Data Processing Agreement

Last updated 5 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Two Trick Pony Enterprise ("Processor", "we") and the customer ("Controller", "you"). It applies when we process personal data on your behalf as part of the service, and meets Article 28 of the GDPR. It applies automatically; no signature is needed. If you need a signed copy, email djangocloud@petervandoorn.com.

1. Roles and scope

You are the controller (or processor for your own customers) of personal data contained in your applications, code, environment settings, build output and logs ("Customer Personal Data"). We process it as your processor only to provide the service. For account, billing and website data we are an independent controller; see the Privacy Policy.

2. Our obligations

1. Process Customer Personal Data only on your documented instructions, which are these terms and your use of the service. If we believe an instruction breaks the law, we tell you.
2. Make sure everyone with access is bound by confidentiality.
3. Apply the security measures in Annex II.
4. Use only the sub-processors in Annex III, bound by terms no less protective than this DPA, and stay responsible for them. We give you 30 days' notice of new or replaced sub-processors by email or dashboard, and you may object on reasonable data protection grounds; if we cannot resolve it you may terminate the affected service.
5. Help you answer requests from data subjects and meet your obligations on security, breach notification, impact assessments and consultation with authorities, taking account of the nature of processing.
6. Notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have.
7. On termination, delete or return Customer Personal Data (logs, release and configuration data) within 30 days, unless law requires us to keep it. Data in your own AWS account stays there under your control.
8. Give you the information needed to show compliance and allow audits, by written questionnaire and, if that is not enough, an audit at reasonable notice, during business hours, at your cost, without disrupting the service or exposing other customers' data.

3. Your obligations

You confirm you have a lawful basis for the data you put through the service, that your instructions comply with the GDPR, and that you will respond to data subjects who contact you.

4. International transfers

We process Customer Personal Data on our platform in Frankfurt, Germany (AWS eu-central-1). Your deployed application itself runs in your own AWS account, in the region you select, under your control. Where a sub-processor transfers data outside the EEA, it is under the EU–US Data Privacy Framework or the Standard Contractual Clauses (module 3, processor to processor), which are incorporated here by reference.

5. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on data protection, this DPA prevails.

Annex I: Details of processing

Annex II: Security measures

• Encryption in transit (TLS) and encryption at rest for stored credentials (your AWS secret key) and sensitive settings.
• Passwords stored only as salted hashes; sessions and CSRF protection enabled.
• Access to production systems limited to staff who need it, using individual accounts and strong authentication.
• Customer deployments isolated per project; actions in your AWS account performed with your least-privilege IAM role (or IAM user).
• Webhook signatures verified; secrets kept out of logs and source control.
• Logging and monitoring of the service, regular dependency updates, and backups of our database .

Annex III: Sub-processors

Analytics tools (Mixpanel, Microsoft Clarity) are used only on our own website and dashboard, not on your applications, and are described in the Privacy Policy.