Data Processing

Roles

For customer content processed through the Service, you are the controller and Harby is the processor. Harby acts only on your documented instructions — which include your agent configurations, permission settings, and connector authorizations.

What the DPA covers

• Scope, nature, and purpose of processing; categories of data and data subjects.
• Confidentiality commitments for personnel with access.
• Security measures (summarized on the Security page).
• Subprocessor list, flow-down obligations, and advance notice of changes with objection rights.
• International transfers under Standard Contractual Clauses (and UK Addendum) where applicable.
• Assistance with data-subject requests and breach notification without undue delay.
• Deletion and return of data at termination, matching the retention windows in the privacy policy.

Subprocessors

Current categories: cloud infrastructure and edge network providers, AI model providers (per your configuration), payment processing, and transactional email. The named list ships with the DPA document and updates are announced before new subprocessors process customer content.

Getting it signed

Email legal@harby.app from your workspace's admin address and we'll send the current DPA for countersignature — typically same-week turnaround. Enterprise customers can also fold the DPA into their master agreement during the sales conversation.