Snapshot 166743
Normalized text
Scripts and page chrome removed; this is what change detection compares.
We use cookies
We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking "Accept", you consent to our use of cookies. Read our Cookie Policy for more information.
Data Processing Agreement
Back to Home
Trust Center
Security, Privacy & Compliance
Quick Links
Privacy PolicyTerms of ServiceCookie PolicyData Processing Addendum
This Data Processing Agreement ("DPA") forms part of the subscription agreement between Cloudevolve Inc. ("Cloudevolve", "we", "us") and you ("Customer", "Controller") and governs the processing of Personal Data carried out by Cloudevolve on your behalf in connection with the Cloudevolve platform and services. This DPA is designed to satisfy the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
By using Cloudevolve services, Customer agrees to the terms of this DPA. If you are acting on behalf of a company or other legal entity, you represent that you have the authority to bind that entity to this DPA.
Definitions
The following terms have the meanings set out below. Terms not defined here carry the meanings assigned by applicable data protection law.
"Personal Data"— Any information relating to an identified or identifiable natural person as defined under applicable data protection law.
"Processing"— Any operation performed on Personal Data, whether automated or manual, including collection, storage, use, disclosure, deletion, or destruction.
"Controller"— The Customer — the entity that determines the purposes and means of processing Personal Data.
"Processor"— Cloudevolve — the entity that processes Personal Data on behalf of the Controller under this DPA.
"Sub-processor"— Any third party engaged by Cloudevolve to process Personal Data in connection with the services.
"Data Subject"— A natural person whose Personal Data is processed under this DPA.
"Security Incident"— A confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
Roles & Responsibilities
Customer as Controller: The Customer determines why and how Personal Data is collected and used in relation to their cloud infrastructure. The Customer is responsible for ensuring that its instructions to Cloudevolve are lawful and that it has obtained all necessary consents or legal bases for the processing described in this DPA.
Cloudevolve as Processor: Cloudevolve processes Personal Data only on documented instructions from the Customer and only for the purposes necessary to deliver the contracted services. Cloudevolve will not sell, rent, or otherwise commercially exploit Customer Personal Data.
Cloudevolve personnel with access to Customer data are bound by confidentiality obligations. Cloudevolve will promptly inform the Customer if it believes an instruction infringes applicable data protection law.
Scope of Processing
Cloudevolve processes Personal Data solely to provide, maintain, secure, and improve the Cloudevolve platform in accordance with Customer's subscription. Processing activities include:
Reading cloud account metadata (account IDs, resource names, tags) via read-only IAM roles
Collecting infrastructure metrics (compute, storage, network utilization)
Analyzing billing and usage data to generate cost optimization recommendations
Evaluating security posture and compliance findings
Storing user account information for platform authentication and access control
Processing support communications to resolve incidents and inquiries
Cloudevolve operates on a strictly read-only architecture. We never create, modify, or delete resources in Customer cloud environments. All IAM roles use least-privilege, read-only policies that are auditable in the Customer's own AWS, Azure, or GCP console.
Data Subjects & Categories of Personal Data
Data Subjects may include:
Customer employees and administrators who use the Cloudevolve platform
Cloud resource owners identified in account metadata or resource tags
End users whose usage patterns are reflected in cloud telemetry data
Categories of Personal Data processed:
Account data: Name, email address, role, and login credentials for platform users
Cloud metadata: Resource identifiers, tags, and annotations that may contain personal identifiers
Usage data: Feature usage, session logs, and audit trails within the Cloudevolve platform
Support data: Communications submitted via support tickets or email
Cloudevolve does not intentionally process special categories of data (sensitive personal data) as defined under GDPR Article 9. Customers should avoid including such data in cloud resource tags or support communications.
Sub-processors
Cloudevolve uses a limited number of trusted sub-processors to deliver its services. All sub-processors are bound by data processing agreements that provide at least the same level of protection as this DPA.
Cloudevolve will provide Customers with at least 30 days' prior written notice of any intended changes to sub-processors (additions or replacements), giving Customers the opportunity to object. The complete and up-to-date list of sub-processors is available on the Sub-processors page of our Trust Center.
Key categories of sub-processors include: cloud infrastructure providers, analytics and monitoring tools, customer support platforms, and payment processors. None of these sub-processors are granted broader access to Customer data than is necessary to fulfill their specific function.
Technical & Organizational Measures
Cloudevolve implements comprehensive technical and organizational measures (TOMs) designed to ensure a level of security appropriate to the risk, including:
Encryption
All data in transit is encrypted using TLS 1.2 or higher
All data at rest is encrypted using AES-256
Encryption keys are managed via AWS KMS with automated rotation
Access Controls
Role-based access control (RBAC) with least-privilege enforcement
Multi-factor authentication (MFA) required for all internal systems
Privileged access management (PAM) with just-in-time access for production
Regular access reviews and deprovisioning of stale accounts
Network Security
Virtual Private Cloud (VPC) isolation with strict security group rules
Web Application Firewall (WAF) protecting all customer-facing endpoints
DDoS protection and traffic scrubbing via AWS Shield
Intrusion detection and prevention systems (IDS/IPS)
Monitoring & Logging
Continuous security monitoring with 24/7 alerting
Immutable audit logs stored in tamper-evident storage
Anomaly detection and behavioral analytics on system access
Structured incident response process with defined SLAs
Organizational Measures
Annual security awareness training for all employees
Background checks for employees with access to Personal Data
Vendor security assessments before onboarding sub-processors
Internal data protection policies reviewed annually
International Data Transfers
Cloudevolve primarily processes data within the United States on AWS infrastructure. Where Personal Data of EU/EEA or UK data subjects is transferred outside those territories, Cloudevolve ensures adequate safeguards are in place, including:
Standard Contractual Clauses (SCCs): We incorporate the EU Commission's approved SCCs (2021/914) into agreements with sub-processors for transfers from the EEA to third countries.
UK IDTA: For transfers from the UK, we use the UK International Data Transfer Addendum (IDTA) issued by the ICO.
Data Residency Options: Enterprise customers may request data residency within specific AWS regions (e.g., EU-West) to minimize cross-border transfers.
Cloudevolve conducts Transfer Impact Assessments (TIAs) where required to ensure that the level of protection afforded to Personal Data is not undermined by conditions in the destination country.
Data Retention & Deletion
Cloudevolve retains Personal Data only as long as necessary to fulfill the contracted services or as required by applicable law. Our retention periods are:
Active account data:Retained for the duration of the subscription
Cloud telemetry & metrics:Retained for up to 13 months for trend analysis; configurable by Customer
Audit logs:Retained for 12 months, then archived for an additional 24 months
Support communications:Retained for 36 months after ticket closure
Billing records:Retained for 7 years as required by financial regulations
Upon termination of the subscription, Cloudevolve will, at the Customer's choice, delete or return all Personal Data within 30 days. Customers may request a data export via the platform or by contacting privacy@cloudevolve.com before account termination.
Data Subject Rights
As Processor, Cloudevolve will assist the Customer (Controller) in responding to data subject requests. Where data subjects contact Cloudevolve directly, we will redirect them to the relevant Customer unless legally required to respond directly.
Cloudevolve provides tooling and documentation to support:
Right of Access (Art. 15 GDPR): Customers can export their data from the platform at any time
Right to Rectification (Art. 16 GDPR): Account data can be updated via platform settings
Right to Erasure (Art. 17 GDPR): Customers may request deletion of Personal Data via our DPO
Right to Restriction (Art. 18 GDPR): Processing can be restricted upon request while a dispute is resolved
Right to Data Portability (Art. 20 GDPR): Data exports are available in machine-readable formats (JSON, CSV)
Right to Object (Art. 21 GDPR): Customers may object to specific processing activities by contacting our DPO
Cloudevolve will respond to verified data subject requests within 30 days, extendable by a further 60 days where the request is complex or numerous.
Breach Notification
In the event of a confirmed Security Incident involving Customer Personal Data, Cloudevolve will:
Notify the affected Customer without undue delay, and within 72 hours of becoming aware of the incident
Provide a detailed description of the nature of the incident, the categories and approximate number of data subjects affected, and the likely consequences
Describe the measures taken or proposed to address the breach and mitigate its possible adverse effects
Assign a dedicated incident coordinator as a single point of contact for the Customer
Cloudevolve maintains a documented Incident Response Plan (IRP) that is tested annually via tabletop exercises. Evidence of testing is available to Customers under NDA upon request.
To report a suspected security incident, contact: security@cloudevolve.com
Audits & Inspections
Cloudevolve commits to supporting Customer audit rights as required by applicable data protection law. Our approach to audits:
Third-party certifications: Cloudevolve maintains SOC 2 Type II and ISO 27001 certifications. Reports and certificates are provided to Customers upon request under NDA, satisfying most audit requirements without on-site inspections.
Questionnaires: Cloudevolve will complete Customer security questionnaires within 15 business days.
On-site audits: Customers with a legitimate need may request an on-site or virtual audit with a minimum of 30 days' notice. Audits must be conducted during business hours and must not unreasonably interfere with operations. Customers bear the cost of third-party auditors.
Request an Executed DPA
Enterprise and growth-tier customers may request a countersigned Data Processing Agreement tailored to their regulatory requirements. Our DPA template can be extended with:
EU Standard Contractual Clauses (SCCs) or UK IDTA for international transfers
HIPAA Business Associate Agreement (BAA) for healthcare customers
Custom data residency or retention terms for enterprise agreements
To request an executed DPA, please contact our Data Privacy Officer with your organization name, jurisdiction, and any specific regulatory requirements:
dpo@cloudevolve.com
On this page
Data Privacy Officer
dpo@cloudevolve.com
We use cookies
We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking "Accept", you consent to our use of cookies. Read our Cookie Policy for more information.