Data Processing Agreement

Summary

For platform customers, EqualisTech OpsReg Limited acts as a processor of the Azure subscription metadata and account data processed through the service, under Article 28 GDPR terms. The key commitments:

• Processing exclusively within the EU: Azure North Europe (Ireland) and West Europe (Netherlands). No transfers outside the EEA.
• Read-only access to customer Azure subscriptions; no customer credentials stored.
• Sole sub-processor: Microsoft Ireland Operations Limited (Microsoft Azure), EU regions above. Customers are notified in advance of any change to the sub-processor list.
• Evidence records are write-once with seven-year retention; on termination, exports are made available for retrieval before deletion.
• Technical and organisational measures include tenant isolation enforced at the database layer, Managed Identity authentication, private networking for data services, and a WAF-fronted public surface.

Executing the DPA

The full signable DPA, including the Article 28 clauses, the description of processing, and the technical and organisational measures annex, is available to customers and prospects on request: contact@equalistech.com.