Data processing agreement

1.Parties and purpose

1.1. This agreement (the "Agreement") is entered into between:

• the Customer: the person or company that holds a Vitalnodo account (IT technician, MSP or organization that manages its own machines); and
• Karim Boulares, an individual domiciled in Tegucigalpa, Honduras, who provides the Vitalnodo service (the "Provider"). Contact: privacidad@vitalnodo.com.

1.2. It forms part of the Terms of service and is accepted by accepting them. In the event of a conflict on data protection matters, this Agreement prevails.

1.3. It governs the processing of personal data that the Provider carries out on behalf of the Customer when providing the Service. It does not cover account data (users, billing, access security), which the Provider processes as controller under its Privacy policy.

2.Roles of the parties

2.1. The Customer is the controller (in Peru, the owner of the personal data bank) when it decides on its own to monitor the machines. When the Customer provides services to a third party (its "End Client", owner of the machines), it may act as that End Client's processor. In that case, the Provider acts as sub-processor, and the Customer warrants that its contract with the End Client authorizes it to engage the Provider and its sub-processors under the terms of this Agreement.

2.2. The Provider is the processor (or sub-processor) under:

• Peru's Personal Data Protection Law 29733 and its Regulations (DS 016-2024-JUS), as regards processing on behalf of others and subcontracting;
• art. 28 of Regulation (EU) 2016/679 (GDPR), when the Customer or the End Client is subject to the GDPR;
• the laws of Honduras and of any other jurisdiction that may apply.

3.Description of the processing

It is detailed in Annex I: subject matter, duration, nature, purpose, types of data and categories of data subjects.

4.Customer obligations

The Customer:

1. warrants that it has a legal basis for the processing and, in particular, the authorization of the owner of each machine on which it installs the agent;
2. informs the users of the machines when the law requires it. The Vitalnodo installer's notice helps, but it doesn't relieve the Customer of this duty: in silent or mass installations the notice is not shown on screen;
3. does not use the Service to monitor people or for purposes incompatible with the technical administration of machines;
4. does not include sensitive data in free-text fields (notes, tags, client or machine names) and does not upload photos of people or images with personal data as icons;
5. complies with the obligations it has as controller before the authority of its country (for example, registering its data banks or notifying cross-border flows, where required).

5.Provider obligations

5.1. Instructions. The Provider processes the data only to provide the Service and in accordance with the Customer's documented instructions, which are: these documents, the configuration the Customer sets in the app (machines, clients, icons, alert rules, recipients, plan) and any additional written instructions the parties agree on. It does not use the data for its own purposes or disclose it to third parties, except to the sub-processors in Annex III or where required by law. If a law requires it to process the data differently, it will inform the Customer beforehand, unless that law prohibits it. If it considers that an instruction infringes data protection law, it will inform the Customer immediately.

5.2. Confidentiality. It ensures that the persons authorized to process the data have committed to confidentiality or are under a statutory obligation of confidentiality.

5.3. Security. It applies the technical and organizational measures in Annex II. It may update them as long as it does not reduce the overall level of protection.

5.4. Sub-processors. It complies with section 6.

5.5. Data subject rights. Taking into account the nature of the processing, it helps the Customer respond to requests to exercise rights (ARCO rights and, where applicable, those in Chapter III of the GDPR). If it receives a request directly, it will forward it to the Customer within 5 business days and will not respond to it on its own unless instructed by the Customer. The Customer can, by itself, view, correct and delete machines and clients, and export the account data as JSON from the app.

5.6. Security incidents. It will notify the Customer of any incident affecting the data processed on its behalf without undue delay after confirming it, aiming to do so within 72 hours and, where possible, sooner, so that the Customer can meet its own deadlines (in Peru, 48 hours before the National Authority for Personal Data Protection in the cases set out in its Regulations; under the GDPR, 72 hours before the supervisory authority). The notification will be sent by email to the account owner and will include, to the extent known: a description of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed and a point of contact. If it does not have all the information, it will provide it in stages.

5.7. Additional assistance. It provides the Customer with the reasonable information it needs for impact assessments and prior consultations, according to the nature of the processing and the information available to it.

5.8. Return and deletion. See section 8.

5.9. Demonstrating compliance and audits. See section 9.

5.10. Records. It keeps a record of the processing activities it carries out on behalf of its customers when the law requires it.

6.Sub-processors

6.1. General authorization. The Customer gives the Provider general authorization to engage the sub-processors in Annex III, which are also published in Subprocessors.

6.2. Changes. The Provider will notify the Customer by email and on the subprocessors page of any new or replacement sub-processor at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may terminate the Service and, on a paid plan, is entitled to a refund of the proportional prepaid part not used.

6.3. Same obligations. The Provider only uses sub-processors that provide sufficient guarantees and that take on, by contract, data protection obligations substantially equivalent to those in this Agreement. The Provider is liable to the Customer for its sub-processors' compliance.

7.International transfers

7.1. The sub-processors process the data mainly in the United States (the database and storage are in Cloudflare's Eastern North America region) and, in Cloudflare's case, also across its global network of data centers. The Customer authorizes those transfers under the terms of this section.

7.2. Peru. The cross-border flow goes to recipients that take on, by contract, protection obligations equivalent to those of Law 29733 (art. 15) and its Regulations.

7.3. GDPR. When the Customer transfers to the Provider data subject to the GDPR, the parties incorporate by reference the standard contractual clauses of Implementing Decision (EU) 2021/914 (module 2 if the Customer is a controller; module 3 if it is a processor), with Annexes I and II of this Agreement as appendices. Transfers to the sub-processor are based on its own safeguards: Cloudflare states that it is certified under the EU-U.S. Data Privacy Framework and offers standard contractual clauses.

8.Return and deletion of data

8.1. While the Service is in effect, the Customer can export the account data as JSON from the app (owner and administrators), in Settings › Privacy & data.

8.2. Ongoing retention. The Provider automatically applies these periods:

• metric history: 30 or 90 days depending on the plan (trial and Technician: 30; Pro and MSP: 90); with an expired trial and no plan purchased, it is deleted 30 days after expiry;
• resolved alerts: 30 days (trial and Technician) or 90 days (Pro and MSP);
• in-app notifications: 90 days;
• audit log: 400 days;
• latest report and latest security posture of each machine: as long as the machine is in the account;
• uploaded icons: until the Customer deletes them or deletes the account.

8.3. Removing a machine. When a machine is removed, its metric history, latest report and security posture are deleted immediately, and the Service stops accepting its submissions. A minimal record of the machine (identifier, name, operating system, public key and digest of the machine identifier) is kept for 30 days and then purged.

8.4. End of the Service. When the account is deleted, the Provider immediately deletes from the Service's database all the data processed on the Customer's behalf and deletes the uploaded icons from storage. Automatic database recovery backups may keep them for up to 30 days, after which they disappear. Alert emails already delivered remain in their recipients' mailboxes and in the email provider's logs according to its retention. If the Customer wants to keep the data, it must export it before deleting the account. If a law requires any data to be kept, the Provider will block it and keep it only for the legal period.

8.5. If the account ends for another reason (for example, by decision of the Provider under the Terms), the Provider will give the Customer a reasonable period, of no less than 15 days except for legal or security reasons, to export the data before deleting it.

9.Information and audits

9.1. The Provider will make available to the Customer the information necessary to demonstrate compliance with this Agreement, primarily through documentation and answers to reasonable questionnaires.

9.2. If that is not enough, or if an authority requires it, the Customer (or an independent auditor bound by confidentiality who is not a competitor of the Provider) may carry out an audit, at most once a year except after a serious incident, with 30 days' notice, during business hours and without accessing other customers' data. The costs are borne by the Customer. Audits of the sub-processors are replaced by the documentation and certifications they publish.

9.3. The Provider does not claim any certifications of its own (such as ISO 27001 or SOC 2).

10.Liability

Each party's liability under this Agreement is governed by the limitation of liability section of the Terms, except where the law does not allow it to be limited.

11.Term

This Agreement applies for as long as the Provider processes data on the Customer's behalf and, after that, until the deletion or return in section 8 has been completed.

12.Remote access (future feature)

Remote access (terminal and desktop) is not available in the current version: it is turned off in the Service and the distributed agent doesn't contain it. If it is turned on, it will involve new processing (screen and terminal content transmitted in real time, session history) and will be governed by additional terms and an update to this Agreement and its annexes, which the Customer must accept before using it.

13.Governing law

This Agreement is governed by the law of the Republic of Honduras, without prejudice to the standard contractual clauses in section 7.3 being governed by the law they specify and to any mandatory data protection rules applicable to the Customer.

Annex I. Description of the processing

Annex II. Technical and organizational measures

Measures applied in version 1.0 of the Service. The Security page explains them in plain language.

1. Encryption in transit

All communication between the agent or the browser and the Service uses HTTPS (TLS). The agent validates the certificate against the system's trusted roots and doesn't allow unencrypted connections outside local development mode; the Windows installer requires TLS 1.2 or later. The website sends HSTS, a strict Content Security Policy (CSP) and other security headers (X-Content-Type-Options, Referrer-Policy: no-referrer, frame-ancestors 'none'). The agent only initiates outbound connections: it opens no ports on the machine.

2. Machine identity

At enrollment each machine generates its own Ed25519 key pair. The private key doesn't leave the machine and is stored in a directory accessible only by root or SYSTEM (and Administrators on Windows); the Service only stores the public key. Every agent request is signed (method, path, time and SHA-256 digest of the body). The Service rejects invalid signatures, requests more than 300 seconds off and removed machines, and discards repeated reports by their unique identifier. The machine identifier is only sent as a SHA-256 digest.

3. No reusable secrets in the database

Enrollment keys and web session tokens are stored only as a SHA-256 digest. The TOTP secret and the purchase license are stored encrypted with AES-GCM using a key that is not in the database. The server signing keys are not in the database, and the release publishing key exists only on the build machine, outside the cloud.

4. Isolation between accounts

Every query is filtered by the authenticated session's account, never by a value sent by the browser. Random, non-sequential identifiers. Icons are stored in object storage and served only to authenticated users of the account that uploaded them; only PNG, JPEG or WebP files verified by their content are accepted (never SVG), up to 256 KB and with limits on number and frequency. Roles within the account and optional restriction of each user to specific clients.

5. User authentication

Passwords with PBKDF2-SHA256 (100,000 iterations) and a random 16-byte salt; at least 10 characters and rejection of common passwords. Two-step verification (TOTP) available to all users. Lockout after 10 failed attempts in 15 minutes per email and 30 per IP; responses don't reveal whether an email exists. HttpOnly, Secure and SameSite=Lax session cookie, with a maximum lifetime of 14 days; state-changing operations require an origin check and an anti-CSRF header. Rate limits on sign-up, sign-in, recovery, machine enrollment and export.

6. Audit log and notices

Audit log of sensitive actions with user, IP and date, kept for 400 days and visible to the Customer. Email notices to the account owner for sign-ins from a new IP, 2FA being turned off and enrollment keys being created.

7. Control of machine enrollment

Rotatable and revocable enrollment keys, with optional expiry and maximum number of uses. On the MSP plan, optional manual approval of each new machine. Key changes when a machine is reinstalled are logged.

8. Agent integrity

The installers verify the binary's SHA-256 before installing it. Automatic updates are based on a manifest signed with Ed25519, whose public key is compiled into the agent; the agent verifies the signature and SHA-256 before installing and restores the previous version if the new one doesn't report within 5 minutes. Reports have size and range limits validated by the agent and by the Service.

9. Availability and recovery

Cloudflare infrastructure. The database can be restored to any point in the last 30 days. Object storage is encrypted at rest according to the provider.

10. Minimization and retention

The agent doesn't collect files, documents, browsing, keystrokes, screenshots or processes with arguments (Annex I). The security posture is read without modifying the machine. To know whether a system is still supported, the Service checks a public catalog without sending any machine data. Automatic daily purge according to the periods in section 8. Version 1.0 is distributed without the remote access feature.

11. Organizational measures

Access to the production infrastructure is limited to the Provider's authorized personnel (currently, the owner) with personal accounts. Before launch, two independent internal audits of the code and configuration were carried out, and the issues found were fixed. The Provider follows an incident management procedure with the deadlines in section 5.6 and reviews this annex whenever the architecture changes. The Provider does not claim its own encryption at rest of the database, other than for the secrets listed in point 3, nor any certifications of its own.

Annex III. Authorized sub-processors

Gumroad, Inc. does not process machine data: only billing data of the Customer's account, in a direct relationship with the Customer as reseller. It is mentioned in the Privacy policy and in Subprocessors.