Data Processing Agreement

1Scope and roles

This agreement applies when a Subscriber (the “Seller”) uses Atlas Authenticator, and Atlas Security (“Atlas”) processes personal data of the Seller’s End Users for it. It is part of the Terms of Serviceand takes effect when the Seller accepts them.

• The Seller is the controller of End User personal data: it decides why and how the data is collected.
• Atlas is the processor and processes that data only to provide the Services, on the Seller’s documented instructions, which are the Seller’s configuration of the dashboard, the SDK and the API, and these Terms.
• For data about the Seller’s own account, Atlas is a controller; that is covered by the Privacy Policy.

Atlas does not write, review or enforce the notices, terms or consents a Seller gives its End Users. Those stay with the Seller.

2The processing

• Subject and purpose

  Detail

  Licensing and authenticating End Users of the Seller’s software, binding licenses to hardware, enforcing bans, geofencing and alert rules, delivering variables, files and updates, and keeping the logs the Seller sees

• Duration

  Detail

  While the Seller keeps the application, and until deletion under section 9

• Data subjects

  Detail

  End Users: people who run the Seller’s Protected Application, and Resellers the Seller invites

• Account data

  Detail

  License key; in account mode the username, email address and password. Account-mode passwords are stored unhashed, because the dashboard shows them to the Seller

• Device data

  Detail

  A combined hardware fingerprint and sixteen hardware identifiers (machine GUID, disk and volume IDs, network adapter MAC addresses, USB controller IDs, SMBIOS UUID, motherboard and BIOS serials, TPM fingerprint, graphics, monitor, audio and storage controller IDs, machine SID), the computer name and Windows user name, and a hash of the application executable

• Network data

  Detail

  IP address, country and city derived from it, VPN, proxy or hosting indicators

• Activity data

  Detail

  Time, outcome and reason of each sign-in attempt, sessions, bans and the Seller’s own logs

• Special categories

  Detail

  None intended. The Seller must not use the Services to process them

3What Atlas does

• Processes End User data only on the Seller’s instructions and not for its own purposes, except where the law requires it. Atlas may use aggregated figures that identify no one to run and improve the platform.
• Ensures the people who can access the data are bound by confidentiality, and limits access by staff position.
• Applies the safeguards in section 6.
• Helps the Seller answer End User requests and meet its own obligations, as section 7 describes.
• Tells the Seller if an instruction seems to break the law.
• Makes available the information needed to show these obligations are met, and answers reasonable audit questions in writing. A site audit needs advance notice and a confidentiality agreement.

4What the Seller does

• Decides the lawful basis for collecting End User data through Atlas, and for each setting it chooses, and does not use the Authenticator to collect data the law does not let it collect.
• Gives its End Users whatever notice, terms or consent the law requires where they are: what the software collects (the list in section 2), who processes it and how to reach the Seller. Atlas does not review or give these on the Seller’s behalf.
• Gives Atlas lawful instructions, uses the dashboard to keep the data accurate and deletes what it no longer needs.
• Controls access to its dashboard, API keys and Resellers and is responsible for what they do.

5Subprocessors

The Seller agrees that Atlas may use the providers on the Subprocessors page. Atlas has a written agreement or the provider’s own terms with each, and stays responsible for them. Atlas updates the page before a new provider receives End User data and tells Sellers by email or in the dashboard. A Seller may object on reasonable data protection grounds within 30 days by writing to [email protected]; if the parties cannot resolve it, the Seller may stop using the Authenticator and Atlas will return and delete its data under section 9.

6Security

Atlas keeps these measures in place and reviews them as the platform changes:

• The connection between the library and our authentication servers is encrypted (X25519 key exchange, a pinned Ed25519 server key, HMAC-authenticated messages). The dashboard and API use HTTPS.
• Dashboard accounts use bcrypt-hashed passwords, emailed approval for password sign-in, optional passkeys, revocable sessions and ban checks on every request.
• Every query is scoped to the application, and staff access is role based. Destructive staff actions need a PIN and staff actions are logged.
• Rate limiting, request signing and abuse detection protect the API and the authentication servers.
• Logs follow the retention periods in the Privacy Policy.

The platform’s controls are described, and checked against the code, at atlassecurity.site/security. The Seller remains responsible for the security of its own systems and credentials.

7Requests and breaches

End User requests

If an End User writes to Atlas about data Atlas processes for a Seller, Atlas tells them to contact the Seller and, where appropriate, tells the Seller. The Seller can see, correct and delete End User records in its dashboard. If it needs more, Atlas helps within a reasonable time.

Personal data breaches

If Atlas becomes aware of a breach that affects End User data, it tells the Seller without undue delay with what it knows, the likely effects and what it is doing about it, and keeps the Seller informed as it learns more. The Seller decides whether to notify an authority or End Users.

8Transfers

Atlas operates its servers in the Kingdom of Saudi Arabia. Subprocessors may process data in other countries. Where a transfer needs a legal mechanism, Atlas relies on one the law allows, such as the provider’s standard contractual clauses, and tells the Seller which on request.

9Return and deletion

A Seller deletes End User licenses and accounts, or resets or deletes an application, in the dashboard, which removes the license, account, sign-in log and hardware identifier records. When the Seller’s relationship with Atlas ends, the Seller can export its data first, and on written request within 30 days Atlas sends an export. Atlas then deletes the data from the live database, except what the law requires it to keep. Archived logs keep the periods in the Privacy Policy.

10General

This agreement is governed by the law and courts in the Terms. If it conflicts with the Terms on the processing of End User data, this agreement controls. Liability under it is subject to the limits in the Terms, to the extent the law allows. Questions or a countersigned copy: [email protected].