OpenRows Get started

Data Processing Agreement

Effective when accepted; draft of October 28, 2026

Draft. This agreement is published for transparency and is still under legal review. It isn't in force yet and may change before it is. If your organization needs a signed data processing agreement now, email support@openrows.io.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Draggable ("we", "us", the "Processor") and the customer that uses the hosted OpenRows service at app.openrows.io for an organization ("you", the "Controller"). It applies when we process personal data on your behalf in providing the Service, and where data protection laws such as the EU and UK GDPR apply to that processing. Our Privacy Policy describes the personal data we handle as a controller ourselves, such as your account and billing details.

1. Subject matter, duration and purpose

  • Subject matter: hosting, storing and processing the content you and your collaborators put into the Service (bases, tables, records, files, comments, forms and automations) so that the Service works.
  • Duration: for as long as you use the Service, then until the data is deleted as described in section 8.
  • Nature and purpose: storage, retrieval, display, sharing with the people you choose, search, computation (formulas, automations), export, backup and deletion, only to provide, secure and support the Service.
  • Categories of data subjects: your users and collaborators, and anyone whose personal data you put into the Service, such as your customers, contacts or form respondents.
  • Types of personal data: whatever you put into the Service (names, email addresses and any other data in your records, files and comments), and the account details of your users (name, email address, profile picture, sign-in times and IP addresses in logs).
  • Special categories: the Service isn't designed for special categories of personal data or data about criminal convictions. If you store them, you are responsible for having a lawful basis and for deciding that the security measures below are appropriate.

2. Our obligations

We will:

  • process personal data only on your documented instructions, which are these terms, your use of the Service's features and settings, and any other written instructions we agree, unless the law requires otherwise (we will then tell you first, unless the law forbids it);
  • tell you if we think an instruction breaks data protection law;
  • make sure everyone who can access the personal data is bound by confidentiality;
  • apply the security measures in Annex 2;
  • not sell the personal data, not use it for advertising, and not use your content to train artificial intelligence or machine learning models.

3. Subprocessors

You authorize us to use the subprocessors listed in Annex 1. We have a written agreement with each of them with data protection obligations no less protective than this DPA, and we remain responsible for their work. We will announce a new or replaced subprocessor at least 30 days in advance, by email to workspace owners and in the app. You may object on reasonable data protection grounds within that time; if we can't resolve the objection, you may end the affected part of the Service and we will refund any prepaid fees for the remaining period.

4. Data location and international transfers

Data location. Today the Service has one region, the European Union: the application, its database, file attachments and encrypted database backups are hosted and stored in the European Union (our server, and Cloudflare R2 in the EU). Traffic passes through Cloudflare's global network in transit, and the billing details in Annex 1 are processed by Polar in the United States and the European Union. When we add a region (a United States region is planned), Enterprise workspaces will choose theirs when they are created; a workspace's records, files and backups then stay in that region, and a workspace never moves between regions without your instruction.

Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 apply, Module Two (controller to processor) between you and us, and Module Three (processor to processor) between us and our subprocessors, with the UK International Data Transfer Addendum and the Swiss adjustments where required. For the clauses' options: clause 7 (docking) applies, clause 9 option 2 (general authorization, with the notice in section 3), clause 11's optional language doesn't apply, clauses 17 and 18 choose the law and courts of Ireland, and the annexes are filled in by section 1 and Annexes 1 and 2 of this DPA. If the clauses and this DPA conflict, the clauses prevail.

5. Assistance

Taking into account the nature of the processing, we will help you respond to requests from data subjects (access, correction, deletion, portability, restriction and objection). Most can be done in the Service itself: you can edit or delete any record, export a base or your account's data, and delete your account or workspace. We will also help you with security, breach notifications, data protection impact assessments and consultations with supervisory authorities, as far as they concern our processing.

6. Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data we process for you, we will notify the workspace owners without undue delay and no later than 48 hours after becoming aware of it. The notice will describe, as far as we know them at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact for more information. We will update it as we learn more, and take reasonable steps to contain the breach and reduce its effects.

7. Audits

We will make available the information needed to show that we meet this DPA: this page, our security measures (Annex 2), our operational runbooks and the results of our monthly compliance self-check (log retention, backup expiry, the deletion jobs, and the absence of tracking cookies and third-party trackers). If that isn't enough to meet your obligations or a supervisory authority's request, you may audit our compliance once a year, at your cost, with 30 days' notice, under a confidentiality agreement, in a way that doesn't affect our other customers' data or the Service's security.

8. Deletion and return

You can export your data at any time (each base as a ZIP of CSV and JSON files with its attachments, and your account's data). When you delete records, tables, bases or your workspace, they go to the trash and are permanently deleted after 30 days, or at once when you delete them permanently. When you delete your account or workspace, or after the Service ends for you, we delete the personal data within 30 days, except where the law requires us to keep it. Encrypted backups are overwritten on a rolling basis within a further 30 days, and server logs are kept for up to 90 days.

9. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where data protection law doesn't allow them. If this DPA and the Terms of Service conflict, this DPA prevails for the processing of personal data.

Annex 1: Subprocessors

Subprocessor What they do for the Service Personal data Location
Ark, our dedicated server, operated by Draggable (hosting provider to be confirmed before this DPA leaves draft) Runs the application, its database and the sign-in service All Service data European Union
Cloudflare, Inc. DNS, network security and the encrypted connection to our server; storage of file attachments and of encrypted database backups (Cloudflare R2); the CAPTCHA on public forms and protected share links (Turnstile) Everything in transit; attachments; encrypted backups; IP addresses Global network; R2 storage in Western Europe
Polar Payments, invoicing and tax for paid plans, as merchant of record Billing contact's name, email address and country; subscription details United States and European Union
Liquid Hosting (liquid.hosting) The mail server that sends the Service's emails: invitations, notifications, sign-in and password reset emails Recipient's name and email address; the email's content To be confirmed

Sign-in with GitHub or Google happens only if a user chooses it; those providers act under their own terms, not as our subprocessors.

Annex 2: Security measures

  • Encryption in transit. Every connection to the Service uses TLS through Cloudflare, and our server receives traffic only through an outbound, encrypted tunnel: it has no open inbound web ports. Its own services listen on its loopback interface only.
  • Encryption at rest. Database backups are encrypted with age before they leave the server, and the decryption key isn't stored with them. Cloudflare R2 encrypts stored files and backups at rest.
  • Tenant isolation. Each workspace's data is isolated in the database with row-level security, and the application connects with a database role that can't bypass it. Every request is authorized against the user's role, and automated tests check that one workspace can never read another's data.
  • Access control. Roles per workspace and base (owner, creator, editor, commenter, read-only), per-table and per-field edit permissions, personal access tokens limited by scope and by base, and share links with optional passwords, expiry and email-domain limits. Passwords are hashed by our sign-in service (Keycloak), which limits failed sign-in attempts.
  • Administrative access. Only Draggable's operator has access to the server, by SSH key. The sign-in service's administration console isn't reachable from the internet and needs a one-time code. Our support console needs a recent sign-in, and every action in it, including viewing a workspace as its user for support, is recorded in an audit log.
  • Application security. A strict Content-Security-Policy and other security headers, rate limits on the API, sign-in and public forms, request size limits, sanitized rich text, and a hardened client for any request to a URL a user chose (webhooks, automations, imports), which refuses private and internal addresses.
  • Logging. Logs leave out request bodies, cookies, query strings and the secret tokens in links, and are deleted after at most 90 days.
  • Backups and recovery. Nightly encrypted backups of every database, kept for 30 days, with a tested restore procedure.
  • Monitoring. Health, error-rate, backup and job monitoring with alerts to the operator, and external uptime checks at status.openrows.io.
  • Compliance self-check. A monthly automated check that log retention, backup expiry and the deletion jobs work as promised, and that our website and app set no non-essential cookies and load no third-party trackers. A failure alerts the operator.
  • Development. Every change must pass the automated tests (including authorization, tenant isolation and security tests) before it is deployed.
  • Deletion. Deleted accounts, workspaces and trash are removed by automated jobs within the periods in section 8.