GDPR & Data Protection
Last updated
Instatus customers range from solo founders to regulated enterprises around the world. This page explains how we help you meet your data protection obligations, and where to find the documents your legal, security and procurement teams usually ask for.
Does this affect me?
If your Instatus account holds personal data, such as your team's names and phone numbers or your status page subscribers' email addresses, then data protection laws apply to you as the controller and to Instatus as your processor. That includes the EU and UK GDPR if you're in Europe or serve people there, the CCPA and other state laws in the US, and similar laws in Brazil, Canada, Australia and elsewhere.
Our Data Processing Addendum
Our Data Processing Addendum (DPA) is part of our Terms of Service, so it applies to every customer automatically, on every plan, with no signature needed. It includes:
- GDPR Article 28 processor commitments;
- the EU Standard Contractual Clauses (2021), the UK International Data Transfer Addendum and Swiss amendments for international transfers;
- CCPA service provider terms and processor terms for other US state privacy laws;
- 48-hour breach notification, audit rights, and deletion at the end of your contract; and
- a commitment that your data is never used to train AI models.
Need a countersigned copy for your records? See how to get a signed copy.
Subprocessors
We use a small set of carefully chosen subprocessors, such as Amazon Web Services for hosting. Each one signs data processing terms with us. You can see the full list, and subscribe to 30 days' advance notice of changes, on our subprocessors page.
Where your data lives
Customer data is stored primarily in the United States on Amazon Web Services. Status pages are delivered from a global edge network so they load fast, and stay up, wherever your users are.
Helping you meet your obligations
- Subscriber consent. You choose whether new subscribers must confirm their email address before receiving notifications, and every notification includes an unsubscribe link. Subscribers you import or add yourself skip confirmation, so you are responsible for having their consent.
- Access and deletion. You can view, export and delete subscribers and team members in the dashboard and through the API.
- Private status pages. Restrict a status page to your team or customers with a password, Google sign-in or SAML single sign-on.
- Security controls. Multi-factor authentication, SAML SSO, SCIM provisioning and role-based permissions help you control access.
- Assistance. We help with data subject requests, impact assessments and regulator inquiries as described in our DPA.
Security reviews
Our security overview and security whitepaper answer the most common questions. If your team has a security questionnaire, email security@instatus.com and we'll fill it in.
Contact
Email privacy@instatus.com with any data protection question.