Instatus home page

Data Processing Addendum

Last updated

This Data Processing Addendum ("DPA") forms part of the Terms of Service, or any other agreement between Instatus, Inc. ("Instatus") and the customer ("Customer") for the Instatus Service (the "Agreement"). It applies automatically to every Instatus customer from the moment they accept the Agreement. No signature is required. If your organization needs a countersigned copy for its records, see how to get a signed copy.

It covers the EU and UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws such as the CCPA, and other data protection laws worldwide, and it includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for international transfers.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

  • "Data Protection Laws" means all laws that apply to the Processing of Customer Personal Data under the Agreement, including, where they apply: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other US state comprehensive privacy laws; Brazil's Lei Geral de Proteção de Dados ("LGPD"); Canada's PIPEDA and provincial equivalents; and Australia's Privacy Act 1988.
  • "Customer Personal Data" means personal data (or "personal information") in Customer Data that Instatus Processes on Customer's behalf under the Agreement.
  • "Controller", "Processor", "Data Subject", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider", "Sell" and "Share" have the meanings given in the CCPA. Equivalent terms in other Data Protection Laws have corresponding meanings.
  • "EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
  • "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022), as revised from time to time.
  • "Subprocessor" means a third party engaged by Instatus to Process Customer Personal Data.
  • "Restricted Transfer" means a transfer of Customer Personal Data that would be prohibited by Data Protection Laws without an approved transfer mechanism.

2. Roles and scope

2.1 Roles. Customer is the Controller (or a Processor acting on behalf of its own controller) of Customer Personal Data, and Instatus is its Processor (or subprocessor). Under the CCPA and similar US laws, Customer is the Business and Instatus is its Service Provider or Processor.

2.2 Instatus as an independent controller. Instatus is an independent Controller for the limited personal data it needs to run its own business, such as account owner details, billing records, support conversations, website analytics, fraud and abuse prevention, security logs, and Service Data as defined in the Agreement. That data is covered by our Privacy Policy, not this DPA.

2.3 Details of the Processing. The subject matter, nature, purpose and duration of the Processing, and the types of Customer Personal Data and categories of Data Subjects, are described in Annex I.

3. Customer's responsibilities

3.1 Customer will comply with Data Protection Laws in its use of the Service, and its instructions to Instatus will comply with them too.

3.2 Customer is responsible for the lawfulness of the Customer Personal Data it provides, and for having the notices, consents and other legal bases needed for Instatus to Process it under the Agreement. This includes consent from status page subscribers and from people who receive SMS messages or phone calls through the Service.

3.3 Customer will not submit special categories of personal data (such as health, biometric or genetic data), government ID numbers, payment card data or children's personal data, unless the Agreement expressly allows it.

4. Instatus's obligations

4.1 Instructions. Instatus will Process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Instatus will tell Customer first unless the law prohibits it. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. Instatus will tell Customer if it believes an instruction breaks Data Protection Laws.

4.2 Confidentiality. Instatus will ensure that everyone authorized to Process Customer Personal Data is bound by confidentiality obligations, and that access is limited to people who need it to provide, support or secure the Service.

4.3 Security. Instatus will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including those in Annex II. Instatus may update these measures over time but will not materially reduce the overall level of protection.

4.4 No AI training. Instatus will not use Customer Personal Data to train artificial intelligence models, and will only use AI Subprocessors that are contractually prohibited from doing so.

4.5 US state law commitments. To the extent the CCPA or similar US laws apply, Instatus will not: (a) Sell or Share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes set out in the Agreement, or outside the direct business relationship between the parties; or (c) combine it with personal data Instatus receives from or on behalf of others, except as the law permits for Service Providers. Instatus will comply with the obligations that apply to it under those laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data. Instatus certifies that it understands and will comply with these restrictions.

5. Subprocessors

5.1 Authorization. Customer gives Instatus general authorization to engage Subprocessors. The current list, with each Subprocessor's purpose and location, is on our subprocessors page.

5.2 Obligations. Instatus will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA, to the extent applicable to its services. Instatus remains responsible for each Subprocessor's performance of its obligations.

5.3 Notice of changes. Instatus will give at least 30 days' notice before a new Subprocessor begins Processing Customer Personal Data, by updating the subprocessors page and emailing customers who have subscribed to updates. You can subscribe as described on that page. In an emergency, such as replacing a Subprocessor that has failed or become unsafe, Instatus may give shorter notice and will explain why.

5.4 Objections. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing privacy@instatus.com within the notice period. The parties will discuss the objection in good faith, and Instatus may offer an alternative, such as a change to the configuration of the Service that avoids the Subprocessor. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected part of the Service by written notice and receive a refund of prepaid fees for the remainder of the term for that part.

6. Data Subject requests and assistance

6.1 Instatus will provide features that let Customer access, correct, export and delete Customer Personal Data, such as managing subscribers and team members in the dashboard and through the API.

6.2 If Instatus receives a request from a Data Subject that relates to Customer Personal Data, it will direct the person to Customer and will not respond itself, except to confirm the request was redirected, unless Customer authorizes it or the law requires it.

6.3 Taking into account the nature of the Processing, Instatus will provide reasonable assistance to help Customer respond to Data Subject requests, carry out data protection impact assessments, consult Supervisory Authorities, and meet its security obligations, where Customer cannot do so through the Service.

7. Personal Data Breaches

7.1 Instatus will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice goes to the email addresses of Customer's account owners.

7.2 The notice will describe, as far as known at the time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Instatus will provide updates as it learns more.

7.3 Instatus will promptly take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with Customer's reasonable requests. Notifying Customer is not an admission of fault. Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as pings, port scans or failed login attempts, are not Personal Data Breaches.

8. Audits

8.1 Instatus will make available the information reasonably necessary to demonstrate compliance with this DPA. Customer agrees to first rely on our security documentation, written answers to reasonable security questionnaires, and any third-party audit reports or certifications Instatus holds, all treated as Instatus Confidential Information.

8.2 If that information is not enough to meet Customer's obligations under Data Protection Laws, or a Supervisory Authority requires it, or after a Personal Data Breach, Customer may audit Instatus's compliance with this DPA, either itself or through an independent auditor bound by confidentiality who is not an Instatus competitor. Audits are limited to once in any 12-month period (except after a breach or at a regulator's request), require at least 30 days' written notice and an agreed scope, must take place during business hours without disrupting Instatus's operations or compromising other customers' data, and are at Customer's expense.

8.3 Audit rights under the EU SCCs and the UK Addendum are exercised under this section.

9. International transfers

9.1 Location. Instatus primarily stores Customer Personal Data in the United States. Instatus and its Subprocessors may Process it in other countries listed on the subprocessors page, and Instatus personnel may access it remotely from the countries where they work, always under this DPA.

9.2 EU transfers. For Restricted Transfers from the European Economic Area, the EU SCCs are incorporated into this DPA and apply as follows:

  • Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor.
  • Clause 7 (docking clause) applies.
  • Clause 9(a): Option 2 (general written authorization) applies, with the notice period in section 5.3 of this DPA.
  • Clause 11(a): the optional language does not apply.
  • Clause 13: the competent Supervisory Authority is the one determined under Clause 13(a) and Annex I.C below.
  • Clause 17: Option 1 applies, and the EU SCCs are governed by the law of Ireland.
  • Clause 18(b): disputes are resolved by the courts of Ireland.
  • Annexes I, II and III of the EU SCCs are completed with the information in Annex I, Annex II and the subprocessors page referenced in this DPA.
  • Where Module Three applies, Instatus may provide information and notices to Customer, and Customer will pass them to its controller where needed.

9.3 UK transfers. For Restricted Transfers from the United Kingdom, the UK Addendum is incorporated into this DPA and amends the EU SCCs as set out in it. Table 1 is completed with the parties' details in Annex I; Table 2 refers to the modules and options in section 9.2; Table 3 is completed with Annex I, Annex II and the subprocessors page; and for Table 4, neither party may end the UK Addendum under its Section 19.

9.4 Swiss transfers. For Restricted Transfers from Switzerland, the EU SCCs apply as set out in section 9.2 with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority for transfers governed by the FADP; references to "Member State" do not prevent Data Subjects in Switzerland from bringing claims in their place of habitual residence; and Swiss law governs to the extent required for those transfers.

9.5 Other countries. For Restricted Transfers under other Data Protection Laws, such as the LGPD, the transfer mechanism adopted by the competent authority applies to the extent the law requires it, with the EU SCCs otherwise applying as adapted to that law. For the LGPD, this includes the standard contractual clauses approved by ANPD Resolution CD/ANPD No. 19/2024.

9.6 Alternative mechanisms. If Instatus adopts another lawful transfer mechanism, such as certification under the EU-US Data Privacy Framework, it may rely on that mechanism instead, to the extent it covers the transfer.

9.7 Government access requests. If Instatus receives a request from a public authority for Customer Personal Data, it will challenge the request where it has reasonable grounds to, disclose only the minimum required, and notify Customer unless the law prohibits it. Instatus will not build back doors into the Service or give any government direct access to Customer Personal Data.

9.8 Order of precedence. If the EU SCCs or the UK Addendum conflict with this DPA or the Agreement, the EU SCCs or the UK Addendum prevail.

10. Return and deletion

10.1 During the Agreement, Customer can export Customer Personal Data through the dashboard and the API.

10.2 When the Agreement ends, Instatus will delete Customer Personal Data from its active systems within 30 days and from backups within 60 days, unless the law requires it to keep some of it, in which case Instatus will keep protecting it under this DPA and only Process it for the purpose the law requires. If Customer wants a copy, it should export the data before cancelling, or email privacy@instatus.com within those 30 days. Instatus will confirm deletion in writing on request.

11. Liability and general terms

11.1 Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the EU SCCs do not allow them to apply, such as liability to Data Subjects under the EU SCCs.

11.2 This DPA lasts as long as Instatus Processes Customer Personal Data. If any part of it is found invalid, the rest stays in effect.

11.3 Instatus may update this DPA to reflect changes in law, guidance or the Service, with notice under the Agreement. Updates will not materially reduce the protection given to Customer Personal Data, except where the law requires the change.

11.4 This DPA is governed by the law that governs the Agreement, except where Data Protection Laws or the EU SCCs require otherwise.

Annex I: Description of the processing

A. Parties

Data exporter: Customer, as identified in the Agreement or its Instatus account. Contact: the account owner(s) of Customer's Instatus account. Role: Controller, or Processor for its own controller.

Data importer: Instatus, Inc., 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon 97008-7105, USA. Contact: privacy@instatus.com. Role: Processor, or subprocessor.

Each party agrees to the EU SCCs and the UK Addendum by accepting the Agreement.

B. Description of the transfer

Categories of Data Subjects: Customer's team members and other authorized users; people who subscribe to or view Customer's status pages; on-call contacts; and any other people whose personal data Customer chooses to include in the Service, such as in incident updates or monitor configurations.

Categories of personal data:

  • Contact and identity data: names, email addresses, phone numbers, job titles, profile pictures, and user identifiers, including identifiers from single sign-on, SCIM directories and connected integrations such as Slack or Microsoft Teams.
  • Status page subscriber data: email addresses, phone numbers, chat or webhook endpoints, subscribed components, language and notification preferences, and confirmation and delivery records.
  • Account and usage data: login records, IP addresses, browser and device information, audit logs, time zones, language settings and mobile push tokens.
  • On-call and incident data: schedules, escalation policies, alert acknowledgements, incident and maintenance content, comments, and postmortems.
  • Monitoring data: monitored URLs and hosts, request headers and bodies Customer configures, and results such as response codes, response times, response content and screenshots.
  • Any other personal data Customer includes in the Service.

Special categories of data: None. Customer agrees not to submit them, as set out in section 3.3.

Frequency of the transfer: Continuous, for as long as Customer uses the Service.

Nature of the Processing: Hosting, storage, retrieval, display, transmission and deletion; sending notifications by email, SMS, voice, push and chat; running monitoring checks; and AI-assisted processing, including automatic incident summaries, translation of status page content and abuse checks, and features Customer uses such as drafting incident updates.

Purpose of the Processing: To provide, maintain, support and secure the Service under the Agreement.

Retention: For the duration of the Agreement, then deleted as described in section 10.

Transfers to Subprocessors: For the subject matter, nature and duration listed for each Subprocessor on the subprocessors page.

C. Competent Supervisory Authority

The Supervisory Authority of the EU Member State where the data exporter is established. If the data exporter is not established in the EU but falls within the territorial scope of the GDPR, the Supervisory Authority of the Member State where its representative under Article 27(1) of the GDPR is established; if no representative is required to be appointed, the Data Protection Commission of Ireland. For the UK, the Information Commissioner's Office. For Switzerland, the Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational measures

Encryption. Data in transit over public networks is encrypted with TLS. Our primary database and the file storage we run on Amazon Web Services are encrypted at rest with AES-256, and database backups are encrypted. Passwords are hashed and salted with bcrypt and are never stored in plain text.

Infrastructure. Our primary infrastructure runs on Amazon Web Services in the United States (us-east-2, Ohio). The primary database runs across multiple availability zones with automatic failover and deletion protection. Access to production systems requires authentication and is limited to authorized services and personnel.

Access control. Access to production systems and Customer Personal Data is limited to personnel who need it for their role, protected by multi-factor authentication, and removed promptly when no longer needed. Instatus staff access customer accounts only to provide support, investigate abuse or fix problems.

Application security. Customers can protect their accounts with multi-factor authentication and SAML single sign-on, provision users with SCIM, and assign role-based permissions. The Service applies rate limiting, bot protection and secure HTTP headers. Code changes are reviewed before release, and dependencies are updated regularly.

Logging and monitoring. We log access to production systems and security-relevant events in the Service, monitor for anomalies and abuse, and alert our team on suspicious activity.

Availability and recovery. The primary database is backed up automatically every day and stored encrypted in a separate location. We test restores, and we publish our own availability at instat.us.

Personnel. Everyone with access to Customer Personal Data signs confidentiality obligations and is trained on security and privacy practices.

Vulnerability management. We welcome reports from security researchers through our security response process and fix confirmed vulnerabilities based on severity.

Incident response. We have a documented process for detecting, containing and investigating security incidents and notifying affected customers as described in section 7.

Subprocessors. We review the security and privacy practices of Subprocessors before engaging them and sign data processing terms with each.

Data minimization and deletion. We collect only what is needed to provide the Service and delete Customer Personal Data as described in section 10.

Annex III: Subprocessors

The list of Subprocessors is maintained at instatus.com/policies/subprocessors.

Signed copy

This DPA is already in effect for every Instatus customer, so you don't need to sign anything. If your organization needs a countersigned copy for its records or vendor review, email privacy@instatus.com with your company's legal name and address and the name and title of the signer, and we'll send a copy for e-signature.

Business and Enterprise customers who need changes to this DPA can ask us through their Order Form.

Previous versions

Customers who signed an earlier version keep it for the rest of their current term, after which this version applies. Earlier versions: June 2022, April 2022.