Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

Version and status of this document

Please note: this document is a draft and remains subject to legal review and approval. In its present version it does not yet constitute a legally binding agreement.

Version of 2026-07-27. We update this document as soon as the underlying processing operations, systems or sub-processors change.

For a signed version, for questions regarding its content or for the conclusion of an individual data processing agreement, please contact hello@erseni.com.

Parties and subject matter of the processing

This data processing agreement (hereinafter the "DPA") sets out in detail the data protection obligations of the parties arising from the use of the service. It applies to all processing of personal data that we carry out on behalf of and on the instructions of the controller.

Controller

The controller within the meaning of Art. 4 (7) GDPR is the natural or legal person who uses the service to transmit or request content and who determines the purposes and means of that processing. In the case of business use, this is the using company or organisation.

Processor

Erseni Ltd, Private Company Limited by Shares
Archiepiskopou Makariou III, 59
MOUYIAS TOWER, 3rd floor, Flat/Office 301
6017 Larnaca, Cyprus
Registration number: HE 487031
Email: hello@erseni.com

Subject matter of the processing

The subject matter of the processing is the operation of a service for the end-to-end encrypted transmission of content (zero-knowledge approach). We provide the technical infrastructure through which encrypted content is stored, retrieved and deleted after retrieval or expiry. No analysis of the content takes place and none is technically possible for us.

Our general terms and conditions and our privacy policy apply in addition. In the event of any conflict with data protection provisions, the terms of this DPA shall prevail.

Nature, scope and purpose of the processing

Nature of the processing

Collection, storage, transmission, provision and deletion of encrypted content and the associated technical metadata. The processing is carried out by automated means. Neither we nor any third party accesses plaintext content.

Purpose of the processing

The sole purpose is the contractual provision of the service: the secure one-time transmission of content between a sender and a recipient, the management of validity periods and the protection of the service against misuse and overload.

Duration of the processing

The processing takes place for the duration of the contractual relationship. Beyond that, encrypted content is processed only until the first retrieval or until the expiry of the selected validity period. Details are set out in the section on the deletion concept.

Categories of personal data

Only the following categories of data are processed:

Encrypted content (ciphertext), including optional encrypted file attachments. This may contain personal data of any kind; its selection is a matter for the controller alone. Without the client-side key it is not readable by us.
Technical metadata relating to the transaction: a randomly generated access token, the time of creation, the time of expiry, where applicable the time of retrieval, and the number of remaining retrievals.
Where a user account is used: the email address and the account status, the assignment of a transaction to the account, and activity log events (type of event and time, without content and without access tokens).
Technical connection data for the prevention of misuse. For rate limiting, the IP address is not stored in plaintext but processed exclusively as a hash value derived using a secret key (HMAC-SHA-256), which is held in the cache only for the duration of the relevant time window. Independently of this, server access logs are kept which contain the IP address in plaintext, together with the time, the path requested, the status code, the volume of data transferred, the referrer and the user agent. They serve technical operations, error diagnosis and the detection of attacks.

The controller decides on its own responsibility which content it transmits via the service. As the content is available to us solely as ciphertext, we can determine neither its category nor whether it relates to an identifiable person.

Categories of data subjects

Users of the controller who create or request content via the service (for example employees and administrators).
Recipients to whom an access link is transmitted, as well as any persons whose data the controller includes in encrypted content.

Special categories of personal data

The service is not designed for the processing of special categories of personal data within the meaning of Art. 9 GDPR. As the content is encrypted client-side, such data may nevertheless be transmitted from a technical point of view. The lawfulness of such processing and compliance with the additional requirements of Art. 9 GDPR are the sole responsibility of the controller.

Processing on documented instructions

We process personal data solely on documented instructions from the controller, unless we are required to process by Union or Member State law. In such a case we inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Use of the service within the contractually agreed scope constitutes an instruction. Supplementary or deviating individual instructions must be addressed in text form to the contact address stated in the section "Version and status of this document".

We inform the controller without undue delay if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. We are entitled to suspend the execution of such an instruction until it is confirmed or amended.

Owing to the zero-knowledge architecture, we are technically unable to carry out instructions that presuppose access to plaintext content. This applies in particular to instructions to disclose, rectify or examine the substance of encrypted content.

Personal data is processed in a third country or by an international organisation only to the extent that this is disclosed in the section on sub-processors and the requirements of Chapter V GDPR are met. The processing of the encrypted content itself takes place exclusively within the European Union.

Confidentiality of personnel

We ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

The group of persons with administrative access to the production systems is limited to the minimum strictly necessary for operations.

The obligation of confidentiality continues to apply after the end of the respective activity and after the termination of this agreement.

Technical and organisational measures (Art. 32 GDPR)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we implement the technical and organisational measures described below in order to ensure a level of security appropriate to the risk. The central safeguard is the architecture itself: content leaves the end device only in encrypted form.

Encryption and pseudonymisation (Art. 32 (1) (a) GDPR)

Content is encrypted exclusively in the user's browser using AES-GCM with a key length of 256 bits before it is transmitted to the server. A separate, randomly generated 12-byte nonce is used for each transaction. Only the browser's native Web Crypto interface is used.
The key is generated client-side and transmitted in the fragment part of the URL after the hash sign. As a matter of principle, browsers do not send this part of a URL to the server, and it is therefore not known to us. If a password is additionally set, key material is derived from it using PBKDF2-SHA256 with 1,200,000 iterations and combined with the fragment key via HKDF-SHA256 to form an AES-GCM-256 key.
When content is requested, an X25519 key pair is generated on the end device of the requesting person. The responding party encrypts using an ephemeral X25519 key pair generated anew for each response and an AES-GCM-256 key derived via HKDF-SHA256. The private key does not leave the end device of the requesting person.
In our database, content exists solely as ciphertext. No plaintext exists on the server side at any time, not even temporarily during delivery.

Physical access control

The servers are physically operated in a data centre of Hetzner Online GmbH in Falkenstein, Germany. Access protection, video surveillance, fire protection and uninterruptible power supply are ensured there by the data centre operator; the corresponding evidence is available via the operator. We do not maintain our own premises with access to the controller's personal data.

System access control

Administrative access to the servers takes place exclusively via SSH using public key authentication; password login is disabled.
Administrative accounts are assigned on a named-person basis and limited to the group of persons required for operations.
Passwords of user accounts are stored solely as hash values using a computationally intensive procedure suitable for passwords. Access credentials and key material for services are stored in encrypted form and are not held in the source code.
The systems are protected by a firewall; only those services required for operations are reachable from outside. Database and cache services are not accessible from outside.

Data access control

Within the application there is a role-based authorisation concept. Access to a transaction requires knowledge of the randomly generated access token.
Only the data required for the purpose is collected. Activity logs contain neither content nor access tokens nor key material.
Access to plaintext content is technically impossible even with full administrative rights, as the key is not available on the server side.

Transfer control

All transmissions between the end device and the server take place exclusively via TLS-encrypted connections. Unencrypted requests are redirected to HTTPS.
The key required for decryption is never transmitted over the wire to the server, but remains in the URL fragment on the end device.
The service employs security-related HTTP headers, including a Content Security Policy and HTTP Strict Transport Security, in order to impede the execution of foreign code and a downgrade of the transport encryption.

Input control

For transactions assigned to a user account, an activity log is kept which records the type of event and the time at which it occurred. It contains neither content nor access tokens. For anonymously created transactions, no logging at transaction level takes place, for reasons of data minimisation.

Availability control and resilience (Art. 32 (1) (b) and (c) GDPR)

Content is present solely as ciphertext and is therefore not readable in any copies of the database either. We do not warrant a regular backup regime for the production database under this agreement.
The operating system and the components used are updated regularly; security-related updates are applied promptly.
Operations are monitored; disruptions and error conditions are reported automatically. The current operating status can be viewed on a public status page.
Access limits are implemented to protect against automated attacks and overload. The counter keys used for this purpose are derived from the IP address using a secret key and are held in memory only for the duration of the relevant time window.

Separation control

The application is multi-tenant capable; data of different projects and organisations is processed logically separated in dedicated database schemas. Production, staging and development environments are separated from one another; no production personal data is used in development environments.

Secure development

Changes to the source code undergo a review and are deployed via an automated pipeline.
Static code analysis and automated tests are used, which must pass without errors prior to deployment.
The third-party libraries used are pinned to fixed versions and are changed exclusively via the deployment pipeline. Automated screening of those libraries for known vulnerabilities is not currently part of the pipeline.
The part of the service that is decisive for the encryption is open source and can be reviewed independently. In addition, we provide a reporting channel for security notices at "/.well-known/security.txt".

Testing and evaluation (Art. 32 (1) (d) GDPR)

The effectiveness of the measures is reviewed as and when required and upon material changes to the architecture, the systems or the sub-processors, and this document is updated accordingly.

Limits of the measures

We consider it part of a credible security commitment to also disclose what we do not provide:

We currently hold no certification under ISO/IEC 27001, no certification under Art. 42 GDPR, and we are not subject to any approved code of conduct under Art. 40 GDPR.
To date, no external security audit, no penetration test and no independent cryptography audit has been carried out.
The encryption takes place in the browser and relies on the program code delivered by us. Anyone who does not trust our delivery must review the open source code themselves; a compromise of the delivery could defeat the end-to-end encryption.
Even though content is not readable by us, metadata is generated, in particular timestamps, expiry periods and the fact that a transaction exists. This metadata is known to us.

Sub-processors

The controller grants general written authorisation for the engagement of further processors within the meaning of Art. 28 (2) sentence 2 GDPR. The sub-processors engaged at the time of conclusion of the contract are set out in the separately maintained list and are deemed authorised. The systems we operate ourselves, which are listed there alongside them, are not sub-processors; the provisions of this section do not apply to them.

We impose on each sub-processor, by contract, a level of protection that corresponds to the requirements of this agreement, and we remain liable to the controller for the sub-processor's compliance with the data protection obligations.

We inform the controller in advance of any intended changes concerning the addition or replacement of a sub-processor. The controller may object to such a change on important data protection grounds; in that case it has a right of extraordinary termination.

Neither the sub-processors engaged nor the systems we operate ourselves obtain access to plaintext content. The hosting provider processes ciphertext only; the remaining service providers process no transmitted content, but exclusively the data required for their respective purpose.

You will find the current list of sub-processors, including purpose, region and privacy information, here: List of sub-processors

Assistance with data subject rights

We assist the controller, in so far as this is possible, by appropriate technical and organisational measures for the fulfilment of its obligation to respond to requests by data subjects for the exercise of their rights under Chapter III GDPR (Art. 28 (3) (e) GDPR).

If a data subject contacts us directly, we forward the matter to the controller without undue delay, in so far as the request relates to processing carried out on its behalf. In such a case we do not respond independently.

We cannot comply with requests for access to, rectification of or disclosure of content, as the content is available to us solely as ciphertext. Deletion, by contrast, is possible at any time and also affects the ciphertext, which thereby becomes permanently unusable.

We further assist the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular with a data protection impact assessment and any prior consultation of the supervisory authority, and make the information available to us available for this purpose.

We provide the assistance services free of charge to the customary extent. For any effort going beyond this that is not attributable to a circumstance for which we are responsible, we may claim reasonable remuneration; we give advance notice of this.

Notification of personal data breaches

We inform the controller without undue delay after becoming aware of a personal data breach that has occurred in the course of the processing on its behalf (Art. 33 (2) GDPR). The information is provided in text form to the contact address of the controller known to us.

The notification contains, in so far as known to us, a description of the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed. Where not all information is immediately available, we provide it without undue delay thereafter.

We take the necessary measures without undue delay to secure the data and to mitigate possible adverse effects, and we agree any further measures with the controller.

The notification to the supervisory authority under Art. 33 GDPR and the communication to data subjects under Art. 34 GDPR are incumbent on the controller. We do not make such notifications independently on behalf of the controller, but we support it in doing so.

Security incidents and vulnerabilities may be reported at any time to hello@erseni.com and via the reporting channel published at "/.well-known/security.txt".

Deletion and return after the end of the contract (deletion concept)

The service is built such that deletion is the rule and retention the exception. Below we describe which data is deleted when and in what manner.

Deletion upon first retrieval

When content is retrieved, the record is read and at the same time physically removed from the table in a single atomic database operation. The delivered content thereafter exists only transiently in memory for the duration of the delivery. A second retrieval of the same link is thereby impossible; restoring the ciphertext is not possible for us.

Maximum retention period for content that is not retrieved

If content is not retrieved, it is deleted at the latest upon expiry of the validity period selected by the controller. The maximum period that can be selected depends on the plan used:

Free use and use without a user account: a maximum of 7 days
Pro plan: a maximum of 30 days
Business plan: a maximum of 30 days

Within these maximum limits the controller may select a shorter validity period; the shortest selectable period is one minute. An extension beyond the stated maximum limits is technically impossible.

Automated deletion of expired data

An automated deletion run removes expired records daily within a night-time window. Deletion takes the form of definitive removal from the database in batches; there is no marking as deleted and no recycle bin. It covers expired content, expired requests, expired status metadata and technical auxiliary data used for the prevention of misuse.

Status metadata and grace period

After content has been deleted, a purely status-related record remains for a grace period of 24 hours from expiry, so that the fate of a transaction remains traceable and a link that has already been retrieved does not incorrectly appear as unknown. This record contains only the type of transaction, the access token, the time of expiry and, where applicable, the times of the response and of the retrieval. It contains no ciphertext and no key material. Upon expiry of the grace period this record is deleted as well; the assignment of a transaction to a user account is automatically deleted along with it.

Account data and activity log

Activity log entries are deleted automatically once they are older than 90 days; a daily deletion run removes them permanently from the database. Account data is stored for the duration of the contractual relationship and deleted after its termination, unless statutory retention obligations preclude this; in that case the processing is restricted to the fulfilment of those obligations.

Backups

Backups are subject to their own retention cycle and are overwritten upon its expiry. Targeted deletion of individual items within existing backups does not take place; as content is present in backups solely as ciphertext and the associated key has never been known to us, it is not readable there.

Return and deletion after the end of the contract

After termination of the contract we delete all personal data processed on the controller's behalf, unless there is a statutory obligation to retain it. A return of the content is devoid of purpose, as it has either already been retrieved and thereby deleted or is present solely as ciphertext that is unreadable for us; the controller can make the content usable only by means of the key known to it.

Upon request we confirm the deletion to the controller in text form.

Evidence and audit rights

We make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller (Art. 28 (3) (h) GDPR).

Evidence is provided primarily by presenting this documentation, the description of the technical and organisational measures, the list of sub-processors and the evidence made available by our service providers.

Where this evidence is not sufficient in an individual case, we allow an on-site audit subject to reasonable advance notice, during normal business hours, without disruption to operations and while preserving confidentiality towards other customers. The mandated auditor must not be in competition with us.

Beyond the contractual evidence, the program code decisive for the encryption can be inspected and reviewed independently as open source code. We regard this as an essential element of demonstrating compliance.

We expressly point out that we are currently unable to present any certification or external audit report that would replace an audit by the controller.

Liability and final provisions

The liability of the parties is governed by Art. 82 GDPR and, in addition, by the liability provisions of our general terms and conditions. This does not entail any limitation of liability towards data subjects under Art. 82 GDPR.

The controller is solely responsible for the lawfulness of the processing, for the lawfulness of the content it transmits and for the secure forwarding of the access links and any passwords to the intended recipients. If an access link is disclosed to unauthorised persons, this lies outside our sphere of responsibility.

This DPA applies for the duration of the contractual relationship. It ends automatically upon its termination. The provisions on confidentiality and on deletion continue to apply beyond that.

Amendments and supplements to this DPA must be made in text form. This also applies to any waiver of this formal requirement.

Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions shall remain unaffected. The parties shall replace the invalid provision with a valid provision that comes closest to its economic and data protection purpose.

In all other respects, the provisions on applicable law and place of jurisdiction set out in our general terms and conditions apply, unless mandatory data protection rules preclude this.