Legal
Data processing agreement
The draft agreement for the personal data Brewless can reach in your accounts when it works on your instruction.
On this page
Warning
Draft of 14 October 2026. This agreement has not been reviewed by a lawyer yet and does not bind anyone until it has been and you have accepted it. Passages marked
[FOR REVIEW]are open.
1. Why this agreement exists
Your application and its data live in your own cloud accounts. Brewless is not in the path of your visitors and keeps no copy of your application's data. Still, with the keys you connect, Brewless can reach your accounts, and some of what it does there on your instruction can touch personal data of the people your application serves. For that, you are the controller and Coding Agency, Blankenstein 131, 7943 PE Meppel, the Netherlands ("Brewless") is your processor, and this agreement applies.
For the personal data of you and your team that Brewless holds itself (accounts, sign-ins, the audit trail), Coding Agency is controller; that is described in the privacy statement.
2. What Brewless does with personal data on your behalf
| What you ask | What Brewless can come across | What is kept by Brewless |
|---|---|---|
| Show the logs of an environment | Log lines of your application, which may hold personal data | Nothing: they are read from your provider and shown to you |
| Run a one-off command in an environment | Whatever the command prints | Which command ran and who ran it, in the audit trail; not its arguments and not its output |
| See, change or push variables through the console or the command line | The values, on their way from or to your Secret Manager | The names and a checksum, never a value; that someone looked, in the audit trail |
| Deploy, roll back, scale, add a domain | The configuration of your resources | References and settings of the resources; no application data |
| Show failed jobs | Which job failed and when, never why | Nothing |
The nature of the processing is therefore reading and passing on, on your instruction, for as long as you use Brewless. The people it concerns are the users and visitors of your application; which kinds of personal data depends on what your application logs and prints, which you decide.
3. Instructions
Brewless handles this data only to do what you instruct through the dashboard, the command line client or the API, and as this agreement describes. If we believe an instruction breaks the law, we tell you.
4. Confidentiality and security
Only people who need it to keep Brewless running can reach its systems, and they are bound to secrecy. The measures we take include: provider keys encrypted at rest; sign-in without passwords; secrets and tokens kept only as a hash; no value of your application's secrets stored or logged; every change in your organisation written to an audit trail you can read; hosting in the European Union. [FOR REVIEW: attach the list of measures as an annex.]
5. Sub-processors
You agree to the sub-processors listed in the privacy statement. We tell you by mail at least 30 days before adding or replacing one, so you can object. Each is bound to the same obligations as this agreement puts on us.
Your own providers (Scaleway, bunny.net, as far as you use them in your own accounts) are not our sub-processors: you have your own agreements with them.
6. Where
Brewless handles this data inside the European Economic Area only.
7. Helping you
We help you answer requests from people about their data and meet your own obligations on security, data breaches and impact assessments, as far as what we can see and do allows. A request that reaches us about your application's data, we pass on to you.
8. Data breaches
If personal data we handle for you is lost or reaches someone it should not, we tell you without undue delay and at the latest within [FOR REVIEW: 48] hours after we found out, with what we know: what happened, what data, what we did about it.
9. Audits
On request we show you how we meet this agreement. You may have it checked once a year by an independent auditor bound to secrecy, at your own cost, announced 30 days ahead. [FOR REVIEW.]
10. When it ends
This agreement lasts as long as you use Brewless. When you stop, we remove what we hold of your organisation as the terms describe; your application's data was never with us and stays in your accounts. Disconnecting a provider removes its key from Brewless at once.
11. The rest
The terms of service apply, including what they say about liability and Dutch law. Where this agreement and the terms differ about personal data, this agreement decides.