Data Processing Addendum

1. Roles and scope

This Data Processing Addendum (“DPA”) applies where Cirrova Systems (“Cirrova”) processes personal data on behalf of a customer in the course of providing the Cirrova platform (the “Service”).

Where you have purchased the Service through Microsoft Marketplace, this DPA is incorporated into your agreement with Cirrova by the Cirrova amendment to the Microsoft Standard Contract. Where you have purchased directly, it is incorporated by our Terms of Service.

You are the entity that determines the purposes and means of processing. Cirrova processes personal data only on your documented instructions. Your instructions are: this DPA, your agreement with us, and your configuration and use of the Service. Cirrova will not process personal data for any other purpose. Consistent with clause 4 of the Cirrova amendment, Cirrova does not sell Customer Data, disclose it for any third party’s commercial purposes, or use it to develop or improve any product or service for anyone other than you. Statistical models and baselines derived from your Customer Data serve only you. The Service incorporates no generative AI or large language model, and no Customer Data is sent to any such system.

If Cirrova considers an instruction to breach applicable data protection law, it will inform you without undue delay.

In this DPA, “personal data” has the meaning given to “personal information” in the Privacy Act 1988 (Cth), and to “personal information” in the Privacy Act 2020 (NZ) where that Act applies. Section 11 applies additional terms where the GDPR applies.

2. Processing details

Subject matter and duration

The subject matter of the processing is the provision of Azure cost visibility, anomaly detection, budgeting, reporting and optimisation insights. Processing continues for the term of your subscription, followed by the 30-day read-only period described in section 9, and thereafter only to the extent data persists in backups until those backups expire.

Nature and purpose

Collection, storage, organisation, structuring, analysis, retrieval and deletion of Azure cost and resource data and associated account records, for the purpose of operating the Service and delivering the notifications and reports you configure.

Categories of personal data

• Account records — name, email address, organisation, role assignments, and Microsoft Entra ID object identifiers where single sign-on is used;
• Authentication records — password hashes, encrypted multi-factor authentication secrets, API key hashes and prefixes, and session metadata;
• Audit records — user identifier, organisation identifier, event type, IP address, user agent and timestamp;
• Azure resource metadata — data retrieved from your Azure environment that may contain personal data where you have placed it there. In practice this means resource tags containing individuals’ names, and the identities of users recorded as creating or owning resources in cost and usage exports;
• Support correspondence — the content of support requests you send us.

Categories of data subjects

• Your personnel and contractors who hold Cirrova accounts;
• Individuals identified in the Azure resource metadata described above;
• Where you are a managed service provider, personnel of the customers whose Azure tenants you connect.

Sensitive information

The Service is not designed to process sensitive information as defined in the Privacy Act 1988 (Cth), or special categories of data under the GDPR, and you must not use it to do so.

3. Personnel

Cirrova Systems limits access to Customer Data and to production systems to those personnel who require it in order to operate, support or troubleshoot the Service. Access is granted on a least-privilege basis and is protected by enforced Microsoft Entra multi-factor authentication.

Personnel with access to Customer Data are bound to confidentiality, and the confidentiality obligations in your agreement with Cirrova Systems apply to that access. Those obligations continue after the engagement ends.

Cirrova Systems engages no third-party administrator with standing access to production systems or Customer Data. Where a contractor is engaged with such access, they will be bound by written confidentiality obligations no less protective than those in this DPA before access is granted.

4. Security measures

Cirrova implements and maintains the technical and organisational measures set out in Annex A. Annex A describes measures that are in operation today, not measures that are planned.

Cirrova may update Annex A from time to time provided the overall level of security is not reduced. Material reductions will be notified in the same way as subprocessor changes under section 5.

You are responsible for your own configuration of the Service, including the roles you assign, whether you enforce multi-factor authentication, the scope of the Azure credentials you supply, and the destinations you configure to receive alerts and reports.

5. Subprocessors

You give Cirrova general authorisation to engage subprocessors, subject to this section. Cirrova remains liable to you for the acts and omissions of its subprocessors as if they were its own.

Each subprocessor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA.

Current subprocessors

What is not a subprocessor

• Alert destinations you configure. Where you direct Cirrova to deliver alerts or reports to an email address, Microsoft Teams channel, Slack channel or webhook endpoint, that delivery is a disclosure made at your instruction to a destination you control. Those recipients are not Cirrova subprocessors and Cirrova is not responsible for them.
• Website analytics and bot protection. Cirrova uses Google Analytics and Cloudflare Turnstile on its public marketing website, where Cirrova acts as controller in respect of website visitors. Neither has access to Customer Data. These are described in our Privacy Policy. Neither operates on this page or on any other page under /legal.
• Development tooling. Cirrova uses AI-assisted development tooling against its source code repositories. That tooling has no access to production infrastructure and no access to Customer Data. Changes reach production only through a manual, human-initiated deployment.

Change notice

You may object to a new subprocessor on reasonable data protection grounds within that notice period. If we cannot resolve your objection, you may terminate the affected subscription without penalty and receive a pro-rata refund of prepaid fees for the unused remainder of the term.

To set or update your notification contact, email hello@cirrova.io. If you do not nominate one, notices are sent to your organisation owners.

Subprocessor change log

6. Data subject requests

The Service gives you the ability to access, correct, export and delete the personal data it holds for your organisation, so that you can respond to requests from individuals yourself.

If an individual contacts Cirrova directly with a request relating to your data, Cirrova will not respond to the substance of it. Cirrova will redirect the individual to you and, unless legally prohibited, tell you that the request was made.

Where you cannot fulfil a request using the Service, Cirrova will provide reasonable assistance, taking into account the nature of the processing and the information available to it.

7. Breach notification

Notification is sent from security@cirrova.io to your nominated notification contact, or to your organisation owners if none is nominated.

An initial notice may be incomplete. Cirrova will provide what is known at the time — the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed — and will supplement it as further information becomes available. An incomplete initial notice will not be delayed in order to make it complete.

Cirrova will assist you in meeting your own notification obligations, including under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) and, where applicable, Part 6 of the Privacy Act 2020 (NZ). You remain responsible for determining whether a breach is notifiable and for making any notification to a regulator or to affected individuals.

This obligation is in addition to, and does not limit, Cirrova’s obligation to notify you of unauthorised disclosure of Confidential Information under your agreement.

8. Audit and assistance

Where you have purchased the Service through Microsoft Marketplace, clause 7 of the Cirrova amendment to the Microsoft Standard Contract governs verification of compliance. It provides:

The same basis applies where you have purchased directly. In either case the once-in-12-months limit does not apply following a confirmed security incident affecting your Customer Data, and you may verify compliance again at that point.

Separately from the above, Cirrova will provide reasonable assistance with privacy impact assessments and with consultation with a supervisory authority or regulator, to the extent this relates to Cirrova’s processing and taking into account the information available to it.

Requests under this section go to security@cirrova.io.

9. Deletion and return

At the end of your subscription, your account moves to read-only access for 30 days so that you can export your data. The Service provides export in machine-readable formats throughout that period.

At the end of the 30-day period, the account is closed and personal data is deleted from Cirrova’s production systems.

During that period, Cirrova will not restore backup data into production or otherwise use it, except to recover from a system failure. Where a restoration occurs, deletions already made are re-applied. Backup data remains subject to the security measures in Annex A and to this DPA for as long as it is held.

You may request deletion at any time before the end of the read-only period, in which case production deletion is brought forward. The backup position is unchanged.

Cirrova may retain personal data where required by law, in which case it will retain only what is required, for only as long as required, and will continue to protect it under this DPA.

10. Data location

Hosting in Australia is a contractual commitment: Cirrova will not host Customer Data outside Australia during your subscription term without your prior written agreement. The specific Australian region is stated above as a matter of current fact and may change without notice, provided Customer Data remains in Australia.

Transactional email is delivered through Microsoft Exchange Online with the tenant data location set to Australia. Billing and payment processing is performed by Stripe, which processes billing contact details and transaction metadata in the United States and Australia. Stripe has no access to Customer Data.

Where you have entered into a custom hosting arrangement with Cirrova, the region specified in that arrangement applies instead for the data it covers. Account and billing records remain in Australia regardless.

For customers subject to the Privacy Act 2020 (NZ), this section together with section 5 records the overseas disclosures relevant to information privacy principle 12.

11. GDPR module

This section applies only where and to the extent that your processing of personal data through the Service is subject to Regulation (EU) 2016/679 (“GDPR”) or to the GDPR as retained in the law of the United Kingdom. It does not otherwise apply.

Where it applies:

• You are the controller and Cirrova is the processor, and Articles 28(3)(a) to (h) are given effect by sections 1 to 9 of this DPA;
• The standard contractual clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference and apply to transfers of personal data from the European Economic Area to Cirrova in Australia;
• For the purposes of those clauses: the optional docking clause in Clause 7 does not apply; in Clause 9, Option 2 (general written authorisation) applies with the notice period in section 5 of this DPA; in Clause 11, the optional independent dispute resolution body does not apply; in Clause 17, the governing law is the law of Ireland; and in Clause 18(b), the forum is the courts of Ireland;
• Annex I.A (parties) is you as data exporter and controller, and Cirrova as data importer and processor, with contact details as recorded in your agreement and at hello@cirrova.io respectively;
• Annex I.B (description of transfer) is section 2 of this DPA. The frequency of transfer is continuous. The period of retention is as set out in section 9;
• Annex I.C (competent supervisory authority) is the authority determined under Clause 13 of the standard contractual clauses;
• Annex II (technical and organisational measures) is Annex A of this DPA;
• Annex III (list of subprocessors) is the table in section 5 of this DPA.

Where the UK GDPR applies, the standard contractual clauses are read together with the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018, which is incorporated by reference.

Where there is a conflict between this section and the remainder of this DPA in respect of processing subject to the GDPR, this section prevails.

Annex A — Security measures

The following measures are in operation as at the effective date of this DPA. They are described as they are, not as they are intended to become.

Infrastructure

• The Service runs exclusively on Microsoft Azure platform services in Australia, currently in the Australia East region. There are no self-managed virtual machines or operating systems, and no infrastructure hosted outside Azure;
• Application components authenticate to Azure resources using managed identity. The application stores no cloud credentials of its own;
• Application secrets are held in Azure Key Vault and resolved at startup. No secret is held in application configuration or source code, and secrets are never written to logs or returned in API responses;
• The application database is Azure SQL with Microsoft Entra authentication only. SQL logins are disabled, the database is not publicly reachable, and access is restricted to permitted managed identities.

Encryption

• All traffic is served over TLS. Unencrypted connections are redirected;
• Database connections enforce TLS with certificate validation (Encrypt=True; TrustServerCertificate=False);
• Data at rest in Azure SQL is protected by transparent data encryption;
• Azure service principal secrets supplied by customers are encrypted on receipt using the .NET Data Protection API and decrypted in memory only for the duration of a collection run;
• User passwords are stored as BCrypt hashes with per-user salts. Multi-factor authentication secrets are encrypted at rest. API keys, password reset tokens and invitation tokens are stored as SHA-256 hashes and cannot be reconstructed.

Access control

• Users authenticate by email and password with a 12-character minimum, or by single sign-on with Microsoft Entra ID over OpenID Connect. Cirrova never receives single sign-on credentials;
• Organisation owners may enforce time-based one-time password multi-factor authentication for all non-single-sign-on users;
• Session tokens are signed with HMAC-SHA256 using a key held only in Key Vault, expire after 60 minutes, and are not persisted server-side;
• A five-role model governs authorisation. Every database query is scoped to the authenticated user’s organisation identifier, and API responses are validated against it before data is returned. API keys inherit and cannot exceed the access scope of the user they were issued to;
• Cirrova administrative access to production infrastructure requires enforced Microsoft Entra multi-factor authentication.

Access to your Azure environment

You may rotate or revoke the credentials you supply at any time, from within the Service or directly in Azure. Collection runs fail without side effects if credentials are invalid.

Logging

• Authentication events, API key issue and use, user and organisation changes, credential changes, collection runs, anomaly detection events, report generation, licence changes and support requests are all recorded to an append-only audit log in Azure Data Explorer;
• Each entry records the user identifier, organisation identifier, event type, IP address, user agent and timestamp;
• Audit records are retained for the period included in your plan and are available to you through the Service.

Monitoring

• Application and platform logs are collected centrally in Azure Data Explorer and are available for investigation;
• Cirrova does not currently operate automated security incident detection or alerting. A security incident would be identified through investigation of the logs described above, through a report from a customer, or through a report to security@cirrova.io. This does not affect the notification obligation in section 7, which applies from the point Cirrova becomes aware of a breach by any means.

Resilience

• Backups are taken daily and retained for 12 months;
• Restore procedures have been tested on development infrastructure, which is provisioned from the same definitions and uses the same backup mechanism as production. A production restore has not been performed;
• Underlying platform availability, patching and redundancy are provided by Microsoft as part of the Azure platform services in use;
• Cirrova gives no uptime commitment on plans purchased through Microsoft Marketplace or through its website. See our Service Availability statement.

Vulnerability management

• All infrastructure, runtimes and platform components are patched and maintained by Microsoft as part of the managed Azure services in use. Cirrova operates no unmanaged operating systems;
• Application dependencies are monitored for published vulnerability advisories;
• Vulnerabilities may be reported to security@cirrova.io. Cirrova will not pursue a reporter who acts in good faith and does not exploit a finding.

Segregation

• The Service is multi-tenant. Each organisation’s data is logically segregated, with the organisation identifier enforced at the query layer rather than only in application logic;
• Within an organisation, users see only the Azure tenants they have been explicitly granted access to;
• Development and production environments are separate. Production data is not copied into development environments.

Version history

Superseded versions of this DPA remain available at the URLs below. If you purchased a subscription while an earlier version was in force, that version continues to apply to you for the remainder of your term.