in-time recovery; report objects encrypted by the application before upload to Spaces, so the storage provider holds no readable reports; Spaces buckets private with no public listing.
Personnel and devices. Written confidentiality agreement; annual training; full-disk encryption, screen lock, current patches, and built-in protection on all devices; home-office only, no printed customer data.
Incident response. Written plan with detection sources, containment playbooks, a defined awareness point, and notification templates; breach notice to Customer within 48 hours.
Business continuity. Agents and restores operate independently of the Console; deployable state reproducible from version control and the container registry; annual restore test.
Part B, Confidential Organizations (on request)
Agents transmit only structured metadata (status, timestamps, sizes, counts, exception types, help identifiers); no log text, file paths, or file names.
The Console ingress verifies every submission and rejects non-conforming submissions without storing or logging their content, notifying the organization owner.
Agents that do not support reduced reporting cannot be enrolled.
Remote-management sessions are encrypted end to end between the Agent and the user's browser; Duplicati's relay forwards ciphertext and holds no key.
Console-stored passphrases and the managed backup service are disabled; Duplicati holds no decryption key for the organization's data.
Customer selects confidential processing when creating an organization; existing organizations are converted only by a Duplicati administrator after the owner confirms in writing that no regulated data was placed in them beforehand. Confidential processing cannot be removed by anyone.
Annex 3. Sub-processors
Sub-processor | Entity and location | Purpose | Data processed | Processing location |
|---|---|---|---|---|
DigitalOcean, LLC | New York, US | Hosting of the Console application, ingress, remote-management relay (App Platform), database (Managed PostgreSQL), and report storage (Spaces; reports encrypted by the application before upload) | Console user data, machine metadata, reports (encrypted), standard-organization log data, Console-stored keys where enabled | Amsterdam, Netherlands. Transfer mechanism for Duplicati's and DigitalOcean's US access: DigitalOcean DPA with Standard Contractual Clauses |
IDrive Inc. | Calabasas, US | Object storage for Duplicati-provided backup storage | Encrypted backup data only | The Console selects the IDrive e2 data centre nearest to Customer (by IP geolocation) when Duplicati-provided storage is created, which for customers in the EEA, UK, or Switzerland is ordinarily a European data centre; Customer may instead choose any data centre IDrive offers, and that choice is Customer's documented instruction for the purposes of Section 11.1. The current list of data centres is available on request. Transfer mechanism: IDrive DPA with Standard Contractual Clauses |
Google LLC | Mountain View, US | (a) Managed backup service runtime; (b) OAuth token handling for third-party storage connections | (a) Contents of Customer's cloud productivity accounts, in memory, stored encrypted; (b) transient OAuth tokens and connection metadata | (a) europe-west1, Belgium; (b) Google global infrastructure, transient. Transfer mechanism: Google Cloud Data Processing Addendum with Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework |
Amazon Web Services, Inc. | Seattle, US | Immutable storage of audit and deployment records | Account, organization, and machine identifiers and event types only; no names, content, or keys | eu-north-1 (Stockholm, Sweden). Transfer mechanism: AWS Data Processing Addendum with Standard Contractual Clauses; Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework |
OpenAI OpCo, LLC | San Francisco, US | Generation of backup report summaries and periodic organization reports (not used for Confidential Organizations). Transfer mechanism: Standard Contractual Clauses incorporated in the OpenAI Data Processing Addendum (section 4; UK Addendum for UK data) | Organization name, machine names and identifiers, backup identifiers and statuses, and report content of standard organizations | United States |
Bird.com Inc. (SparkPost) | Amsterdam, NL | Delivery of service and notification emails (Duplicati's account is on SparkPost's US platform) | Console user email addresses, names, notification content (status, backup names, machine identifiers) | United States. Transfer mechanism: Standard Contractual Clauses (Module 2) incorporated in the Bird DPA, s. 9.3.1 |
Better Stack s.r.o. | Prague, CZ | Application log aggregation and uptime monitoring | Identifiers (organization, machine, user IDs), timings, error codes; no content. Processed in the European Union; no transfer | European Union; no transfer |
Zendesk, Inc. | San Francisco, US | Support ticketing. Transfer mechanism: Zendesk DPA with Standard Contractual Clauses; Zendesk, Inc. is certified under the EU-US Data Privacy Framework | Contact details and correspondence of Customer users who contact support | United States |
Zoom Video Communications, Inc. | San Jose, US | Customer troubleshooting sessions (support user group; end-to-end encrypted; not recorded) | Participant names and email addresses; transient audio/video | Transient; not stored. Transfer mechanism: Zoom Global DPA with Standard Contractual Clauses; Zoom Video Communications, Inc. is certified under the EU-US Data Privacy Framework |
Stripe, Inc. | San Francisco, US | Payment processing and invoicing. Transfer mechanism: Stripe DPA with Standard Contractual Clauses; Stripe, Inc. is certified under the EU-US Data Privacy Framework | Billing contact details, payment data (held by Stripe only) | United States |
Duplicati's workforce accesses the above from Denmark. Better Stack s.r.o. is established in the EU and processes in the EU, so no transfer mechanism is required for it. Duplicati's SparkPost account is contracted with Bird.com Inc. (Bethesda, Maryland, US), so notification data is transferred to the United States under the EU Standard Contractual Clauses (Module 2, controller to processor) incorporated by section 9.3.1 of the Bird Data Processing Agreement. For each US Sub-processor the transfer mechanism stated is the one in Duplicati's executed agreement with that Sub-processor; the Data Privacy Framework certifications stated are as listed at https://www.dataprivacyframework.gov on the date of this DPA and are verified at Duplicati's annual review. The current list is published at https://duplicati.com/legal/duplicati-sub-processor-list; Customers may subscribe to change notices by emailing security@duplicati.com.
